MF53862 - TCPIP-INCORROUT IKE packets not returned if NAT rules applie

TYPE PROGRAM  REL  NUMBER   MIN/MAX  OPTION
---- -------- ---  -------  -------  ------
NONE



NOTICE:
-------
Application of this PTF may disable or render ineffective programs that
use system memory addresses not generated by the IBM translator,
including programs that circumvent control technology designed to limit
interactive capacity to purchased levels.  This PTF may be a prerequisite
for future PTFs.  By applying this PTF you authorize and agree to the
foregoing.

This PTF is subject to the terms of the 'IBM License Agreement for Machine
Code', the terms of which were provided in a printed document that was
delivered with the machine.

SUBJECT TO ANY WARRANTIES WHICH CAN NOT BE EXCLUDED OR EXCEPT AS EXPLICITLY
AGREED TO IN THE APPLICABLE LICENSE AGREEMENT OR AN APPLICABLE SUPPORT
AGREEMENT, IBM MAKES NO WARRANTIES OR CONDITIONS EITHER EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OR CONDITIONS OF
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND NON INFRINGEMENT,
REGARDING THE PTF.





APAR Error Description / Circumvention

-----------------------------------------------
System i configured with Hide NAT prevents VPN traffic coming
from local PC to process correctly. The outbound 500,IKE traffic
will make it out, but the return traffic to the PC will fail.

CORRECTION FOR APAR MA41263 :
-----------------------------
If NAT rules applied along with IpSec, the NAT rules are
bypassed because of invalid checks for IKE packet. (UDP port
500/4500)

CIRCUMVENTION FOR APAR MA41263 :
--------------------------------
None.


Activation Instructions


None.




Special Instructions


Perform the following to apply/remove this PTF:
> remove all filter rules
> apply/remove PTF
> reapply filter rules.

********************************************************************
THE FOLLOWING ARE SUPERSEDED SPECIAL INSTRUCTIONS. IF THE SUPERSEDED
PTF HAS ALREADY BEEN APPLIED AND ITS SPECIAL INSTRUCTION FOLLOWED,
IT IS NOT NECESSARY TO FOLLOW THAT SPECIAL INSTRUCTION AGAIN.
********************************************************************

SPECIAL INSTRUCTIONS FOR SUPERSEDED PTF MF51249 :
=================================================

After Apply/remove this PTF, perform the following:
endtcpsvr *vpn
strtcpsvr *vpn


Default Instructions

THIS PTF CAN BE APPLIED IMMEDIATE OR DELAYED.



Supersedes

PTF/FIX NO(S).  APAR TITLE LINE
--------------  ------------------------------------------------------------
   MF51249      TCPIP-INCORROUT IPv6 Tunnel mode fragmentation issue

Summary Information

System i Support