What is the best alternative to replace your TN3270 emulator?

The promises heavy TN3270 emulators made years ago are starting to wane. In the beginning, these emulators brought convenience and cost savings. Unfortunately, security breaches and performance issues followed some years after.

SO, it’s time to get rid of that expensive TN3270 emulator, but what is the alternative?

What is wrong with heavy client TN3270 emulators?

As the name implies, traditional TN3270 emulators require a thick client to be installed on your workstation. However, this TN3270 emulator needs a wide array of elements to work properly.

To secure unencrypted data between the TN3270 emulator on the user’s desktop and the mainframe outside of the company network, most companies chose to invest in a VPN. Not only is this an additional cost, but it is also another piece of software to monitor and maintain.

Activating TLS on these emulators, if compatible, seemed like a good way to bypass VPNs. However, configuring TLS on the emulator requires a lengthy intervention on each workstation. This is why many companies are reluctant to make this change and are stuck with VPNs.

Speaking of change, heavy TN3270 emulators are also extremely vulnerable to OS changes. Significant efforts are required to ensure their compatibility, which can explain why some companies choose to postpone (sometimes for years) their migration to Windows 10 for example.

Moreover, many heavy TN3270 emulators are reliant on Java plugins which are vulnerable to security breaches. Not to mention that Java’s licensing costs can get unpredictably high. Your maintenance teams are getting weary from employees requesting help with installing updates and security patches – the emulator needs to be done on every single PC.

What about web-based TN3270 emulators with middle-tier servers?

Middle-tier architecture is appealing. Getting rid of any installation on the user’s side is already a step in the right direction. All the hard work of conversion from PC to mainframe is done on the middle-tier server.

However, middleware servers are also full of issues, the biggest one being security. By design, middle-tier servers translate data between two protocols: HTTPS and TN3270.

Unfortunately, TN3270 is an old protocol that is quite complicated to secure. It is derived from Telnet which is no longer used on Unix platforms that favour more secure protocols such as SSH.

Middle-tier servers also represent an additional stage to access the mainframe computer; another piece added to the infrastructure. This makes the whole mainframe environment more vulnerable because any middle-tier-server failure can completely break access to the mainframe.

They also need to be included in the capacity planning process and thereby increasing the total cost of ownership.

Solution – Two-tier Web-based TN3270 emulator to access Mainframes.

What is meant by two-tier web-based access? Well, the middle-tier is removed, leaving 2 “tiers” – the mainframe and the PC. The TN3270 emulator is installed software directly on the mainframe. It can then be accessed through any standard web browser (and its subsequent updates) through a URL. This enables the following benefits:

1. Security

Two-tier architecture benefits from reinforced security as it is directly installed on the mainframe. The emulator’s own internal security system can function by interacting with the leading ESM tools such as RACF, TOP-SECRET, and ACF2.

Moreover, when it uses SSL, the emulator builds on the z/OS system’s ATTLS layers which makes it compliant with the most recent security levels.

Similarly, this architecture uses standard and modern web browsers, which are constantly updated and are one of the most secured pieces of software in modern IT.

2. Eliminate the unnecessary and save money

This means you can remove the additional software mentioned above such as Java, and VPNs. Which in turn means that you don’t have to worry about updating them and dealing with their security issues.

This also means that you are effectively lowering your TCO by not buying unnecessary licenses and you will also save on a session manager since modern two-tier TN3270 emulators already have one built-in.

3. Maintenance & Support is easier

Eliminate repetitive tasks. With a two-tier TN3270 emulator, there is nothing to install on each workstation/PC and nothing to update, except for web-browsers.

There is no need to manage a middle-tier server (no longer required) and no more worries about Windows 10 compatibility. Things that will delight your maintenance team, not to mention full IPv6 compatibility as well

More importantly, everything related to the TN3270 emulator will be found in one place, the mainframe.

4. Flexibility and scalability

Let your employees work from whatever device they want, without having to worry about security and sign-on from anywhere, anytime with any SSO tool on the market. Two-tier web-based access makes life simpler for everyone.

Not only does this give easy access to the employees, but it’s also the case for contractors and other third-party collaborators. They can finally be free from restrictions on which operating system version to use and what software they can install on their workstations/PCs.

If you add the compatibility with all existing SSO solutions, you have a very convenient and easy-to-use piece of mainframe software.

Two-tier TN3270 emulators allow multiple concurrent user sessions (up to 10,000) without any loss of performance. This makes for a very efficient and scalable solution or a web-VDI oriented solution.

Two-tier TN3270 emulators are not only secure, easy to maintain, and flexible, they are also non-invasive. Their installation will not disrupt your business. The transition will be seamless and allow you to transition at your own pace, without having to rebuild your entire infrastructure or write a single line of code.