IT23216: DSMC -FORCEFAILOVER=YES COMMAND DOES NOT HONOR REPLTCPPORT CAUSING THE CONNECTION TO FAIL (ANS5216E)

IBM Spectrum Protect client 8.1.x.y interim fix downloads
IBM Spectrum Protectâ„¢ Client 8.1.6 Downloads and READMEs

APAR status

• Closed as program error.

Error description

• When node replication is configured and the dsmc
  -forcefailover=yes command is issue to intentionally connect to
  the replication server, it can fail with ANS5216E error.
  
  For example, if the secondary server's hostname is "tsmserver1"
  and REPLTCPPORT is set to 21500, the following message sequence
  can be observed on the client:
  
  ANS2107I   Attempting to connect to secondary server tsmserver1;
  at tsmserver1; : 21500;
  ANS5216E   Could not establish a TCP/IP connection with address
  'tsmserver1:1500'. The TCP/IP error is 'No connection could be
  established No connection could be made because the target
  machine actively refused it' (errno = 10061).
  
  A Client SERVICE trace will show the following:
  
  2017/09/15 11:25:00.061 [029922] [4159158080] : optcallbacks.cpp
  (1329): optReplServerCallback: Processing OPT_REPLSERVERNAME
  2017/09/15 11:25:00.061 [029922] [4159158080] : optcallbacks.cpp
  (1346): optReplServerCallback: added new replication server to
  list: TSMSERVER1
  2017/09/15 11:25:00.061 [029922] [4159158080] : optservices.cpp
  (9065): Fail Over TCP Server Name: TSMSERVER1 Address: N/A Port:
  1500 SSL Port: 1500 GUID: N/A Used: no
  2017/09/15 11:25:00.061 [029922] [4159158080] : optcallbacks.cpp
  (1285): Entering optReplServerCallback(), source = 1
  2017/09/15 11:25:00.061 [029922] [4159158080] : optcallbacks.cpp
  (1421): optReplServerCallback: Processing
  OPT_REPLTCPSERVERADDRESS
  2017/09/15 11:25:00.061 [029922] [4159158080] : optservices.cpp
  (9065): Fail Over TCP Server Name: TSMSERVER1 Address:
  tsmserver1 Port: 1500 SSL Port: 1500 GUID: N/A Used: no
  2017/09/15 11:25:00.061 [029922] [4159158080] : optcallbacks.cpp
  (1285): Entering optReplServerCallback(), source = 1
  2017/09/15 11:25:00.061 [029922] [4159158080] : optcallbacks.cpp
  (1435): optReplServerCallback: Processing OPT_REPLTCPPORT
  2017/09/15 11:25:00.061 [029922] [4159158080] : optservices.cpp
  (9065): Fail Over TCP Server Name: TSMSERVER1 Address:
  tsmserver1 Port: 21500 SSL Port: 1500 GUID: N/A Used: no
  ...
  2017/09/15 11:25:00.218 [029922] [4159158080] : commtcp.cpp
  (1727): TcpOpen: Trying to connect to server at:
  2017/09/15 11:25:00.218 [029922] [4159158080] : commtcp.cpp
  (1728):              Domain Name: tsmserver1
  2017/09/15 11:25:00.218 [029922] [4159158080] : commtcp.cpp
  (1730):              Port #: 1500
  2017/09/15 11:25:00.218 [029922] [4159158080] : commtcp.cpp
  (1756): TcpOpen: using blocking sockets
  2017/09/15 11:25:00.219 [029922] [4159158080] : pscomtcp.cpp
  (1224): psTcpConnect(): Attempt socket 7 (IPv4) connection ->
  rc=-1, errno=111
  2017/09/15 11:25:00.219 [029922] [4159158080] : commtcp.cpp
  (1844): TcpOpen(): connect(): errno = 111. Re-trying connect 1
  
  
  The symptom observed is that client is attempting to connect to
  REPLSSLPORT (SSL Port: 1500) instead of REPLTCPPORT (Port:
  21500). REPLTCPPORT should be used to connect to a server socket
  instead of REPLSSLPORT unless SSL option is explicitly set to
  YES
  
  
  IBM Spectrum Protect Versions Affected:
  IBM Spectrum Protect client on all platforms
  
  
  Initial Impact:
  Medium
  
  
  Additional Keywords:
  Spectrum Protect; TSM; client; replication; REPLTCPPORT;
  REPLSSLPORT; ANS5216E
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * IBM Tivoli Storage Manager backup archive client version 7.1 *
  * running on all platforms.                                    *
  * IBM Spectrum Protect backup archive client version 8.1       *
  * running on all platforms.                                    *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See ERROR DESCRIPTION                                        *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Apply fixing level when available. This problem is currently *
  * projected to be fixed in level 8.1.4.1 and 8.1.6. Note that  *
  * this is subject to change at the discretion of IBM.          *
  ****************************************************************
  

Problem conclusion

• Background: backup archive client tried to use SSL port to
  connect to the server, when establishing secure connection.
  Spectrum Protect server starting from versions 7.1.8 and 8.1.2
  enforces all connections to be secure. The client is expected to
  use regular TCP port if replication server stanza does not
  explicitly prescribes SSL port usage with "SSL yes" option.
  Problem: client tries to connect to the server using SSL port
  when notices the connection is secured.
  Fix: the client now uses TCP port to connect to the server
  unless the replication server stanza contains "SSL yes" option.
  Backup archive client now uses proper port to connect to
  replication server.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Modules/Macros

• dsmc
  

Fix information

• Fixed component name

  TSM CLIENT

• Fixed component ID

  5698ISMCL

Applicable component levels

• R81L PSY

     UP

• R81A PSY

     UP

• R81W PSY

     UP

• R81H PSY

     UP

• R81S PSY

     UP