Troubleshooting
Problem
Following the application of APAR IJ53189, structural modifications were made to the Object Data Manager (ODM) class definitions. These changes were intended to resolve a defect regarding duplicate rules for ports 32768 and above. However, the schema change results in a binary incompatibility between the updated ODM libraries and existing IPSec ODM entries created under the legacy schema.
Symptom
The customer may encounter errors during IPSec device configuration or while managing filter rules. Common symptoms include:
During device configuration:
ipsec_v4 AvailableCan not get IPv4 default filter rule.0519-002 libodm: The CLASS_SYMBOL does not identify a valid object class.
- While running genfilt:
genfilt: Cannot get IPv4 default filter rule.0519-002 libodm: The CLASS_SYMBOL does not identify a valid object class.Check parameters, path name and permissions.
Cause
The defect is caused by a schema mismatch. APAR IJ53189 altered the internal structure of the ipsec_filter ODM class. Because the ODM entries on the system still reside in the old format, the updated libodm cannot correctly map the CLASS_SYMBOL, leading to a failure in identifying the object class.
Environment
This only affects AIX 7.3 TL4.
Diagnosing The Problem
To confirm this issue, check if the ipsec_v4 device is available, but filter commands fail:
Run
lsdev -Cc ipsecto ensure the device is listed.Execute
genfilt -v 4.If the command returns 0519-002 libodm errors despite the device being present, the system is experiencing the schema incompatibility described in this technote.
Resolving The Problem
A permanent fix is under development and will be included in the next scheduled Service Pack (SP).
For now, an iFix is being developed to overcome this defect.
In the interim, the following workaround can be used to re-initialise the ODM classes with the new schema while preserving existing rules:
Please run the following commands:
# cd /etc/security# ODMDIR=. odmget ipsec_filter > /tmp/ipsec_filter.odmadd # rm ipsec_filter*# lsfilt# ODMDIR=. odmdelete -o ipsec_filter# ODMDIR=. odmadd < /tmp/ipsec_filter.odmaddThis will make sure all the rules that existed previously are added back to the freshly initialised ODM.
If you have multiple systems and have not yet updated all of them, it is highly recommended to export your filter rules from the un-updated systems first. This ensures you have a clean, high-level backup of your rules that can be easily re-imported if the ODM corruption occurs after the update.
On a system not yet updated, run:
expfilt -r -p -f
Related Information
Document Location
Worldwide
Was this topic helpful?
Document Information
Modified date:
13 February 2026
UID
ibm17260772