If you configure TCP/IP Services before you add the system to a cluster, when you add the system to the cluster the owning UIC for each of the TCP/IP service SYS$LOGIN directories (TCPIP$service-name, where service-name is the name of the service) may be incorrect. Use the OpenVMS AUTHORIZE utility to correct these UICs.

2.6 TCPIP$CONFIG.COM Changes

The following sections describe changes to the TCPIP$CONFIG.COM configuration procedure in this release.

2.6.1 Warning Message in TCPIP$CONFIG.COM

If you have run the TCPIP$IP6_SETUP.COM configuration procedure to enable IPv6, then when you run the TCPIP$CONFIG.COM configuration procedure, the following warning message appears when you select the Core environment option:

WARNING This node has been configured for IPv6. If you make any additional changes to the configuration of the interfaces, you must run TCPIP$IP6_SETUP again and update your host name information in BIND/DNS for the changes to take effect.

2.6.2 Disabling or Enabling SSH Server

When you use the TCPIP$CONFIG.COM configuration procedure to disable or enable the SSH server, the following prompt is displayed:

* Create a new default Server host key? [YES]:

Unless you have a specific reason for creating a new default server host key, you should enter "N" at this prompt. If you accept the default, clients with the old key will need to obtain the new key. For more information, see Section 3.11.6.

2.7 SSH Configuration Files Must Be Updated

The SSH client and server on this version of TCP/IP Services cannot use configuration files from previous versions of SSH.

If the SSH client and server detect systemwide configuration files from an older version of SSH, the client and server will fail to start. The client will display the following warning message, and the server will write the following warning message to the SSH_RUN.LOG file:

You may have an old style configuration file. Please follow the instructions in the release notes to use the new configuration files.

If the SSH client detects a user-specific configuration file from an older version of SSH, the SSH client will display the warning and will allow the user to proceed.

To preserve the modifications made to the SSH server configuration file and the SSH client configuration file, you must edit the templates provided with the new version of SSH, as follows:

1. Extract the template files using the following commands:

   $ LIBRARY/EXTRACT=SSH2_CONFIG SYS$LIBRARY:TCPIP$TEMPLATES.TLB - _$ /OUT=TCPIP$SSH_DEVICE:[TCPIP$SSH.SSH2]SSH2_CONFIG. $ LIBRARY/EXTRACT=SSHD2_CONFIG SYS$LIBRARY:TCPIP$TEMPLATES.TLB - _$ /OUT=TCPIP$SSH_DEVICE:[TCPIP$SSH.SSH2]SSHD2_CONFIG.

   
   These commands copy the new template files into the SSH2 configuration directory with a new version number.

2. Copy the modifications made in the old versions of the configuration files to the new versions.
3. Start SSH using the following command:

   $ @SYS$STARTUP:SSH_STARTUP.COM $ @SYS$STARTUP:SSH_CLIENT_STARTUP.COM

If SMTP or LPD shutdown generates errors indicating that the queue manager is not running, check your site-specific shutdown command procedure (VMS_SYSHUTDOWN.COM). If this procedure contains the command to stop the queue manager (STOP/QUEUE/MANAGER), make sure this command is after the command that runs the TCPIP$SHUTDOWN.COM command procedure.

This chapter provides information about problems and restrictions in the current version of TCP/IP Services, and also includes other information specific to a particular command or service, such as changes in command syntax or messages.

3.1 Restrictions on OpenVMS I64 Platforms

The following restrictions apply to OpenVMS I64 platforms only:

• The output of the TCP/IP management command SHOW VERSION/ALL differs from the output seen on OpenVMS Alpha and VAX systems. (The information is listed in one column, and the image name and location are combined.)
• The following components do not work on OpenVMS I64 platforms for this release:
  • NFS server
  • PPP

The NFS server is fully functional on Alpha platforms, but it does not work on I64 platforms for this release. This problem will be fixed in a future update to TCP/IP Services.

On I64 systems, NFS-related components are installed so that the NFS server can be provided in a future release. However, these components will not run. Attempts to start them will fail or result in an error.

You can configure the NFS server on I64 systems, but you cannot successfully start the server. The server will immediately exit. The associated TCP/IP management commands will return errors. For example:

TCPIP> SHOW MAP %LIB-E-KEYNOTFOU, key not found in tree %TCPIP-E-CFSERROR, error processing TCPIP file system request -TCPIP-E-NOCFS, error resolving TCPIP$CFS_SHR entry point -LIB-F-KEYNOTFOU, key not found in tree TCPIP> MAP "/x" DKA100: %LIB-E-KEYNOTFOU, key not found in tree %TCPIP-E-MAPERROR, error processing MAP or UNMAP request -TCPIP-E-NOCFS, error resolving TCPIP$CFS_SHR entry point -LIB-F-KEYNOTFOU, key not found in tree

Other errors related to the NFS server may also occur.

For information about NFS restrictions on Alpha platforms, refer to Section 3.8.

3.3 PPP Restrictions

The point-to-point protocol (PPP) does not work in this release of TCP/IP Services, on both Alpha and I64 platforms. This problem will be fixed in a future update to TCP/IP Services.

If you try to use PPP, the following type of error can occur:

$ PPPD CONN TTA08 %PPPD-I-CONNECTTERM, converting connection on device _TTA0: to a Point-to-Point connection %LIB-E-ACTIMAGE, error activating image DKA0:[SYS0.SYSCOMMON.][SYSLIB]TCPIP$PPPD_CALLOUT.EXE;1 -SYSTEM-F-PRIVINSTALL, shareable images must be installed to run privileged image %PPPD-E-PROTOERR, error initiating network protocol callback routine %SYSTEM-F-PRIVINSTALL, shareable images must be installed to run privileged image %PPPD-F-ABORT, fatal error encountered; operation terminated.

If you manually install the image TCPIP$PPPD_CALLOUT.EXE, the system will fail when you execute the command in this example. This is not a security problem because privileges are required in order to install images manually.

3.4 SLIP Restrictions

The serial line IP protocol (SLIP) does not work in this release of TCP/IP Services, on both Alpha and I64 platforms. This problem will be fixed on Alpha platforms in a future update to TCP/IP Services.

3.5 Advanced Programming Environment Restrictions and Guidelines

The header files provided in TCPIP$EXAMPLES are provided as part of the advanced TCP/IP programming environment. The following list describes restrictions and guidelines for using them:

• Use of the functions and data structures described in TCPIP$EXAMPLES:RESOLV.H is limited to 32-bit pointers. The underlying implementation will only handle 32-bit pointers. Previously, 64-bit pointers were wrongly accepted, resulting in undefined behavior for the underlying implementation.
• The IP.H and IP6.H header files are incomplete in the OpenVMS environment. They contain include directives for header files that are not provided in this version of TCP/IP Services. Refer to the HP TCP/IP Services for OpenVMS Sockets API and System Services Programming for more information.

BIND Version 9 has the following restrictions:

• Certain DNS server implementations do not support AAAA (IPv6 address) records. When queried for an AAAA (IPv6) record type by the BIND resolver, these name servers will return an NXDOMAIN status, even if an A (IPv4) record exists for the same domain name. These name servers should be returning NOERROR as the status for such a query. This problem can result in delays during host name resolution.
  BIND Version 9.2.1, which is supported with this release of TCP/IP Services, and prior versions of BIND do not exhibit this problem.
• Serving secure zones
  When acting as an authoritative name server, BIND Version 9 includes KEY, SIG, and NXT records in responses as specified in RFC 2535 when the request has the DO flag set in the query.
  Response generation for wildcard records in secure zones is not fully supported. Responses indicating the nonexistence of a name include an NXT record proving the nonexistence of the name itself, but do not include any NXT records to prove the nonexistence of a matching wildcard record. Positive responses resulting from wildcard expansion do not include the NXT records to prove the nonexistence of a non-wildcard match or a more specific wildcard match.
• Secure resolution
  Basic support for validation of DNSSEC signatures in responses has been implemented but should be considered experimental.
  When acting as a caching name server, BIND Version 9 is capable of performing basic DNSSEC validation of positive as well as nonexistence responses. You can enable this functionality by including a trusted-keys clause containing the top-level zone key of the DNSSEC tree in the configuration file.
  Validation of wildcard responses is not currently supported. In particular, a " name does not exist " response will validate successfully even if the server does not contain the NXT records to prove the nonexistence of a matching wildcard.
  Proof of insecure status for insecure zones delegated from secure zones works when the zones are completely insecure. Privately secured zones delegated from secure zones will not work in all cases, such as when the privately secured zone is served by the same server as an ancestor (but not parent) zone.
  Handling of the CD bit in queries is now fully implemented. Validation is not attempted for recursive queries if CD is set.
• Secure dynamic update
  Dynamic updating of secure zones has been partially implemented. Affected NXT and SIG records are updated by the server when an update occurs. Use the update-policy statement in the zone definition for advanced access control.
• Secure zone transfers
  BIND Version 9 does not implement the zone transfer security mechanisms of RFC 2535 because they are considered inferior to the use of TSIG or SIG(0) to ensure the integrity of zone transfers.

The following sections describe restrictions in the use of IPv6.

3.7.1 Mobile IPv6 Restrictions

Mobile IPv6 is not supported in this release.

3.7.2 IPv6 Requires the BIND Resolver

If you are using IPv6, you must enable the BIND resolver. To enable the BIND resolver, use the TCPIP$CONFIG.COM command procedure. From the Core environment menu, select BIND Resolver.

You must specify the BIND server to enable the BIND resolver. If you do not have access to a BIND server, specify the node address 127.0.0.1 as your BIND server.

3.8 NFS Restrictions on Alpha Platforms

The following sections describe problems and restrictions with NFS on Alpha platforms.

3.8.1 NFS Server Problems and Restrictions

The NFS server is not supported on I64 platforms for this release. The associated components (lock manager, PCNFS, MOUNT server, nfsstat ) are also unsupported. For other information specific to the NFS server on OpenVMS I64 systems, see Section 3.1.

The following restrictions apply to the NFS server on OpenVMS Alpha systems:

• Using the ls command from a Solaris Version 9 client may hang the OpenVMS server with no error message on either client or server. To avoid this problem, set the nfs subsystem attribute ovms_xqp_plus_enabled to 7. Refer to the HP TCP/IP Services for OpenVMS Management guide for more information about this attribute.
• When performing a mount operation or starting the NFS server with OPCOM enabled, the TCP/IP Services MOUNT server can erroneously display the following message:

  %TCPIP-E-NFS_BFSCAL, operation MOUNT_POINT failed on file /dev/dir

  
  This message appears even when the MOUNT or NFS startup has successfully completed. In the case of a mount operation, if it has actually succeeded, the following message will also be displayed:

  %TCPIP-S-NFS_MNTSUC, mounted file system /dev/dir

• If the NFS server and the NFS client are in different domains and unqualified host names are used in requests, the lock server (LOCKD) fails to honor the request and leaves the file unlocked.
  When the server attempts to look up a host using its unqualified host name (for example, johnws ) instead of the fully qualified host name (for example, johnws.abc com ), and the host is not in the same domain as the server, the request fails.
  To solve this type of problem, you can do one of the following:
  • When you configure the NFS client, specify the fully qualified host name, including the domain name. This ensures that translation will succeed.
  • Add an entry to the NFS server's hosts database for the client's unqualified host name. Only that NFS server will be able to translate this host name. This solution will not work if the client obtains its address dynamically from DHCP.

• To get proper timestamps, when the system time is changed for daylight savings time (DST), dismount all DNFS devices. (The TCP/IP management command SHOW MOUNT should show zero mounted devices.) Then remount the devices.
• The NFS client does not properly handle file names with the semicolon character on ODS-5 disk volumes. (For example, a^;b.dat;5 is a valid file name.) Such file names are truncated at the semicolon.
• The NFS client included with TCP/IP Services uses the NFS Version 2 protocol only.
• With the NFS Version 2 protocol, the value of the file size is limited to 32 bits.
• The ISO Latin-1 character set is supported. The UCS-2 characters are not supported.
• File names, including file extensions, can be no more than 236 characters long.
• Files containing characters not accepted by ODS-5 on the active OpenVMS version or whose name and extension exceeds 236 characters are truncated to zero length. This makes them invisible to OpenVMS and is consistent with prior OpenVMS NFS client behavior.

The NTP server has a stratum limit of 15. The server does not synchronize to any time server that reports a stratum of 15 or greater. This may cause problems if you try to synchronize to a server running the UCX NTP server, if that server has been designated as "free running" (with the local-master command). For proper operation, the local-master designation must be specified with a stratum no greater than 14.

3.10 SNMP Problems and Restrictions

This section describes restrictions to the SNMP component for this release. For more information about using SNMP, refer to the HP TCP/IP Services for OpenVMS SNMP Programming and Reference manual.

3.10.1 Incomplete Restart

When the SNMP master agent and subagents fail or are stopped, TCP/IP Services is often able to restart all processes automatically. However, under certain conditions, subagent processes may not restart. When this happens, the display from the DCL command SHOW SYSTEM does not include TCPIP$OS_MIBS and TCPIP$HR_MIB. If this situation occurs, restart SNMP by entering the following commands:

$ @SYS$STARTUP:TCPIP$SNMP_SHUTDOWN.COM $ @SYS$STARTUP:TCPIP$SNMP_STARTUP.COM

3.10.2 SNMP IVP Error

On slow systems, the SNMP Installation Verification Procedure can fail because a subagent does not respond to the test query. The error messages look like this:

. . . Shutting down the SNMP service... done. Creating temporary read/write community SNMPIVP_153. Enabling SET operations. Starting the SNMP service... done. SNMPIVP: unexpected text in response to SNMP request: "- no such name - returned for variable 1" See file SYS$SYSDEVICE:[TCPIP$SNMP]TCPIP$SNMP_REQUEST.DAT for more details. sysContact could not be retrieved. Status = 0 The SNMP IVP has NOT completed successfully. SNMP IVP request completed. Press Return to continue ...

You can ignore these types of messages in the IVP.

3.10.3 Using Existing MIB Subagent Modules

If an existing subagent does not execute properly, you may need to relink it against the current version of TCP/IP Services to produce a working image. Some subagents (such as those for HP Insight Management Agents for OpenVMS) also require a minimum version of OpenVMS and a minimum version of TCP/IP Services.

The following restrictions apply:

• In general, only executable images linked against the following versions of the eSNMP shareable image are upward compatible with the current version of TCP/IP Services:
  • UCX$ESNMP_SHR.EXE from TCP/IP Services Version 4.2 ECO 4
  • TCPIP$ESNMP_SHR.EXE from TCP/IP Services Version 5.0A ECO 1
  
  Images built under versions other than these can be relinked with one of the shareable images, or with TCPIP$ESNMP_SHR.EXE in the current version of TCP/IP Services.
• The underlying eSNMP API changed from DPI in TCP/IP Services Version 5.0 to AgentX in later versions of TCP/IP Services. Therefore, executable images linked against older object library versions of the API (*$ESNMP.OLB) must be relinked against either the new object library or the new shareable image. Linking against the shareable image ensures future upward compatibility and results in smaller image sizes.

  Note Although images may run without being relinked, backward compatibility is not guaranteed. Such images can result in inaccurate data or run-time problems.

• This version of TCP/IP Services provides an updated version of the UCX$ESNMP_SHR.EXE shareable image to provide compatibility with subagents linked under TCP/IP Services Version 4.2 ECO 4. Do not delete this file.
• The SNMP server responds correctly to SNMP requests directed to a cluster alias. Note, however, that an unexpected host may be reached when querying from a TCP/IP Services Version 4.x system that is a member of a cluster group but is not the current impersonator.
• The SNMP master agent and subagents do not start if the value of the logical name TCPIP$INET_HOST does not yield the IP address of a functional interface on the host when used in a DNS query. This problem does not occur if the server host is configured correctly with a permanent network connection (for example, Ethernet or FDDI). The problem can occur when a host is connected through PPP and the IP address used for the PPP connection does not match the IP address associated with the TCPIP$INET_HOST logical name.
• Under certain conditions observed primarily on OpenVMS VAX systems, the master agent or subagent exits with an error from an internal select() socket call. In most circumstances, looping does not occur. If looping occurs, you can control the number of iterations by defining the TCPIP$SNMP_SELECT_ERROR_LIMIT logical name.
• The MIB browser provided with TCP/IP Services (TCPIP$SNMP_REQUEST.EXE) supports getnext processing of OIDs that include the 32-bit OpenVMS process ID as a component. However, other MIB browsers may not provide this support.
  For example, the following OIDs and values are supported on OpenVMS:

  1.3.6.1.2.1.25.4.2.1.1.1321206828 = 1321206828 1.3.6.1.2.1.25.4.2.1.1.1321206829 = 1321206829 1.3.6.1.2.1.25.4.2.1.1.1321206830 = 1321206830

  
  These examples are from hrSWRunTable ; the hrSWRunPerfTable may be affected as well.

• You can ignore the following warning that appears in the log file if a null OID value (0.0) is retrieved in response to a Get , GetNext , or GetBulk request:

  o_oid; Null oid or oid->elements, or oid->nelem == 0

After upgrading to the current version of TCP/IP Services, you must disable and then enable SNMP using the TCPIP$CONFIG.COM command procedure. When prompted for "this node" or "all nodes," select the option that reflects the previous configuration.

3.10.5 Communication Controller Data Not Fully Updated

When you upgrade TCP/IP Services and then modify an existing communication controller, programs that use the communication controller might not have access to the updated information.

To ensure that programs like the MIB browser (SNMP_REQUEST) have access to the new data about the communication controller, do the following:

1. Delete the communication controller using the TCP/IP management command DELETE COMMUNICATION_CONTROLLER.
2. Reset the communication controller by running the TCPIP$CONFIG.COM command procedure and exiting.
3. Restart the program (such as SNMP) by entering the following commands:

   $ @SYS$STARTUP:SNMP_SHUTDOWN.COM $ @SYS$STARTUP:SNMP_STARTUP.COM

4. Use the TCP/IP management command LIST COMMUNICATION_CONTROLLER to display the information.