User Tools

Site Tools


tsm:tsm_client_firewall

Understand TSM ports used

<box 65% blue | SCHEDMODE POLLING>With client-polling mode, client nodes poll the server for the next scheduled event. This minimize the number of ports open on a firewall.</box>

<box 65% blue | SCHEDMODE PROMPTED>With server-prompted mode, the server contacts the nodes at the scheduled start time. Better management of parallel schedule on the server, and faster for testing.</box>

SCHEDMODE POLLING

If you specify this option (also the default if none specified) on the client dsm.opt on Windows, dsm.sys on UNIX, then the client will prompt the server for available schedules. By defaut client contact the server every 12 hours, but it can be changed by specifying: QUERYSCHEDPERIOD 1 (for 1 hour for example)

SCHEDMODE PROMPTED

There are httpport, tcpclientport and webports client options and there is the low-level address in the client node definition, which one takes precedence?

In a prompted scheduling mode, depending on how the scheduler is controlled and depending on whether the session is initiated by the server or client, the port used will vary.

Here we have multiple cases available:

SESSIONINITiation SERVEROnly

The server will contact the Tivoli Storage Manager client scheduler at the IP address and port that is specified in the node definition. To specify the IP address and port, use the following Tivoli Storage Manager administrative command:

update node <nodename> hladdress=<ip_address> lladdress=<port>

For example, if the following command is issued, the server will contact the client scheduler at address mynode.bla.com at port 2020:

update node testnode hladdress=mynode.bla.com lladdress=2020

The HLADDRESS (high level address) value can be specified either in numeric or host name format.

  If a numeric address is used, the address is saved without verification by a domain name server. 
  If the address is not correct, failures can occur when the Tivoli Storage Manager server attempts 
  to contact the client.
    
  If a host name format address is used, the address is verified with a domain name server. Verified 
  names are saved and resolved with Domain Name Services (DNS) when the Tivoli Storage Manager server 
  contacts the client. In other words, a host name format address is resolved to a numeric TCP/IP 
  address using standard DNS TCP/IP calls.

Example #1 :
A node is registered or updated with hladdress=mynode.bla.com. The Tivoli Storage Manager server attempts to resolve this host to a TCP/IP address. Assuming this host is resolved to 192.168.99.92, the server attempts to contact the client scheduler at address 192.168.99.92.

Example #2 :
A node is registered or updated with hladdress=192.168.64.66. The Tivoli Storage Manager server attempts to contact the client scheduler at address 192.168.64.66.

SESSIONINITiation client and scheduler is controlled by dsmcad

a) if the webports option is not used :

TheTivoli Storage Manager client scheduler will generate a random port to listen to and this port will be recorded in the Tivoli Storage Manager server database. This port will be used to contact the client scheduler.

b) if the webports option is used :

The Tivoli Storage Manager server will contact the client scheduler at port specified by “webports xxx yyy” option. For example, following client options are used :

NodeName testnode
commmethod tcpip
tcpport 1500
TCPServeraddress tsm.server.bla.com
passwordaccess generate
schedmode prompted
MANAGEDSERVICES WEBCLIENT SCHEDULE
webports 1700 1710
httpport 1750
tcpclientport 1760

The Tivoli Storage Manager server contacts the client scheduler at port 1700

SESSIONINITiation client and scheduler is NOT controlled by dsmcad

The Tivoli Storage Manager server will contact the client scheduler at port specified by tcpclientport option. For example, following client options are used :

NodeName testnode
commmethod tcpip
tcpport 1500
TCPServeraddress tsm.server.bla.com
passwordaccess generate
schedmode prompted
*MANAGEDSERVICES WEBCLIENT SCHEDULE
webports 1700 1710
httpport 1750
tcpclientport 1760

The Tivoli Storage Manager server contacts the client scheduler at port 1760

NOTE : In any of the above cases, the httpport option plays no part with the client scheduler port. This httpport is strictly used to access the web client, not the scheduler.

ANNEXE

TSM hidden TCPCLIENTADDRESS table

Client uses “SESSIONINITiation client” option and TCPCLIENTADDRESS is not used

The Tivoli Storage Manager client uses the host name for the TCPCLIENTAddress value. This value is sent to the Tivoli Storage Manager server, where it is stored in the Schedules.Node.Addresses table (V5) or Schedules_Node_Addresses (V6). The host name is not resolved to a numeric TCP/IP address before being sent to the Tivoli Storage Manager server. When the Tivoli Storage Manager server needs to contact the client scheduler, the host name is resolved to a numeric TCP/IP address at that time.

[tsmsrv@tsminst1 ~]$ db2 connect to tsmdb1

   Database Connection Information

 Database server        = DB2/LINUXX8664 10.5.7
 SQL authorization ID   = TSMSRV
 Local database alias   = TSMDB1

[tsmsrv@tsminst1 ~]$ db2 list tables

Table/View                      Schema          Type  Creation time             
------------------------------- --------------- ----- --------------------------

  0 record(s) selected.

[tsmsrv@tsminst1 ~]$ db2 list tables for all

Table/View                      Schema          Type  Creation time             
------------------------------- --------------- ----- --------------------------
ATTRIBUTES                      SYSCAT          V     2013-12-16-19.20.25.977158
.........
SCHEDULES                       TSMDB1          T     2012-01-02-21.56.19.062939
SCHEDULE_ASSOCATION             TSMDB1          T     2012-01-02-21.56.19.211541
SCHEDULE_EVENT                  TSMDB1          T     2012-01-02-21.56.19.428134
SCHEDULE_NODE_ADDRESSES         TSMDB1          T     2012-01-02-21.56.19.543819
SCHEDULE_PENDING                TSMDB1          T     2012-01-02-21.56.19.310507

[tsmsrv@tsminst1 ~]$ db2 "select * from TSMDB1.SCHEDULE_NODE_ADDRESSES" | sed 's/\( \)*/\1/g' | sed 's/\(-\)*/\1/g'

NODEID      ADDRESSTYPE HLADDRESS                                LLADDRESS                        
----------- ----------- ---------------------------------------- ---------------------------------
          9           1 10.10.10.11                              1055                             
         18           1 10.10.10.12                              1058                             
         81           1 toto01                                   1581                             
        113           1 totorepo01                               1501                             
         97           1 tititsm03                                49234                                             
         90           1 10.10.10.50                              1582                             
         89           1 10.10.111.25                             1501        

Check the coherence between TSM nodes and the real resolution of name

[tsmsrv@tsminst1 ~]$ db2 "select a.NODE_NAME,a.NODE_ID,a.TCP_NAME,a.TCP_ADDRESS,a.CLIENT_HLA,a.CLIENT_LLA,b.HLADDRESS,b.LLADDRESS from TSMDB1.NODESVIEW a,TSMDB1.SCHEDULE_NODE_ADDRESSES b where a.NODE_ID=b.NODEID" | sed 's/\( \)*/\1/g' | sed 's/\(-\)*/\1/g'

Solve missed schedules

*(optional, to use dsmadmc from client)

TCPADMINPORT 1500

*(optional, use to establish connection )

TCPPORT 1500

*Client scheduler listen port

TCPCLIENTPORT 1501

* Port LISTEN for web client http

HTTPPORT 1581

* CAD and agent port

WEBPorts  cadport  agentport

Ex:

SCHEDMODE PROMPTED
TCPPORT 1500
TCPCLIENTPORT 1501
Webport 1552 1553
HTTPport 1581
MANAGEDSERVICES schedule webclient

Example Linux with client acceptor

Configure the firewall to enable TCP port 1500 (TSM server) and 1502 (Client acceptor)

[root@lnx01 ~]# cat /etc/sysconfig/firewalld 
# firewalld command line args
# possible values: --debug
FIREWALLD_ARGS="--debug=2"
[root@lnx01 ~]# systemctl restart firewalld
[root@lnx01 ~]# firewall-cmd --add-port=1502/tcp --zone=public --permanent
success
[root@lnx01 ~]# firewall-cmd --list-all
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eno16777888
  sources: 
  services: dhcpv6-client http https ssh
  ports: 1234/tcp 22/tcp 1500/tcp 1502/tcp
  protocols: 
  masquerade: no
  forward-ports: 
  sourceports: 
  icmp-blocks: 
  rich rules: 
	
[root@lnx01 ~]# firewall-cmd --reload
success

Now use TSM cad (client acceptor, which will start scheduler and/or webclient). Webports must be set else these are random, which is not compatible with a firewall

[root@lnx01 ~]# cat /opt/tivoli/tsm/client/ba/bin/dsm.sys
....
commmethod tcpip 
tcpport 1500 
passwordaccess generate 
nodename lnx01

Managedservices schedule
webports 1502 1503

errorlogname /var/tsm/log/dsmerror.log
errorlogret 30,d

schedmode prompted
schedlogname /var/tsm/log/dsmsched.log
schedlogret 30,d

[root@lnx01 ~]# dsmcad
[root@lnx01 ~]# ps -ef | grep dsm
root     31429     1  0 16:35 ?        00:00:00 dsmcad

[root@lnx01 ~]# lsof -Pp 31429

COMMAND   PID USER   FD   TYPE  DEVICE  SIZE/OFF      NODE NAME
dsmcad  31429 root  cwd    DIR   253,1      4096  39048656 /opt/tivoli/tsm/client/ba/bin
......
dsmcad  31429 root    3w   REG   253,1         0  70721299 /var/tsm/log/dsmerror.log
dsmcad  31429 root    4w   REG   253,1     24894  70721300 /var/tsm/log/dsmwebcl.log
dsmcad  31429 root    5u  IPv4 9704438       0t0       TCP *:1502 (LISTEN)
tsm/tsm_client_firewall.txt · Last modified: 2025/08/23 23:28 (external edit)