Turns out it was plain stupidity(ours).
When the system was IPLed, we received(and missed) these messages:
IST1365I CONNECTION ATTEMPT TO STRUCTURE EZBEPORTxxxx FAILED 497
IST1366I MVS MACRO IXLCONN FAILED - RTN CODE= 0C - REASON CODE= 0C08
IST314I END
IXL013I IXLCONN REQUEST FOR STRUCTURE EZBEPORTxxxx FAILED. 495
JOBNAME: NETI ASID: 002E CONNECTOR NAME: NETNAME_DOMAIN
IXLCONN RETURN CODE: 0000000C, REASON CODE: 02010C08
NO SUITABLE COUPLING FACILITY IN PREFERENCE LIST
and
CFNAME ALLOCATION STATUS/FAILURE REASON
-------- ----------------------------------------
CF1 INVALID STRUCTURE SIZE: 4 M
INITSIZE MUST BE AT LEAST: 5 M
CF2 INVALID STRUCTURE SIZE: 4 M
INITSIZE MUST BE AT LEAST: 5 M
This is the structure used by the sysplex distributor to allocate ephemeral
ports for connections like the FTP passive connection needs.
The *IBM z14 **Configuration Setup *redbook specifically explains that you
need to rerun CFsizer for all your structures when migrating to a z14
because the CFCC level has changed.
There is even a z14 z/OSMF workflow and running CFsizer is one of the
steps(we did not use zOSMF for this migration). Another good reason to get
on board with z/OSMF.
Bottom line - run CFsizer before any hardware migration and make any
suggested changes.
Thanks everyone for your suggestions.
On Fri, 29 Mar 2019 at 20:43, Mike Shorkend <mike.shork...@gmail.com> wrote:
> Hi Kevin
> Have not worked it out yet. I can send you full information on Monday.
> Thanks for contacting me.
>
> Mike
>
> On Fri, 29 Mar 2019, 17:48 Kevin Mckenzie, <kmcke...@us.ibm.com> wrote:
>
>> Hi, Mike. Did you figure out what had happened there? I've taken over
>> ownership of the PSP Bucket, which has some overlap with the FixCats, so if
>> something was missing, or wasn't easy to figure out, I'd like to fix or
>> improve whatever the problem was.
>>
>> I see you were on z/OS 2.2; what level of ICSF was installed? What PTF
>> level? What did you install to fix the problem? Which hardware FixCats
>> did you install the fixes from prior to migrating?
>> ---
>> Kevin McKenzie
>>
>> External Phone: 845-435-8282, Tie-line: 8-295-8282
>> z/OS Test Services - Test Architect, Provisioning
>>
>> [image: Inactive hide details for Mike Shorkend ---03/28/2019 12:37:46
>> PM---Thanks guys, will keep you posted. On Thu, 28 Mar 2019, 16]Mike
>> Shorkend ---03/28/2019 12:37:46 PM---Thanks guys, will keep you posted. On
>> Thu, 28 Mar 2019, 16:52 Mark Jacobs, <
>>
>> From: Mike Shorkend <mike.shork...@gmail.com>
>> To: IBM-MAIN@LISTSERV.UA.EDU
>> Date: 03/28/2019 12:37 PM
>> Subject: Re: FTPS breaks on z14-ZR1
>> Sent by: IBM Mainframe Discussion List <IBM-MAIN@LISTSERV.UA.EDU>
>> ------------------------------
>>
>>
>>
>> Thanks guys, will keep you posted.
>>
>> On Thu, 28 Mar 2019, 16:52 Mark Jacobs, <
>> 00000224d287a4b1-dmarc-requ...@listserv.ua.edu> wrote:
>>
>> > If you didn't have the required ICSF FMID installed for CryptoExpress6
>> > Cards, I don't think the FIXCAT would have caught it.
>> >
>> > The systems assurance meeting (assuming IBM still holds them) should
>> have
>> > covered it though.
>> >
>> > Mark Jacobs
>> >
>> >
>> > Sent from ProtonMail, Swiss-based encrypted email.
>> >
>> > GPG Public Key -
>> >
>> https://api.protonmail.ch/pks/lookup?op=get&search=markjac...@protonmail.com
>> >
>> > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
>> > On Thursday, March 28, 2019 10:37 AM, Mike Shorkend <
>> > mike.shork...@gmail.com> wrote:
>> >
>> > > I would assume that it would be included in the FIXCAT for the z14,
>> but I
>> > > will check.
>> > >
>> > > On Thu, 28 Mar 2019 at 16:33, Bill Bishop (TMNA)
>> bill.bis...@toyota.com
>> > > wrote:
>> > >
>> > > > Sorry, it was the crypto express software.
>> > > > We went from Crypto 5 to Crypto 6 cards and missed updating the ICSF
>> > > > software
>> > > > Thanks
>> > > > Bill Bishop
>> > > > Consultant, Mainframe Engineer
>> > > > Mainframe and Scheduling | Infrastructure Technology Services
>> > > > Toyota Motor North America
>> > > > bill.bis...@toyota.com
>> > > > Office: (469) 292-5149
>> > > > Cell: (502) 316-4386
>> > > > -----Original Message-----
>> > > > From: IBM Mainframe Discussion List [
>> mailto:IBM-MAIN@LISTSERV.UA.EDU <IBM-MAIN@LISTSERV.UA.EDU>]
>> > On
>> > > > Behalf Of Mike Shorkend
>> > > > Sent: Thursday, March 28, 2019 9:28 AM
>> > > > To: IBM-MAIN@LISTSERV.UA.EDU
>> > > > Subject: Re: FTPS breaks on z14-ZR1
>> > > > No firewall, and like I said, nothing else has changed.
>> > > > @Bill - we did go from OSA5 to OSA6. I am not aware of how we would
>> > > > upgrade the OSA software?
>> > > > On Thu, 28 Mar 2019 at 16:06, scott Ford idfli...@gmail.com wrote:
>> > > >
>> > > > > If your running PASV FTP.DATA and the TCPIP profile must be
>> changed.
>> > > > > Inbound port 20/21 are good for PASV , but outbound is a different
>> > story.
>> > > > > Are you running z/OS to z/OS ? Is there an intervening firewall ?
>> > > > > Scott
>> > > > > On Thu, Mar 28, 2019 at 10:02 AM Carmen Vitullo
>> cvitu...@hughes.net
>> > > > > wrote:
>> > > > >
>> > > > > > ok, if you don't mind keep us posted, we'll be moving to a Z14
>> > > > > > eventually,
>> > > > > > if there's some gotya's going from Z13 to z14 I'd like to know
>> > > > > > thanks and good luck
>> > > > > > Carmen Vitullo
>> > > > > > ----- Original Message -----
>> > > > > > From: "Mike Shorkend" mike.shork...@gmail.com
>> > > > > > To: IBM-MAIN@LISTSERV.UA.EDU
>> > > > > > Sent: Thursday, March 28, 2019 8:55:48 AM
>> > > > > > Subject: Re: FTPS breaks on z14-ZR1
>> > > > > > The z/OS definitions for both systems are identical.
>> > > > > > Looking at the other ideas mentioned
>> > > > > > Thanks
>> > > > > > On Thu, 28 Mar 2019 at 15:09, Elardus Engelbrecht <
>> > > > > > elardus.engelbre...@sita.co.za> wrote:
>> > > > > >
>> > > > > > > Carmen Vitullo wrote:
>> > > > > > >
>> > > > > > > > Another possible cause of the 425 error code is the SSL
>> > > > > > > > requirements
>> > > > > > > > on
>> > > > > >
>> > > > > > > the server. In the case of the following error message:
>> > > > > > >
>> > > > > > > > - 425 unable to build data connection: Operation not
>> > permitted.
>> > > > > > >
>> > > > > > > In this case, check and compare on z13 and z14 what Crypto
>> cards
>> > > > > > > and
>> > > > > > > keys
>> > > > > > > do you have.
>> > > > > > > Groete / Greetings
>> > > > > > > Elardus Engelbrecht
>> > > > > > >
>> > > > > > > ---- For IBM-MAIN subscribe / signoff / archive access
>> > > > > > > instructions, send email to lists...@listserv.ua.edu with the
>> > > > > > > message: INFO IBM-MAIN
>> > > > > >
>> > > > > > --
>> > > > > > Mike Shorkend
>> > > > > > m...@shorkend.com
>> > > > > > www.shorkend.com
>> > > > > > Tel: +972524208743
>> > > > > > Fax: +97239772196
>> > > > > >
>> > > > > > -- For IBM-MAIN subscribe / signoff / archive access
>> instructions,
>> > > > > > send email to lists...@listserv.ua.edu with the message: INFO
>> > > > > > IBM-MAIN
>> > > > > >
>> > > > > > -- For IBM-MAIN subscribe / signoff / archive access
>> instructions,
>> > > > > > send email to lists...@listserv.ua.edu with the message: INFO
>> > > > > > IBM-MAIN
>> > > > >
>> > > > > --
>> > > > > Scott Ford
>> > > > > IDMWORKS
>> > > > > z/OS Development
>> > > > >
>> > > > > For IBM-MAIN subscribe / signoff / archive access instructions,
>> send
>> > > > > email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>> > > >
>> > > > --
>> > > > Mike Shorkend
>> > > > m...@shorkend.com
>> > > > www.shorkend.com
>> > > > Tel: +972524208743
>> > > > Fax: +97239772196
>> > > >
>> > > > For IBM-MAIN subscribe / signoff / archive access instructions, send
>> > email
>> > > > to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>> > > >
>> > > > For IBM-MAIN subscribe / signoff / archive access instructions,
>> > > > send email to lists...@listserv.ua.edu with the message: INFO
>> IBM-MAIN
>> > >
>> > > --
>> > >
>> > > Mike Shorkend
>> > > m...@shorkend.com
>> > > www.shorkend.com
>> > > Tel: +972524208743
>> > > Fax: +97239772196
>> > >
>> > >
>> >
>> --------------------------------------------------------------------------------------
>> > >
>> > > For IBM-MAIN subscribe / signoff / archive access instructions,
>> > > send email to lists...@listserv.ua.edu with the message: INFO
>> IBM-MAIN
>> >
>> > ----------------------------------------------------------------------
>> > For IBM-MAIN subscribe / signoff / archive access instructions,
>> > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>> >
>>
>> ----------------------------------------------------------------------
>> For IBM-MAIN subscribe / signoff / archive access instructions,
>> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>>
>>
>>
>>
>>
--
Mike Shorkend
m...@shorkend.com
www.shorkend.com
Tel: +972524208743
Fax: +97239772196
On Thu, 28 Mar 2019 at 18:52, Cieri, Anthony <aci...@seic.com> wrote:
>
>
> I assume that you are doing some type of certificate exchange to
> support FTPS. If so, where are the certificates stored? In a SAF product in
> ICSF? Crypto hardware could have changed!!
>
>
> -----Original Message-----
> From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU] On
> Behalf Of Mike Shorkend
> Sent: Thursday, March 28, 2019 12:37 PM
> To: IBM-MAIN@LISTSERV.UA.EDU
> Subject: Re: FTPS breaks on z14-ZR1
>
> [[ SEI WARNING *** This email was sent from an external source. Do not
> open attachments or click on links from unknown or suspicious senders. ***
> ]]
>
>
> Thanks guys, will keep you posted.
>
> On Thu, 28 Mar 2019, 16:52 Mark Jacobs, <
> 00000224d287a4b1-dmarc-requ...@listserv.ua.edu> wrote:
>
> > If you didn't have the required ICSF FMID installed for CryptoExpress6
> > Cards, I don't think the FIXCAT would have caught it.
> >
> > The systems assurance meeting (assuming IBM still holds them) should have
> > covered it though.
> >
> > Mark Jacobs
> >
> >
> > Sent from ProtonMail, Swiss-based encrypted email.
> >
> > GPG Public Key -
> >
> https://api.protonmail.ch/pks/lookup?op=get&search=markjac...@protonmail.com
> >
> > ‐‐‐‐‐‐‐ Original Message ‐‐‐‐‐‐‐
> > On Thursday, March 28, 2019 10:37 AM, Mike Shorkend <
> > mike.shork...@gmail.com> wrote:
> >
> > > I would assume that it would be included in the FIXCAT for the z14,
> but I
> > > will check.
> > >
> > > On Thu, 28 Mar 2019 at 16:33, Bill Bishop (TMNA)
> bill.bis...@toyota.com
> > > wrote:
> > >
> > > > Sorry, it was the crypto express software.
> > > > We went from Crypto 5 to Crypto 6 cards and missed updating the ICSF
> > > > software
> > > > Thanks
> > > > Bill Bishop
> > > > Consultant, Mainframe Engineer
> > > > Mainframe and Scheduling | Infrastructure Technology Services
> > > > Toyota Motor North America
> > > > bill.bis...@toyota.com
> > > > Office: (469) 292-5149
> > > > Cell: (502) 316-4386
> > > > -----Original Message-----
> > > > From: IBM Mainframe Discussion List [mailto:IBM-MAIN@LISTSERV.UA.EDU
> ]
> > On
> > > > Behalf Of Mike Shorkend
> > > > Sent: Thursday, March 28, 2019 9:28 AM
> > > > To: IBM-MAIN@LISTSERV.UA.EDU
> > > > Subject: Re: FTPS breaks on z14-ZR1
> > > > No firewall, and like I said, nothing else has changed.
> > > > @Bill - we did go from OSA5 to OSA6. I am not aware of how we would
> > > > upgrade the OSA software?
> > > > On Thu, 28 Mar 2019 at 16:06, scott Ford idfli...@gmail.com wrote:
> > > >
> > > > > If your running PASV FTP.DATA and the TCPIP profile must be
> changed.
> > > > > Inbound port 20/21 are good for PASV , but outbound is a different
> > story.
> > > > > Are you running z/OS to z/OS ? Is there an intervening firewall ?
> > > > > Scott
> > > > > On Thu, Mar 28, 2019 at 10:02 AM Carmen Vitullo
> cvitu...@hughes.net
> > > > > wrote:
> > > > >
> > > > > > ok, if you don't mind keep us posted, we'll be moving to a Z14
> > > > > > eventually,
> > > > > > if there's some gotya's going from Z13 to z14 I'd like to know
> > > > > > thanks and good luck
> > > > > > Carmen Vitullo
> > > > > > ----- Original Message -----
> > > > > > From: "Mike Shorkend" mike.shork...@gmail.com
> > > > > > To: IBM-MAIN@LISTSERV.UA.EDU
> > > > > > Sent: Thursday, March 28, 2019 8:55:48 AM
> > > > > > Subject: Re: FTPS breaks on z14-ZR1
> > > > > > The z/OS definitions for both systems are identical.
> > > > > > Looking at the other ideas mentioned
> > > > > > Thanks
> > > > > > On Thu, 28 Mar 2019 at 15:09, Elardus Engelbrecht <
> > > > > > elardus.engelbre...@sita.co.za> wrote:
> > > > > >
> > > > > > > Carmen Vitullo wrote:
> > > > > > >
> > > > > > > > Another possible cause of the 425 error code is the SSL
> > > > > > > > requirements
> > > > > > > > on
> > > > > >
> > > > > > > the server. In the case of the following error message:
> > > > > > >
> > > > > > > > - 425 unable to build data connection: Operation not
> > permitted.
> > > > > > >
> > > > > > > In this case, check and compare on z13 and z14 what Crypto
> cards
> > > > > > > and
> > > > > > > keys
> > > > > > > do you have.
> > > > > > > Groete / Greetings
> > > > > > > Elardus Engelbrecht
> > > > > > >
> > > > > > > ---- For IBM-MAIN subscribe / signoff / archive access
> > > > > > > instructions, send email to lists...@listserv.ua.edu with the
> > > > > > > message: INFO IBM-MAIN
> > > > > >
> > > > > > --
> > > > > > Mike Shorkend
> > > > > > m...@shorkend.com
> > > > > > www.shorkend.com
> > > > > > Tel: +972524208743
> > > > > > Fax: +97239772196
> > > > > >
> > > > > > -- For IBM-MAIN subscribe / signoff / archive access
> instructions,
> > > > > > send email to lists...@listserv.ua.edu with the message: INFO
> > > > > > IBM-MAIN
> > > > > >
> > > > > > -- For IBM-MAIN subscribe / signoff / archive access
> instructions,
> > > > > > send email to lists...@listserv.ua.edu with the message: INFO
> > > > > > IBM-MAIN
> > > > >
> > > > > --
> > > > > Scott Ford
> > > > > IDMWORKS
> > > > > z/OS Development
> > > > >
> > > > > For IBM-MAIN subscribe / signoff / archive access instructions,
> send
> > > > > email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> > > >
> > > > --
> > > > Mike Shorkend
> > > > m...@shorkend.com
> > > > www.shorkend.com
> > > > Tel: +972524208743
> > > > Fax: +97239772196
> > > >
> > > > For IBM-MAIN subscribe / signoff / archive access instructions, send
> > email
> > > > to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> > > >
> > > > For IBM-MAIN subscribe / signoff / archive access instructions,
> > > > send email to lists...@listserv.ua.edu with the message: INFO
> IBM-MAIN
> > >
> > > --
> > >
> > > Mike Shorkend
> > > m...@shorkend.com
> > > www.shorkend.com
> > > Tel: +972524208743
> > > Fax: +97239772196
> > >
> > >
> >
> --------------------------------------------------------------------------------------
> > >
> > > For IBM-MAIN subscribe / signoff / archive access instructions,
> > > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> >
> > ----------------------------------------------------------------------
> > For IBM-MAIN subscribe / signoff / archive access instructions,
> > send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
> >
>
> ----------------------------------------------------------------------
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
> ----------------------------------------------------------------------
> For IBM-MAIN subscribe / signoff / archive access instructions,
> send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
>
--
Mike Shorkend
m...@shorkend.com
www.shorkend.com
Tel: +972524208743
Fax: +97239772196
----------------------------------------------------------------------
For IBM-MAIN subscribe / signoff / archive access instructions,
send email to lists...@listserv.ua.edu with the message: INFO IBM-MAIN
