Note: Many z/VSE users still have small batch partition sizes. IPv6/VSE applications all require an 8 MB minimum partition size, unless there is a specific formula in the manual.

Note: Figure 3-4 was taken from a Windows XP SP3, so the Properties button is not available. Instead, the netsh command was used for configuring IPv6.

Note: z/VSE 4.3 and later can be used as the gateway when the EZA socket interface is used. With EZA, you can access IPv4 and IPv6 sockets in the same program. However, a C interface is not yet available.

Notes: Up to four ATTACH commands can be used in each FTP Server partition to attach FTP Server subtasks. When the IBM provided security exit BSSTISX is used, make sure that you copy phase BSTTFTS1 as phase BSTTFTSX into a configuration lib.sublib.

Note: BSTTFTPS allows specifying generic values, such as the use of wildcards. For example, if you want to download the first queue entry with a name in class A, you write A.0.name.

Note: BSTTVNET supports up to 2000 sessions per BSTTVNET partition. BSI recommends defining printer sessions in a separate BSTTVNET partition. Generally, BSI suggests dividing many sessions between multiple BSTTVNET partitions. After you define over 1,000 sessions in one BSTTVNET partition, it is suggested that a new BSTTVNET partition is used for more new sessions.

Note: Unless you have a specific need for a true TN3270E session, BSI recommends the use of TERMINAL sessions. There is less processor usage for TERMINAL sessions when compared to TN3270E.

Printer	CICS Typeterm	VTAM Logmode
CICS printer	VSEDSCP	SPDSCPRT
SNA LU1 SCS printer	VSESCSPA	SPSCSPRT

Note: The Keyman/VSE tool needs the VSE Connector Client that can be downloaded and installed from this website: http://www.ibm.com/systems/z/os/zvse/downloads/#vsecon

Important: The VSE certificate must be placed before the root certificate in the .pem file so that the order is: key - vsecert - rootcert.

Note: On Windows XP, the notepad.exe cannot read UNIX style text files correctly. To convert the line endings with WordPad, edit the .pem file and save it back to disk.

Note: BSTTPRXY requires a minimum 20 MB partition. BSTTATLS requires a minimum 20 MB partition and 72K for each possible socket to be handled. Ensure that the BSTTATLS/BSTTPRXY partition has a higher priority than the application partition. Otherwise, application hangs might occur.

Note: The KEYFILE parameter on the ATTLS command was not working correctly before APAR PM98875/PTF UK98397.

Note: The KEYRING parameter can be specified only once, assuming that customers want to have all .pem files at the same place. KEYFILE and SECTYPE can be specified for each connection separately.

Note: A first try might be to block the clear port by using the following PORT SUSPEND command: MSG BSTTINET,D=PORT 21 SUSPEND This command blocks port 21 until a PORT 21 RESUME is issued. While the port is suspended, no connections are accepted. However, the use of the PORT command also stops BSTTATLS from connecting on port 21 and this result is not what we want.

Note: Check for the latest IPv6/VSE version. It provides a firewall mechanism that allows enabling and blocking single ports. Foe example: IN TCP DENY PORT 21 IN TCP DENY PORT 23 IN TCP ALLOW PORT 0

Note: A previously created PCOM key database can be migrated to MSCAPI by using the Certificate Migration utility. This utility can be accessed by clicking Start → All Programs → IBM Personal Communications → Administrative and PD Aids.

Note: As shown in Figure 3-31, there is a new option in the Security Setup window that is call Telnet-negotiated. Do not select this option because BSTTATLS/BSTTPRXY do not support Telnet-negotiated security.

Connection type	FileZilla	Core FTP Language Environment®	Total Commander
FTPS explicit	Explicit FTP over TLS	AUTH_SSL AUTH_TLS	N/A
FTPS implicit	Implicit FTP over TLS	FTPS (SSL DIRECT)	SSL/TLS

Note: The FTP clients do not need a client keyring file if you do not use SSL client authentication. When you are connecting the first time, a client usually displays a window in which the user must accept or reject the SSL server certificate. Some clients allow importing the SSL server certificate into their client keystore, which makes this check obsolete when you are reconnecting.

Note: For BSTTATLS/BSTTPRXY, you must select FTPS (SSL DIRECT). In contrast, when TCP/IP for VSE is used, you must use AUTH SSL or AUTH TLS.

Note: The user ID and password might be case-sensitive, depending on which FTP server is used. PBSZ 0 and PROT P are necessary to encrypt any transferred data.

Note: You can run BSTTPRXY on another z/VSE system and specify this system’s IP address instead of localhost.

Note: By clicking Generate new certificate, you can create a .pem file with a private key and a second .pem file with a self-signed certificate. You also can create a .pem file with both items. However, this .pem file is not usable because the server certificate is missing. You must complete the steps that are described in 3.7.2, “Creating the keystore” on page 71 to create a working .pem file.

Note: The VSE Connector Server partition must have a lower priority than the BSTTATLS partition. Otherwise, your system might hang.

Note: BSTTPRXY can proxy one connection only.

Note: TLSv1.2 is supported by OpenSSL 1.0.1e, which is the current code level on z/VSE with APAR DY47499 / PTF UD53983 and later. TLSv1.2 is used by IPv6/VSE with APAR PM98875 / UK98397 and later.

Note: The use of TLS_RSA_WITH_AES_256_CBC_SHA256 requires the unlimited security strength files for Java. You can download these files from the following website: http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html