Why doesn't NetXMS know the IP addresses of remote computers?  The computers all have the agent installed and connect to the server using a TLS tunnel.

I have email alerts adding "IP address: %a" to the message body.  With these systems I see "UNSPEC".  In the console > object details > overview, "Primary IP address" also shows "UNSPEC".

I also include "%[FQDN]" in the message, which is a 1-line script of "return GetDCIValueByName($node,"System.FQDN");".  I do get an FQDN.  How can I get an address?  Do I have to define it in the client config file?

Yes, in case of tunnel NetXMS does not store the IP address. The thing is that IP address from which the tunnel connection arrives is not necessary the IP of the node - it can be a NAT, etc. And if we take list of interfaces for a node - the could be several interfaces and we don't know which one is primary.

You could get list of interfaces via NXSL script - the script should filter out loopback interface and if there are several interfaces - select one of them. There is currently no hook script on tunnel connection, you can run your script from configuration poll hook.

Here's an example script that prints list of interfaces:
for(i : $node->interfaces)
{
  println i->name;
  for(a : i->ipAddressList)
    println "   " . a->address . "/" . a->mask;
}

Also, there's a system event SYS_TUNNEL_OPEN - this event occurs when the tunnel is established, in the context of that node. So you can create a rule in EPP and run some script from there.

It's not possible to update node's IP address from script, but you can create a cusome attribute on node and keep IP address there.