HP AB500A - Integrated Lights-Out Advanced Guide rapide

Planning and configuration recommendations

for Integrated Lights-Out processors

technology brief, 2nd edition

Abstract.............................................................................................................................................. 3

Introduction......................................................................................................................................... 3

IT environment assessment .................................................................................................................... 3

Planning considerations for network configuration ................................................................................... 4

Private management network............................................................................................................. 4

Network port configurations available to iLO ...................................................................................... 5

iLO common network .................................................................................................................... 5

iLO Shared Network Port .............................................................................................................. 5

iLO on dedicated management network.......................................................................................... 6

Considerations when configuring the iLO network ............................................................................ 7

Network cabling in dense rack environments................................................................................... 7

Out-of-band management using iLO’s virtual serial port..................................................................... 8

iLO configuration................................................................................................................................. 9

Single iLO device............................................................................................................................. 9

Multiple iLO devices ......................................................................................................................... 9

Automated setup .......................................................................................................................... 9

Initial deployment ....................................................................................................................... 10

Naming conventions................................................................................................................... 10

iLO network settings ....................................................................................................................... 10

Proxy servers ............................................................................................................................. 10

Configuring IP port assignments ................................................................................................... 10

IP port assignment for blades ....................................................................................................... 11

Implementing iLO network security architecture...................................................................................... 12

Default local iLO users accounts....................................................................................................... 12

Advantages of directory integration.................................................................................................. 12

How to begin directory implementation ............................................................................................ 13

Methods for directory services implementation................................................................................... 13

HP default schema method .............................................................................................................. 14

Support for nested groups ........................................................................................................... 15

HP extended schema method........................................................................................................... 15

Required Software...................................................................................................................... 15

Extending the directory schema.................................................................................................... 16

Roles......................................................................................................................................... 16

Integrating iLO login into complex network directories........................................................................ 17

Configuring iLO to access the directory service.................................................................................. 18

Local versus directory accounts ........................................................................................................ 18

Additional security considerations .................................................................................................... 19

Two-factor authentication............................................................................................................. 19

Restricting access to the Remote Console port ................................................................................ 20

Protecting SNMP traffic ............................................................................................................... 21

Using iLO with other HP management tools........................................................................................... 21

Integration with HP Systems Insight Manager..................................................................................... 21

Configuring iLO for access with Systems Insight Manager Single Sign-on.............................................. 23

How it works ............................................................................................................................. 23

Integrating iLO usage with Onboard Administrator ............................................................................ 23

Unattended server deployment......................................................................................................... 25

Deploying servers using Rapid Deployment Pack ............................................................................... 25

Taking advantage of advanced Remote Consoling ................................................................................ 26

Configuring and using Shared Remote Console ................................................................................. 26

Configuring and managing Console Replay...................................................................................... 28

Creating a central repository for use with iLO’s virtual media feature ....................................................... 29

Scripted Virtual Media.................................................................................................................... 29

XML scripting ............................................................................................................................. 29

XML examples............................................................................................................................ 30

CLP scripting.............................................................................................................................. 30

Scripting web server requirements ................................................................................................ 31

Managing multiple iLO devices ........................................................................................................... 31

HP Systems Insight Manager ........................................................................................................... 32

CPQLOCFG.EXE, HPONCFG.EXE, and script files ............................................................................. 32

Appendix A ...................................................................................................................................... 33

Using barcode scanning to ease mass-configuration of iLO devices...................................................... 33

Command-line switches................................................................................................................... 34

Deploying iLO devices.................................................................................................................... 34

Updating iLO devices ..................................................................................................................... 35

Appendix B....................................................................................................................................... 36

Using a RAM drive to ease mass-deployment of iLO-based servers....................................................... 36

Overview ...................................................................................................................................... 36

The master boot diskette.................................................................................................................. 36

The custom deployment tool ............................................................................................................ 37

For more information.......................................................................................................................... 39

Call to action .................................................................................................................................... 39

Abstract

This document identifies specific planning and configuration practices for using the HP Integrated

Lights-Out (iLO) and the HP Integrated Lights-Out 2 (iLO 2) management processors to reduce

complexity and simplify management of the datacenter and remote sites. Although, management

processors may not be applicable in all computing environments, HP recommends implementing these

guidelines as appropriate to the specific IT infrastructure.

Introduction

Server remote management is a necessity for IT organizations of all sizes. One of the HP Integrated

Lights-Out (iLO) products is right for any organization where it’s important to minimize downtime,

have the ability to remotely manage servers regardless of condition, and perform complex operations

such as initial server deployments. HP Integrated Lights-Out is HP’s building block management tool.

It improves server experience in initial deployment, reconfiguration, and operation. By setting up

each server to be monitored with iLO HP, administrators can benefit from the long record of

undisputed leadership in lights-out remote management with iLO.

The iLO device is an autonomous management processor that resides on the system board of a host

server. This device contains its own processor, memory, and network interface that allow it to operate

independently from the host server. Using iLO, IT administrators can manage a ProLiant server

remotely through its entire life cycle: initial deployment, operation, and redeployment.

Unlike other management solutions, iLO devices are entirely independent of the state of the operating

system (OS) or server hardware. These devices provide seamless control of remote servers in full

graphics mode (when using the iLO Advanced feature set). The Virtual Media feature of iLO allows IT

administrators to perform remote ROM upgrades and server deployments. All these capabilities

combine to provide administrators with the ability to respond quickly to downtime events, diagnose

OS or server problems remotely, increase uptime, and reduce the loss of business revenue.

This paper discusses system planning, configuration, and deployment of iLO management processors.

It is assumed that the reader is familiar with the general features of iLO. Reference material is

available in the “For more information” section at the end of this document. More information about

iLO technology is also available from the HP website at www.hp.com/servers/ilo.

This document supports both iLO devices; however, certain functions described herein may only be

supported on one and not the other. A designation of “iLO only” or “iLO 2 only” indicates that the

function is exclusive to that device. iLO firmware is backward-compatible. For example, the latest

versions of iLO 2 firmware support any iLO 2 processor. For consistency and best feature support,

use the latest version of iLO 2. If no designation is present then the function is supported on both

devices.

IT environment assessment

Before deploying and configuring an iLO device, it is helpful to assess the IT environment. Table 1

outlines areas to consider when planning the use of Lights-Out technology and the resulting benefits in

the data center.

Table 1. Assessing the IT environment

Target Criteria Potential improvement

Asset management Where are servers located (in datacenters

or at remote sites)?

Where would it be helpful to use iLO?

How many servers exist in the computing

environment?

Deploying iLO can eliminate the need

for keyboards, video monitors, and

mice, which reduces cabling complexity

and increases server density in the

datacenter.

Systems

management

How are remote sites and data center

servers currently managed?

Can the servers be managed remotely

through lights-out technology?

The iLO device provides seamless

access to the server, which eliminates

the need for an administrator to be

present in front of the server.

Software or

operating system

How many different operating systems are

running on the servers? What is the plan

to take them all to the latest release?

Ensuring that the latest drivers are

downloaded as needed

Security Is the network as secure as possible?

Does the datacenter use virtual private

networks or include firewalls?

Can all servers use directory services and

authentication?

Can the datacenter benefit from two-factor

authentication?

The iLO device provides multiple levels

of security, including directory

authentication, Secure Sockets Layer

(SSL) encryption, event generation for

failed login attempts, lockout of

configuration utilities, enforced delay

after unsuccessful login attempts, two-

factor authentication, and configurable

internet protocol (IP) port assignments.

When planning future server purchases, a customer can determine whether a server includes iLO by

referring to this Web page:

http://h18013.www1.hp.com/products/servers/management/remotemgmt/supported-servers.html.

Customers that have a large installed based of iLO devices and frequently add more may want to

purchase a Master License Agreement (MLA) from HP. An MLA allows the customer to purchase a

single activation key for multiple licenses of the ProLiant Essentials Value Packs, such as the iLO

Advanced Pack. After the MLA is in place with HP, the customer purchases the desired number of

license-only part numbers whenever additional licenses for iLO Advanced are needed. This simplifies

the software licensing process and reduces the amount of physical documentation that is shipped to

the customer. Additional information is available from the HP website:

http://h18004.www1.hp.com/products/servers/proliantessentials/license/licensebuy.html.

Planning considerations for network configuration

Before deploying iLO devices, an administrator should consider the setup and design of the network

on which the iLO devices will reside.

Private management network

The iLO devices allow browser access to the host ProLiant servers through a seamless, hardware-

based, OS-independent remote console. For security reasons, HP recommends that customers

establish a private management network that is separate from their data network and that only

administrators are granted access to that management network. The iLO private management network

uses a shared network port. The autosensing iLO network interface card (NIC) operates at 10/100

megabits per second (Mbps) and links at the same speed as the host.

Network port configurations available to iLO

Possible configurations between the system network interface card NIC and the iLO based NIC

provide the user with choices to best suit individual system requirements (Figure 1). Choosing between

these options depends on knowing the benefits and cautions connected with each.

Figure 1. Three methods of iLO connectivity

Server

iLO

Mgmt

Port

Standard

Gigabit

Port

Common Network

Access

Server

iLO

Mgmt

Port

Standard

Gigabit

Port

Corporate Network

Management Network

Dedicated Network

Access

Server

iLO

Mgmt

Port

Shared

Port Access

Corporate/Management

Network

Standard

Gigabit

Port

Corporate/Management

Network

iLO common network

The iLO management port can be connected to the same network used by the server’s main

10/100/1000 NIC to allow iLO control from anywhere on the network. Using a common network

simplifies installation, since all cables attach to the same network; however, iLO management

performance may be hindered by corporate network traffic.

iLO Shared Network Port

The iLO Shared Network Port feature on ProLiant servers allows system administrators to access iLO

using a network connection shared with the host operating system. SNP enables this shared

connection with a single cable. The ProLiant server Shared Network Port feature implements a

sideband connection between the main NIC and the iLO. This sideband connection maintains a

second (and separate) MAC address. This separate MAC address is assigned to iLO and allows iLO

to obtain a separate IP address. Thus, iLO and the server’s NIC each have their own separate MAC

and IP addresses.

With iLO 2 only, shared network port provides a high-speed, full-featured connection to iLO. First

generation, iLO only servers with shared network port are limited-to a low-speed (text only) connection

to iLO when using the shared port.

When teaming host NICs, the iLO Shared Network Port can still be used, however iLO does not

benefit from teaming fault tolerance, nor does Shared Network Port prevent teaming, since iLO and

the host have separate MAC and IP addresses.

This feature reduces the number of network connections required to manage the server. The Shared

Network Port operates as miniature network switch, routing iLO information to the iLO network

interface and server operating system information to the operating system network interface. Using

this routing, where both ports are connected to the corporate network, allows fewer network

connections to the system. This approach enables access to iLO from anywhere on the network. One

issue to consider when implementing the iLO common network approach is that there will be an

increase in traffic on the corporate network.

A corporate network configuration reduces the amount of networking hardware and infrastructure

required to support iLO because iLO uses existing DNS and DHCP servers and routers. Additionally,

with iLO 2 only, the shared network port performance is comparable to the iLO Dedicated Network

Port.

Note:

The iLO Shared Network Port function is available only on a limited number

of ProLiant servers. This function is supported by both the NIC and iLO

firmware.

Optional use of VLAN tags allows segregation of management traffic.

iLO on dedicated management network

Use of the iLO port on a separate management network improves performance, security, and provides

redundant access to the server when a hardware failure occurs on the corporate network. In this

configuration, iLO cannot be accessed directly from the corporate network.

A separate management network increases the security through the ability to physically control which

workstations are connected to the network.

Considerations when configuring the iLO network

Administrators can use a hierarchical decision tree (Figure 2) to analyze the benefits of choosing

particular network configurations.

Figure 2. Planning iLO network implementation

Is there a

dedicated

management

network?

Yes

Should iLO be

accessible

from the

network?

Port

constrained?

Port

constrained?

How to implement iLO

network

Yes No

Deploy iLO on

dedicated network

Use iLO Shared

Network Port

capability (if

available) and

connect to the

production network

Connect iLO to the

Production network

Yes

Use iLO Shared Network

Port capability- Assign

VLAN ID to the

management network

and connect to a switch

configured to support

VLAN

Yes

Connect the dedicated

iLO network to a new

management network

HP recommends using the Dedicated Management Network and the dedicated iLO network port for

highest performance and security. If port constrained, administrators can use the iLO shared network

port with VLAN on supported ProLiant servers.

Network cabling in dense rack environments

When deploying multiple iLO-enabled servers in very dense rack environments, it is beneficial to

consolidate all of the iLO network connections to a rack-mounted hub or access switch (Figure 3). The

administrator may then uplink all Lights-Out Management network traffic via a single output from the

hub/switch into a distribution switch in the enterprise network infrastructure.

Using an access switch for Lights-Out management traffic on the network provides the following

benefits:

•Simplifies cable management inside the rack

•Makes more efficient use of available bandwidth

•Reduces the number of network cables run to the rack for management traffic

•Reduces usage of more expensive enterprise network infrastructure ports

Figure 3. Consolidating multiple iLO devices into a single rack-mounted access switch

Out-of-band management using iLO’s virtual serial port

The Virtual Serial Port (iLO) and Remote Serial Console (iLO 2) functions allow access to the physical

serial port of the server virtually through the iLO network connection. These two functions are

technically equivalent; only the names changed between iLO and iLO 2. The Remote Serial Console

option relies on the Virtual Serial Port. The Virtual Serial Port must be correctly enabled and

configured in the host RBSU. There are three methods of accessing the Remote Serial Console or

Virtual Serial Port:

•Using a Windows or Linux browser, a Java applet is launched which provides VT320 console

capability to the serial port connection.

•Using a telnet client, a command can be issued to connect to the serial port.

•Using a SSH client in a manner similar to that from the telnet client.

The Remote Serial Console or Virtual Serial Port function enables access to the Microsoft EMS

(Emergency Management Services) SAC (Special Administration Console), and the Linux serial

console, as well as to the ProLiant System ROM BIOS Serial Console Redirection.

For more information on Remote Serial Console (iLO 2) and Virtual Serial Port (iLO) functions see the

iLO users guide and Integrated Lights-Out Virtual Serial Port papers referenced in “For more information”

at the end of this paper.

iLO configuration

Each iLO device can be configured individually in multiple ways: through the ROM-Based Setup Utility

(RBSU), through the web browser interface, through the Command Line Protocol (CLP), or through a

scripted setup over the network or from the host. This allows the administrator to configure iLO using

the appropriate means for their environment, and enables 1:1 configuration (such as using a browser)

or 1:many configuration (such as using a scripted setup).

Single iLO device

RBSU is the recommended method to set up a single iLO device initially. RBSU allows configuration of

the iLO network address as well as a local user account. After initial setup using iLO RBSU, the iLO

device is available on the network; and subsequent configuration and management can be

accomplished by other means. RBSU is available every time the server is booted and can be run

remotely using the iLO Remote Console. RBSU is not intended for continued administration. Other

tools such as the web browser or scripting tools are better suited for that.

See the iLO User Guide for more information about ea the configuration methods discussed here.

Links to the iLO User Guides may be found on the ‘For more information’ page at the end of this

document.

Multiple iLO devices

Administrators faced with the deployment of multiple iLO compliant servers should employ efficient

configuration and management methods.

Automated setup

Deploying a large number of iLO-enabled servers is best accomplished by using several OS specific,

automated setup enablers. These enablers include the Lights-Out Configuration Utility

(CPQLOCFG.EXE), the Online Configuration Utility (HPONCFG.EXE), and a Perl interpreter that

communicates with iLO. These utilities support the use of script files allowing administrators to

configure and manage user accounts on multiple iLO devices simultaneously. HP has developed and

made available sample XML and Perl scripts files that can be adjusted for the targeted environment.

Additionally, HP recommends using a bar code scanner (see Appendix A) to further facilitate

automation.

Administrators can expand or change the sample XML scripts to perform other functions such as to

power up or down servers or determine who has access rights to iLO. The iLO User Guide includes

the supported XML commands for additional script development.

Appendix A discusses, in detail, how to use these utilities, their respective sample script files and the

bar code reader in order to automate the deployment and configuration of multiple iLO devices.

The CPQLOCFG.EXE, HPONCFG.EXE, and the sample scripts files are available from the HP website

at the links found in Table 2. The CPQLOCFG.EXE version 2.5 or greater must be used for iLO

devices.

Table 2. Links to Online Configuration utilities and XML scripting samples

Software Links

CPQLOCFG.EXE http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang

=en&cc=US&swItem=MTX-

5ee197c5bd7641359f45d876b1&prodTypeId=15351&prodSeriesId=397989

HPONCFG.EXE

for Windows

http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lan

g=en&cc=us&prodTypeId=18964&prodSeriesId=1146658&prodNameId=1135772

&swEnvOID=1005&swLang=8&mode=2&taskId=135&swItem=MTX-

ea306043175c40bcb35952a862

Software Links

HPONCFG.EXE

for Linux

http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang

=en&cc=us&prodTypeId=18964&prodSeriesId=1146658&prodNameId=1135772&s

wEnvOID=2025&swLang=8&mode=2&taskId=135&swItem=MTX-

0e9ae397b9224e3dae2fb457d5

XML scripting

sample for

Windows

http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang

=en&cc=us&prodTypeId=18964&prodSeriesId=1146658&prodNameId=1135772&s

wEnvOID=1005&swLang=8&mode=2&taskId=135&swItem=MTX-

84d9a19b43b84516ac2d26d01f

Initial deployment

HP recommends using a bar code scanner to further facilitate automation. Appendix A discusses, in

detail, how to use these utilities, their respective sample script files and the bar code reader in order

to automate the deployment and configuration of multiple iLO devices.

HP recommends that administrators use these sample files and a bar code reader to scan all the

passwords and Domain Name System or Service (DNS) names from the network settings tag into a

spreadsheet or database. (An administrator can manually enter the passwords and DNS names into a

spreadsheet; however, manual entry is much more time-consuming and error-prone than scanning.)

Then, using the appropriate XML script, the administrator can configure the group of iLO devices, add

the license keys for the iLO Advanced functionality, upgrade firmware on the iLO devices, add a new

user, or change user privileges.

After initially configuring iLO, it is possible to continue deploying the server, including the operating

system installation. Various methods are available to perform OS installation and configuration,

including iLO virtual media, Rapid Deployment Pack, or custom installation tools. Appendix B outlines

a sample custom installation tool that allows installation of the operating system during a mass

deployment operation.

Naming conventions

When deploying many iLO devices, it is helpful to name them according to a consistent convention,

for example: ServerName_iLO. This convention clearly identifies which server is hosting the iLO

device and makes it easier to set up proxy settings for wildcard usage.

iLO network settings

The Network Settings and DCHP/DNS tabs of the Network section allow administrators to view and

modify network settings for iLO 2. The Network Settings tab of the Network section displays NIC IP

address, subnet mask, and other TCP/IP related settings. All users can view the Network Settings, but

only users with the Configure iLO 2 Settings privilege can change these settings.

Proxy servers

Each iLO device can be accessed by its short name (for example, remote21), fully qualified name (for

example, remote21.domain.com), or Internet protocol (IP) address. The browser needs to be

configured to bypass the proxy server for each method used to access the iLO device.

Configuring IP port assignments

Administrators can manually configure the HTTP, Remote Console, and Virtual Media ports used by

the iLO device. Normally, a web browser automatically attempts to connect with port 80 when given

an IP address. Using the port configuration capability, the administrator can redirect the HTTP,

Remote Console, and Virtual Media ports to administrator-defined ports (Table 3). This redirection

prevents others from accessing the HTTP, Remote Console, and Virtual Media ports without specific

knowledge of the port numbers. Once the HTTP port is re-directed, a user must specify that port along

with the IP address to access the login screen. This may be particularly useful for customers who wish

Autres manuels pour AB500A - Integrated Lights-Out Advanced

Table des matières

Autres manuels HP Logiciel

HP ProLiant xw25p Manuel utilisateur

HP ProLiant ML310 Generation 5p Manuel utilisateur

HP 4X - DDR InfiniBand Mezzanine HCA Mode d’emploi

HP BB118BV - StorageWorks Data Protector Express... Instructions d'installation et d'utilisation

HP J4813A Manuel utilisateur

HP B6960-96035 Manuel utilisateur

HP StorageWorks 2/32 - SAN Switch Mode d’emploi

HP Integrity rx2800 - i2 Manuel utilisateur

HP Integrity BL860c Manuel utilisateur

HP 742n - Pavilion - 512 MB RAM Guide de référence rapide

HP BladeSystem bc2000 - Blade PC Manuel de service

HP Data Protector A.06.11 Manuel utilisateur

HP BladeSystem bc2000 - Blade PC Manuel de service

HP 2230s - Compaq Business Notebook Mode d’emploi

HP HP NonStop Data Transformation Engine FTP... Manuel utilisateur

HP T5145 - Thin Client - Tower Manuel utilisateur

HP t5630 - Thin Client Instructions d'installation et d'utilisation

HP A4500A - VMEbus Single Board Computer 744... Mode d’emploi

HP Integrity Superdome 2 Manuel utilisateur

HP T5145 - Thin Client - Tower Manuel de service

HP StorageWorks 2/16 - SAN Switch Manuel utilisateur

HP Media Center m1000 - Desktop PC Guide de démarrage rapide

HP P9000 Mode d’emploi

HP ProLiant BL620c G7 Instructions d'installation et d'utilisation

Manuels Logiciel populaires d'autres marques

COMPRO

COMPRO COMPROFM Manuel utilisateur

Muratec

Muratec OFFICEBRIDGE ONLINE Manuel utilisateur

Oracle

Oracle Contact Center Anywhere 8.1 Manuel utilisateur

Adobe

Adobe 65007312 - Photoshop Lightroom Manuel

Avaya

Avaya NULL One-X for RIM Blackberry Manuel utilisateur

PS Audio

PS Audio PowerPlay Manuel du propriétaire

Brady

Brady LOCKOUT PRO 3.0 Manuel de service

Avaya

Avaya Interaction Center Manuel utilisateur

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Manuel

Novell

Novell GROUPWISE 8 - INTERNET AGENT Manuel utilisateur

Oracle

Oracle Application 9i Manuel utilisateur

Acer

Acer RDM Manuel utilisateur

Canon

Canon Vixia HF21 Manuel utilisateur

Canon

Canon ZR950 Manuel utilisateur

Samsung

Samsung Auto Backup Manuel utilisateur

Polycom

Polycom Vortex EF2201 Instructions d'installation et d'utilisation

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c Manuel utilisateur

Novell

Novell SP2 - S Mode d’emploi