Avigilon VMA-AS3X-IPMI Operating instructions

Avigilon HDVA3X IPMI Kit
Installation and Operations
Guide
VMA-AS3X-IPMI
For
VMA-AS3X-24P VMA-AS3X-16P
VMA-AS3X-8P

© 2023,Avigilon Corporation. All rights reserved. AVIGILON, the AVIGILON logo, AVIGILON are trademarks
of Avigilon Corporation. Intel is a trademark of Intel Corporation or its subsidiaries in the U.S. and/or other
countries. Other names or logos mentioned herein may be the trademarks of their respective owners. The
absence of the symbols ™ and ® in proximity to each trademark in this document or at all is not a disclaimer of
ownership of the related trademark.
This document has been compiled and published using product descriptions and specifications available at
the time of publication. The contents of this document and the specifications of the products discussed
herein are subject to change without notice. Avigilon Corporation reserves the right to make any such
changes without notice. Neither Avigilon Corporation nor any of its affiliated companies: (1) guarantees the
completeness or accuracy of the information contained in this document; or (2) is responsible for your use of,
or reliance on, the information. Avigilon Corporation shall not be responsible for any losses or damages
(including consequential damages) caused by reliance on the information presented herein.
Avigilon Corporation
avigilon.com
20230601
2

Table of Contents
Introduction 7
Supported HD Video Appliances 7
Confirm Package Contents 8
Required Tools 8
Before You Begin 8
In cases where the label is missing or unreadable 8
Installing the IPMI Module 10
Configuring DHCP 12
Accessing the IPMIWeb Interface the First Time 13
Overview 14
Functional Description 14
Power and Reset Control 14
Firmware Upgrade 14
Cooling Management 14
KVM (Kernel Virtual Machine) Control 14
Messaging Interface 14
Using the IPMIWeb Interface 16
Browser Setting Requirements 16
Allow File Downloads From This Site 16
Enable Java Script for This Site 16
Enable Cookies for This Site 16
Avoid Using the Following Browser Functions 16
Dashboard 16
Sensor Readings 17
Logs & Reports 17
IPMI Event Log 17
System Log 17
Audit Log 17
IPMI Settings 18
Captured BSOD 18
Date & Time Settings 18
Select the Time Zone 18
Automatically Set the Date & Time with an NTP Server 18
Manually Set the Date & Time 18
3

External User Services 18
LDAP / E-Directory Settings 19
Setting Up LDAP / E-Directory Authentication 19
Adding a New Role Group 20
RADIUSSettings 20
Configuring RADIUS Authentication 20
KVM Mouse Settings 21
Log Settings 21
SELLog Settings Policy 21
Advanced Log Settings 21
Configuring the Remote Server to Enable Syslogging 22
Media Redirection Settings 22
Network Settings 22
Network IP Settings 22
Network Link Configuration 23
DNS Configuration 23
Platform Event Filters 24
Event Filters 24
Alert Policies 26
Adding an Alert Policy 26
Deleting an Alert Policy 26
LAN Destinations 27
Adding a LAN Destination 27
Deleting a LAN Destination 27
Services Settings 27
Viewing Service Details 27
Viewing Active Sessions 28
Modifying an Existing Service 29
SMTP Settings 30
SSL Settings 30
Using a CA-Signed SSL Certificate 31
Using the Certificate Signing Request Workflow 31
Using a Self-Signed Certificate 32
System Firewall Settings 33
General Firewall Settings 33
Adding Firewall Settings 33
Updating Existing Firewall Settings 34
4

IPAddress Firewall Rules 34
Adding an IP Rule 34
Viewing Existing IPRules 35
Port Firewall Rules 35
Adding a Port Rule 35
Viewing Existing Port Rules 36
User Management 36
Adding a New User 37
Unsupported Password Characters 38
Modifying an Existing User 39
Reserved Users 40
Remote Control 41
Supported Browsers 41
Using the Remote Control Interface 41
Power Control 44
ACPI Shutdown Windows Settings 44
Maintenance Options 45
Backup Configuration 45
Dual Firmware Update 45
Dual Image Configuration 46
Firmware Image Location 47
Firmware Information 47
HPM Firmware Update 47
Preserve Configuration 48
Restore Factory Defaults 49
Restoring Factory Defaults with ipmitool Commands 49
Set Preserve Configuration Status 49
Request Data: 50
Response Data: 50
Get Preserve Configuration Status 50
Request Data: 51
Response Data: 51
Restore Default Configuration Command 52
Response Data: 52
Password Recovery 53
Setting Up Email Password Recovery 53
5

Password Recovery User Management Settings for Email Receiver 53
Password Recovery SMTP Settings 53
Internal Email Server 53
Gmail Server 53
Hotmail Server 54
Password Recovery with the IPMITool 55
For More Information 57
Product User Guides 57
6

Introduction
Avigilon provides an optional Intelligent Platform Management Interface (IPMI) Module Kit for the HD Video
Appliance 3X (HDVA3X). This kit provides you with enhanced remote control for the HDVA3X appliance, to
more easily control and monitor HDVA3X appliances from a central location.
Part Number Description
VMA-AS3X-IPMI HDVA3X IPMI Module Accessory Kit
Important: The IPMI module is only compatible with the HDVA3X model video appliance. Earlier
HDVA appliances do not support this accessory. A full list of the supported appliances is available
below.
Supported HD Video Appliances
VMA-AS3X-24P24 VMA-AS3X-16P12 VMA-AS3X-8P8
VMA-AS3X-24P18 VMA-AS3X-16P09 VMA-AS3X-8P4
VMA-AS3X-24P12 VMA-AS3X-16P06 VMA-AS3X-8P2
Introduction 7

Confirm Package Contents
Confirm that the kit you are installing contains the following components:
l1 × IPMI module
l3 × screws
l3 × standoffs
Required Tools
The following tools are not included in the kit package, but are needed to complete the installation:
lHDVA3X appliance (8/16/24 port)
lMonitor
lKeyboard and mouse
lPhillips #2 screwdriver
Important: It is recommended that you always use an antistatic mat and antistatic strap while
working on components inside the system.
Before You Begin
Important: The IPMI module is only compatible with the HDVA3X model video appliance. Earlier
HDVA appliances do not support this accessory. Before starting the installation you will confirm that
you have the correct model of HDVA for the IPMI module, and find the serial number that will be
needed later in the process.
1. Confirm that the HD Video Appliance is an HDVA3X (model number VMA-AS3X). Confirm by checking
the label on the bottom of the appliance.
2. When checking the label for the model number, note down the serial number listed in the top left
section of the label. This serial number will be needed to enter BIOS later.
In cases where the label is missing or unreadable
1. Boot up the appliance and login.
2. Open the command line interface.
Press the Windows key + R and the enter cmd in the Run dialog that opens.
3. Enter the following command to retrieve the model number information:
Confirm Package Contents 8

wmic COMPUTERSYSTEM get SystemSKUNumber
4. Enter the following command to retrieve the serial number information:
wmic BIOS get SerialNumber
In cases where the label is missing or unreadable 9

Installing the IPMI Module
The following steps will install the IPMImodule in your HDVA3X appliance.
Important: It is recommended that you always use an antistatic mat and antistatic strap while
working on components inside the system.
1. If turned on, power down the HDVA3X appliance.
2. Disconnect the power cord.
3. Use a Phillips #2 screwdriver to remove the two M2 screws on the back of the unit that secure the lid
in place.
4. Remove the lid by sliding it towards the back of the unit and then lifting the side of the lid with the
screw holes up.
5. Install the IPMI module board to the location shown below.
6. Secure the IPMI module board to the appliance with the three standoffs and M3 screws provided.
Installing the IPMI Module 10

7. Replace the lid back onto the unit and secure it in place with the two M2 screws.
8. By default, the IPMIWeb interface IPaddress is set to 192.168.1.2.
lIf you want to set the IPMI to DHCP, see Configuring DHCP on the next page.
lIf you want to continue using the default IPaddress, see Accessing the IPMIWeb Interface the
First Time on page13
9. Remove the two M2 Phillips screws that are securing the cover for the IPMImodule Ethernet port to
connect the Ethernet cable.
Installing the IPMI Module 11

Configuring DHCP
Note: The IPMI module is set to use the 192.168.1.2 static IPaddress by default. Use the process
below to switch to DHCP instead of the default static IP address. If you want to continue using the
default static IPaddress, proceed to Accessing the IPMIWeb Interface the First Time on the next
page.
1. Use a Cat5e Ethernet cable to connect the IPMI module Ethernet port to a DHCP server.
2. Power on the HDVA3X appliance and press the Delete key when prompted on the black Avigilon
splash screen next to the BIOS option. You will be prompted to enter a password.
3. Enter the unit's serial number as noted earlier in the process. For more information, see Before You
Begin on page8.
4. Navigate to the Server Mgmt page using the arrow keys on the keyboard.
5. Select BMC network configuration and press Enter.
6. On the BMC network configuration page, scroll down to Configuration Address source and change
the option to DynamicBmcDhcp.
7. Navigate to the Save & Exit tab and select Save Changes and Reset by using the arrow keys on the
keyboard, and press Enter.
8. Check the assigned DHCP address via BIOS for the IP address, by navigating to the Server Mgmt tab,
go to the BMC network configuration option and check the IP address on the right of the Station IP
Address line under Lan Channel 1.
Note: If you are connected to a DHCP server an IPaddress will be automatically assigned.
Configuring DHCP 12

Accessing the IPMIWeb Interface the First Time
To access the IPMI web interface, you will need a computer on the same network as the IPMI module and you
will need to know the IPaddress of the IPMImodule. The default static IPaddress is 192.168.1.2. If you
switched the IPMImodule to use DHCP to assign IPaddresses, contact your network administrator or
otherwise discover the assigned IPaddress of the IPMI module.
1. Open a web browser on a computer on the same network as the IPMImodule.
2. Enter https:// and the IPaddress of the IPMI module in the browser's address bar and press Enter.
The default static IPaddress is 192.168.1.2.
3. Use the default login credentials below to login to the IPMI web interface.
lUsername: admin
lPassword: admin
Note: To use the forgot my password option on the login screen, you must add an email address to
the user account for the one time password email to be sent to and configure the SMTPsettings for
sending the email. For more information, see Setting Up Email Password Recovery on page53.
Accessing the IPMIWeb Interface the First Time 13

Overview
The IPMI functionality of the HD Video Appliance is intended to comply with IPMI 2.0.
Functional Description
The IPMImodule will provide the following functions on the HD Video Appliance platform. These functions
cover the management of the platform, sensor monitoring, event logs, power/reset control, I2C access to
internal non-intelligent devices, and firmware upgrades of the IPMI module.
Power and Reset Control
All power and reset control can be completed by issuing corresponding IPMI commands. The IPMImodule
supports cold and warm resets. Resetting the IPMI module will not affect the system's operation.
lCold Reset: This command will cause the default settings to be restored. A SelfTest will also run as
part of this reset.
lWarm Reset: This command will reset the communication interface and the current settings will be left
as they are.
Firmware Upgrade
The IPMI module supports HPM.1 specification upgrading with rollback capability through either the LAN or
the KCS interface.
Cooling Management
The smart fan of the HD Video Appliance is controlled by BIOS instead of the IPMI module.
KVM (Kernel Virtual Machine) Control
The KVM control is HTML5-based. This web-based user interface allows you to easily monitor the HD Video
Appliance hardware information, including temperatures, fan rotations, voltages, and power. This application
also lets you instantly power on/off or reset the HD Video Appliance.
Messaging Interface
The messaging interfaces comply with IPMI v2.0. You can learn more about IPMImessaging interfaces in
general in the IPMI v2.0 Specification, Chapter 6 IPMIMessaging Interfaces, Chapter 9 Keyboard Controller
Style (KCS) Interface, and Chapter 13 IPMI LANInterface.
To meet the IPMIv2.0 specification, two channels are provided:
Overview 14

lKCS Channel: For communicating with the system payload (x86 motherboard).
lLAN Channel: Using the side-band interface NC-SI of the HD Video Appliance network interface card.
For the LAN port location, see Configuring DHCP on page12.
Messaging Interface 15

Using the IPMIWeb Interface
The IPMIweb-based user interface allows you to easily monitor the remote server's hardware information
such as temperatures, fan rotations, voltages and power. You can also remotely power on/off or reset the HD
Video Appliance.
Browser Setting Requirements
To properly use the IPMIweb interface, use the following browser settings:
Allow File Downloads From This Site
For Internet Explorer: Navigate to Tools > Internet Options > Security tab. Based on your device setup,
select from Internet, Local intranet, trusted sites and restricted sites. Click Custom level. In the Security
Settings - Zone dialog box, find the Download options under settings and enable the File download option.
Click Ok on all of the dialog boxes to save the changes.
For all other browsers: Accept the file download option when prompted.
Enable Java Script for This Site
If not already enabled, go to your browser's settings to enable java script for this site.
Enable Cookies for This Site
If not already enabled, change your browser's settings to allow cookies for this site.
Avoid Using the Following Browser Functions
Once you have logged in to the IPMIweb interface, avoid using the following browser functions:
lRefresh button
lRefresh menu
lBack and Forward buttons
lF5 on the keyboard
lBackspace on the keyboard
Dashboard
Click Dashboard to view the overall information and status of the HD Video Appliance.
From this page you can view a quick overview of system events, logs and sensor monitoring.
Using the IPMIWeb Interface 16

Sensor Readings
Click Sensor to view sensor related information on the Sensor Readings page.
From this page you can click on any sensor to view more information about that particular sensor, including
thresholds and a graphical representation of all associated events.
The Sensor Readings page provides live readings of all of the available sensors, including details like the
Sensor Name, Status, Current Reading, and Behavior. You can also choose the types of sensors that you
want to display in the list.
Logs & Reports
Expand Logs &Reports on the side menu to access the following pages:
lIPMI Event Log
lSystem Log
lAudit Log
IPMI Event Log
This page lists the event logs from the different sensors on this device. Double-click on a log to see its details.
You can sort the list by clicking on any of the column headers. You can filter the list by date, event type, or
sensor type.
You can click Clear Event Logs to delete the event logs.
System Log
This page lists the system events that have occurred on the device.
Note: Logs must be configured under Settings > Log Settings in order to display event entries. For
more information, see Log Settings on page21.
You can filter the list by date and event category.
Audit Log
This page lists any system events that have occurred on the device that have been configured as audit logs.
Note: Logs must be configured under Settings > Log Settings > Advanced Log Settings in order to
display event entries. For more information, see Log Settings on page21.
Sensor Readings 17

IPMI Settings
From the Settings page you can access various configuration settings for the IPMI module. See the sections
below for more information on the different settings pages available.
Captured BSOD
This page captures a screenshot of the blue screen and error messages that displays in the event of the
system crashing. If the system crashed since the last reboot and you want to find more details about the
crash, you can check this settings page for a screenshot of the blue screen message that was displayed just
before the crash.
Note: KVM service should be enabled to display the BSOD screen capture. KVM service can be
configured from Settings > Services > KVM.
Date & Time Settings
This page is used to set the date and time of the IPMI module. You can set the date and time manually or
automatically using an NTP service. See below for more details.
Select the Time Zone
Use the Select Time Zone drop-down list or the map to select the time zone for your location. This will then
display the exact local time for that time zone.
Automatically Set the Date & Time with an NTP Server
Select your time zone and then check the Automatic NTP Date & Time checkbox to enable the IPMImodule
date and time to be set by an NTP server.
Enter the NTP server hostname that should be used to automatically set the date and time in the Primary
NTPServer field. In the Secondary NTPServer field, enter the NTP server hostname for the server that will
be used if the primary server cannot be reached. The secondary NTPserver is optional. Click Save to save
these settings for your IPMIdate and time.
Manually Set the Date & Time
If you select to manually set the date and time, the map will be disabled for selecting the time zone. Use the
Select Time Zone drop-down list to select the time zone.
External User Services
From the External User Services page you can access various configuration settings for external user
services such as connecting to an LDAP directory or using the RADIUS (Remote Authentication Dial-in User
Service) protocol for dial-in users. See the sections below for more information on the external users services
available.
IPMI Settings 18

LDAP / E-Directory Settings
From the Lightweight Directory Access Protocol (LDAP) / E-Directory Settings page you need an LDAP or E-
directory server on your network to authenticate IPMIusers. This is done by passing login requests to your
LDAP server and helps to keep authentication centralized and avoid the need to create and update users in
multiple locations.
Important: The LDAP feature will not work with any version of Windows Server implementations of
LDAP/AD. If possible, please use an implementation of LDAP/AD other than Windows Server.
Setting Up LDAP / E-Directory Authentication
1. Navigate to Settings > External User Settings > LDAP/E-Directory Settings > General Settings.
2. Check the Enable LDAP/E-Directory Authentication box to enable this option.
3. Select the Encryption Type to use when communicating with the LDAP server. If SSL is selected,
make sure to use the correct port number.
4. Select IPAddress as the Common Name Type.
5. Enter the IPaddress of the LDAP server in the Server Address field. The IPMI module supports both
IPv4 and IPv6 address formats.
6. If you are using the StartTLS encryption type with FQDN, enter the FQDN address.
7. Enter the LDAP port number in the Port field.
The default port is 389. For SSLconnections the default port is 636. The port value ranges from 1 to
65535.
8. Enter the Bind DN that is used during the binding operation. This authenticates the client to the server.
The Bind DN is a string of 4-64 alpha-numeric characters and it must start with an alphabetic character.
Special characters such as .,-_= are allowed in positions other than the starting character.
9. Enter the Password.
The password must be between 1-48 characters. White space is not supported.
10. Enter the Search Base. The search base defines which part of the external directory tree to be
searched on the LDAP server. The search base may be something equivalent to the organization or
group in the external directory.
The Search Base is a string of 4-64 alpha-numeric characters and it must start with an alphabetic
character. Special characters such as .,-_= are allowed in positions other than the starting character.
11. Use the Attribute of User Login drop-down menu to select the attribute that should be used by the
LDAP/E-directory server to identify the user. The cn and uid attributes are supported by the IPMI
module.
12. Click Save to save the settings.
LDAP / E-Directory Settings 19

Adding a New Role Group
1. Navigate to Settings > External User Settings > LDAP/E-Directory Settings > Role Groups.
2. Select a blank row and click Add Role Group. Alternatively you can double-click the blank row.
3. Enter a Group Name to identify the role group.
The role group name is a string of up to 255 alpha-numeric characters. Special characters -and _are
supported.
4. Enter the Group Domain where the role group is located.
The domain name is a string of 4-64 alpha-numeric characters and it must start with an alphabetic
character. Special characters such as .,-_= are allowed in positions other than the starting character.
5. Enter the privilege level of the group in the Group Privilege field. The options are: User, Administrator,
Operator, or None.
6. Select the groups access for KVM and VMedia.
7. Click Save to save the new role group and return to the role group list.
RADIUSSettings
RADIUS is a modular, high performance and feature-rich RADIUS suite that includes servers, clients,
development libraries and numerous additional RADIUS-related utilities. The RADIUS settings page is used to
configure RADIUS authentication.
Configuring RADIUS Authentication
1. Navigate to Settings > External User Settings > RADIUS Settings > General RADIUS Settings.
2. Select the checkbox to Enable RADIUSAuthentication.
3. Enter the IPaddress of the RADIUSserver in the Server Address field. IPv4, IPv6, and FQDN formats
are supported.
4. Enter the RADIUS port number in the Port field.
The default port is 1812. The port value can range from 1 to 65535.
5. Enter the RADIUS server's authentication secret in the Secret field.
The secret must be between 4-31 characters long. White space is not supported.
6. Click Save to save the settings.
7. Navigate to Settings > External User Settings > RADIUS Settings > Advanced RADIUS Settings.
8. For authorization purposes, configure the RADIUS user with Vendor Specific Attributes from the
RADIUS server. If you change the vendor specific values on the RADIUS server, you should also
update those values on this page.
lExample 1 — testadmin:
Auth-Type= PAP
Cleartext-Password="admin"
Auth-Type=PAP
Vendor-Specific="H=4"
lExample 2 — testoperator:
Adding a New Role Group 20