Emerson Avocent ACS 6000 User manual

Avocent® ACS 6000 Advanced Console Server
Installer/User Guide

Emerson, Emerson Network Power and the Emerson Network Power logo are trademarks or service marks of Emerson Electric
Co. Avocent, the Avocent logo and Cyclades are trademarks or service marks of Avocent Corporation or its affiliates in the U.S. and
other countries. Liebert is a trademark and service mark of Liebert Corporation. Allother marks are the property of their respective
owners. This document may contain confidential and/or proprietary information of Avocent Corporation, and its receipt or
possession does not convey any right to reproduce, disclose its contents, or to manufacture or sell anything that it may describe.
Reproduction, disclosure, or use without specific authorization from Avocent Corporation is strictly prohibited. ©2014 Avocent
Corporation. All rights reserved.
NOTE: This document supports versions up to and including release 3.0
For important safety information, visit:
www.emersonnetworkpower.com/ComplianceRegulatoryInfo

i
TABLE OF CONTENTS
Introduction 1
Features and Benefits 1
Access options 1
Web manager 2
IPv4 and IPv6 support 2
Flexible users and groups 3
Security 3
Authentication 3
VPN based on IPSec with NAT traversal 3
Packet filtering 3
SNMP 4
Data logging, notifications, alarms and data buffering 4
Power management 4
Auto discovery 4
FIPS module 4
Configuration Example 4
Installation 7
Getting Started 7
Supplied with the console server 7
Additional items needed 7
Rack Mounting 7
Connecting the Hardware 8
Console server connectors 8
Connecting device consoles or modems to serial ports 10
Turning On the Console Server 11
AC power 11
DC power 12
Configuring a Console Server 13
Using Telnet or SSH 13
Accessing the Console Server via the Web Manager 17
Web Manager Overview for Administrators 17
Wizard Mode 18
Expert Mode 20
Access 20
System Tools 21
System 22
Security 22
Date and Time 26
Help and Language 27
General 27
Boot Configuration 28

ii.....Avocent® ACS 6000 Advanced Console Server
Information 28
Usage 29
Network 29
Settings 29
Devices 29
IPv4 and IPv6 static routes 30
Hosts 30
Firewall 31
IPSec(VPN) 33
SNMP Configuration 34
Ports 35
Serial ports 35
Auxiliary ports 42
CAS Profile 42
Dial-in Profile 45
Dial-out Profile 47
Pluggable Devices 48
Device configuration 49
Authentication 49
Appliance authentication 50
Authentication servers 51
Users Accounts and User Groups 53
Local accounts 53
User groups 54
DSView software access rights 61
Event Notifications 61
Event List 61
Event Destinations 62
Trap Forward 62
Data Buffering 63
Appliance logging 63
Sensors 64
Power Management 64
PDUs 65
Login 67
Outlet Groups 67
Network PDUs 68
Active Sessions 68
Monitoring 69
Change Password 69
Web Manager Overview for Regular Users 70
Appendices 71
Technical Specifications 71

.....iii
Recovering a Console Server's Password 72
Port Information for Communication with the DSView Software 73
Accessing a Console Server with a DSView Software Installation via Dial-up 74
Installing DSView software with an OOB back door 74
Configuring dial-up for a console server 74
Internal Modem 77
AT+MS modulation selection 80
Set telephone extension option 81
AT S registers 81
Basic modem result codes 82
Digital line guard 82
Sleep mode operation 83
Disconnecting a call 83
Selecting country codes 83
Using caller ID 84
Technical Support 86

Introduction
The Avocent® ACS 6000 advanced console server is a 1U appliance that serves as a single point
for access and administration of connected devices, such as target device consoles, modems and
power devices. Console servers support secure remote data center management and out-of-band
management of IT assets from any location worldwide.
NOTE: Unless noted, references to a console server refer to all models in the 60XX series.
Console servers provide secure local (console port) and remote (IP and dial-up) access. The
console servers run the Linux®operating system with a persistent file system in Flash memory, and
can be upgraded from either FTP or a DSView™4 management software server.
NOTE: Unless otherwise noted, all references to DSView software in this document refer to version 4 or
greater.
Multiple administrators can be logged into the console server at the same time and can use the web
manager, the Command Line Interface (CLI utility) or DSView software to access and configure the
console server.
Some models feature two PC card/slots to support modem, Ethernet, fast Ethernet (fiber optic) and
storage PC cards (16 bit and 32 bit). One USB port supports modem (V.92 and Wireles), storage
devices and USB hubs. Two fast Ethernet ports support connections to more than one network or
configuration of Ethernet bonding (failover) for redundancy and greater reliability. For dial-in and
secure dial-back with Point-to-Point Protocol (PPP), optional internal modems can be factory
installed, or you can use external modems or wireless modem CardBus devices.
Features and Benefits
Access options
Secure access is available through the following local (analog console port) and remote (digital IP
and dial-up) options:
•LAN/WAN IP network connection.
•Dial-up to a factory-configured internal modem (optional), a modem connected either to a
serial port or the AUX port (which is only possible when an internal modem is not installed), or
to a PC phone card installed in one of the PC card slots (if applicable)or in the USB port or a
wireless modem.

2.....Avocent® ACS 6000 Advanced Console Server
•Target device connection. An authorized user can make a Telnet, SSH v1, SSH v2 or Raw
connection to a target device. For Telnet or SSH to be used for target device connections, the
Telnet or SSH service must be configured in the Security Profile that is in effect.
•Console server console connection. An administrator can log in either from a local terminal or
from a computer with a terminal emulation program that is connected to the console port and
can use the CLI utility. The CLI utility prompt (--|- cli>) displays at login.
More than one administrator can log into the console server and have an active CLI or web
manager session. All sessions receive the following warning message when the configuration is
changed by another administrator or by the system: The appliance configuration has been altered
from outside of your session. Upon receipt of this message, each administrator needs to verify that
changes made during the session were saved.
Web manager
Users and administrators can perform most tasks through the web manager (accessed with HTTP
or HTTPS). The web manager runs in Microsoft®Internet Explorer®, Mozilla®Firefox®, and
Apple®Safari®on any supported computer that has network access to the console server. The list
of supported client browsers and their versions are available in the release notes.
IPv4 and IPv6 support
The console server supports dual stack IPv4 and IPv6 protocols. The administrator can use the
web manager or CLI to configure support for IPv4 addresses only or for both IPv4 and IPv6
addresses. The following list describes the IPv6 support provided in the console server:
•DHCP
•Dial-in and dial-out sessions (PPP links)
•DSView software integration
•eth0 and eth1 Ethernet interfaces
•Firewall (IP tables)
•HTTP/HTTPs
•Linux kernel
•Remote authentication: Radius, Tacacs+, LDAP and Kerberos servers
•SNMP
•SSH and Telnet access
•Syslog server
NOTE: Remote authentication NFS, NIS and IPSec are not supported with IPv6.

Introduction.....3
Flexible users and groups
An account can be defined for each user on the console server or on an authentication server. The
admin and root users have accounts by default, and either can add and configure other user
accounts. Access to ports can be optionally restricted based on authorizations an administrator can
assign to custom user groups. For more information, see Users Accounts and User Groups on
page 53.
Security
Security profiles determine which network services are enabled on the console server.
Administrators can either allow all users to access enabled ports or allow the configuration of group
authorizations to restrict access. You can also select a security profile, which defines which
services (FTP, ICMP, IPSec and Telnet) are enabled and SSH and HTTP/HTTPS access. The
administrator can select either a preconfigured security profile or create a custom profile. For more
information, see Security on page 22.
Authentication
Authentication can be performed locally, with One Time Passwords (OTP), a remote Kerberos,
LDAP, NIS, RADIUS, TACACS+ authentication server or a DSView server. The console server
also supports remote group authorizations for the LDAP, RADIUS and TACACS+ authentication
methods. Fallback mechanisms are also available.
Any authentication method configured for the console server or the ports is used for authentication
of any user who attempts to log in through Telnet, SSH or the web manager. For more information,
see Authentication on page 49.
VPN based on IPSec with NAT traversal
If IPSec is enabled in the selected security profile, an administrator can use the VPN feature to
enable secure connections. IPSec encryption with optional NAT traversal (which is configured by
default) creates a secure tunnel for dedicated communications between the console server and
other computers that have IPSec installed. ESP and AH authentication protocols, RSA Public Keys
and Shared Secret aresupported. For more information, see IPSec(VPN) on page 33.
Packet filtering
An administrator can configure a console server to filter packets like a firewall. Packet filtering is
controlled by chains, which are named profiles with user-defined rules. The console server filter
table contains a number of built-in chains that can be modified but not deleted. An administrator
can also create and configure new chains.

4.....Avocent® ACS 6000 Advanced Console Server
SNMP
If SNMP is enabled in the selected security profile, an administrator can configure the Simple
Network Management Protocol (SNMP) agent on the console server to answer requests sent by an
SNMP management application.
The console server SNMP agent supports SNMP v1/v2 and v3, MIB-II and Enterprise MIB. For
more information, see SNMP Configuration on page 34.
NOTE: The text files with the Enterprise MIB (ACS6000-MIB.asn) and the TRAP MIB (ACS6000-TRAP-
MIB.asn) are available in the appliance under the /usr/local/mibs directory.
Data logging, notifications, alarms and data buffering
An administrator can set up data logging, notifications and alarms to alert administrators of
problems with email, SMS, SNMP trap or DSView software notifications. An administrator can also
store buffered data locally, remotely or with DSView management software. Messages about the
console server and connected servers or devices can also be sent to syslog servers.
Power management
The console server enables users who are authorized for power management to turn power on,
turn power off and reset devices plugged into a connected power distribution unit (PDU). The
power devices can be connected to any serial port or to the AUX/Modem port (if an internal modem
is not installed). For more information, see Power Management on page 64.
Auto discovery
An administrator can enable auto discovery to find the hostname of a target connected to a serial
port. Auto discovery’s default probe and answer strings have a broad range. An administrator can
configure site-specific probe and answer strings. Auto discovery can also be configured through
the DSView software.
FIPS module
The 140 series of Federal Information Processing Standards (FIPS) are U.S. government
computer security standards that specify requirements for cryptography modules.
The console server uses an embedded FIPS 140-2 validated cryptographic module (Certificate No.
1747)running on a Linux PPCplatform per FIPS 140-2 Implementation Guidance section G.5
guidelines. For more information, see FIPS module on page 23.
Configuration Example
The following graphic and table illustrate a typical ACS 6000 console server configuration.

Introduction.....5
Typical ACS 6000 Advanced Console Server Configuration
Number Description Number Description
1 ACS 6000 advanced console server 8 Phone line
2 Target devices 9 Remote dial-in
client
3 PDU (one or more) 10 Local Area
Network (LAN)
4 Serial port connection 11 LAN firewall
5PC card (modem, Ethernet or storage - not available on all
models) 12
Remote
authentication
server
6 Either AUX/Modem or any serial port 13 DSView
client/server
7
Modem ordered and configured internally at the factory -or-
external modem (on a device in one of the PC card slots or USB
port, or connected to a serial port or the AUX port)
14
Remote/local
Windows/Linux
computer
Typical ACS 6000 Advanced Console Server Configuration Descriptions

Introduction.....6

Installation
Getting Started
Before installing your ACS 6000 console server, refer to the following list to ensure you have all
items that shipped with it , as well as other items necessary for proper installation.
Supplied with the console server
•Quick InstallationGuide (QIG)
•Power Cord
•RJ-45 to RJ-45 straight-through CAT 5cable
•RJ-45 to DB-9F cross adaptor
•DB-25 loop-back plug
•RJ-45 to DB-25M cross adaptor
•RJ-45 to DB-25F cross adaptor
•RJ-45 to DM-25M straight-through cable
•Mounting brackets, screws and cord retention clips
•Keyhole mounting kit
•Software License Agreement
•Safety Sheet
Additional items needed
If you are configuring the console server in a standalone configuration, you will also need the
following items:
•One or more RJ-45 to RJ-45 CAT 5 straight-through cables
•An RJ-45 to DB-9F straight-through adaptor
•A PC running a terminal emulation program
Rack Mounting
You can mount the console server in a rack or cabinet, or place it on a desktop or other flat surface.
For rack or cabinet mounting, two mounting brackets are supplied.
To rack mount a console server:

8.....Avocent® ACS 6000 Advanced Console Server
1. Install the brackets at the front or back edges of the console server with the screws provided
with the mounting kit.
2. Mount the console server in a secure position.
Bracket Connections for Front Mount Configuration
Connecting the Hardware
Console server connectors
The following figure shows the connectors on the front of the ACS 6000 console server.
Front of the Console Server (ACS 6032 Console Server Shown)
Number Description
1 USB connector
2 LEDs
3 PC card slots (not available on all models)
Connectors on the Console Server Front

Installation.....9
Label Description
PWR/CPU
• Blue Blinks - During unit boot
• Solid - During operation
• Off - Power is off
ETH 0/ETH 1
• Amber - Link at 10BaseT speed
• Yellow - Link at 100BaseT speed
• Green - Link at 1000BaseT speed
• Off - No link/cable disconnected/Ethernet fault
AUX/MODEM
Dual LED: Yellow on top, green on bottom
• Yellow - DTR/DCD activity
• Green - TXD and RXD activity
• Off - No activity
[One LED for each serial port]
Green
• Blinks - Ready, with activity
• Solid - Ready
• Off - Not ready
LEDs on the Console Server Front
The following figure shows the rear connectors on the console server.
Rear of the Console Server (ACS 6032 Console Server Shown)
Number Description
1 Power supplies (dual AC shown).
2 Serial ports (32 ports shown). Models come with 4, 8, 16, 32 or 48 serial ports.
3 ETH 1 10/100M/1G Ethernet port. Can be connected to a second network or used for failover.
4
AUX/Modem port. If an optional internal modem is ordered, this port is defined as a V.92 modem at
the factory; otherwise, the port is factory-defined as RS-232 with an RJ-45 ACS console server
pinout and can be used to connect either an external modem or a power device.
5 ETH0 10/100M/1G Ethernet port for remote IP access.
6Console port. Allows for local administration and access to connected devices through a terminal or
a computer with a terminal emulator.
Connectors on the Console Server Rear

10.....Avocent® ACS 6000 Advanced Console Server
Connecting device consoles or modems to serial ports
Use CAT 5 or greater cables and DB-9 or DB-25 console adaptors as needed to connect target
device consoles or modems to the serial ports on the console server.
The console server supports the Cisco®serial port pinout configuration, which is disabled by
default. If a Cisco cable is connected to a port, an administrator must enable the Cisco pinout for the
port. An administrator can select Expert - Ports - Serial Ports - (SetCAS or SetPower) - Physical to
open the Physical Settings screen, then check Enable Cisco RJ Pin-Out.
The following tables show serial port pinout information.
Pin No. Signal Name Input/Output
1 RTS OUT
2 DTR OUT
3 TxD OUT
4 GND N/A
5 CTS IN
6 RxD IN
7 DCD/DSR IN
8 Not Used N/A
ACS Console Server Serial Port Pinout
Pin No. Signal Name Input/Output
1 CTS IN
2 DCD/DSR IN
3 RxD IN
4 GND N/A
5 Not Used N/A
6 TxD OUT
7 DTR OUT
8 RTS OUT
Cisco Serial Port Pinout
To connect devices, modems and PDUs to serial ports:
Make sure the crossover cable used to connect a device has the same pinout type that is
configured in the software for the port (either Cyclades or Cisco).
1. Make sure the devices to be connected are turned off.
2. Use CAT 5 or greater crossover cables to connect the devices to the console server, using an
adaptor, if necessary.

Installation.....11
3. To connect modems, use straight-through CAT 5 or greater cables, with an appropriate
connector or adaptor (USB, DB-9 or DB-25) for the modem.
NOTE: To comply with EMC requirements, use shielded cables for all port connections.
WARNING: Do not turn on the power on the connected devices until after the console server is turned on.
To daisy chain PDUs to a console server:
This procedure assumes that you have one PDU connected to a serial port on a console server.
NOTE: Daisy chaining is not possible with SPC PDUs. ServerTech PDUs will allow only one level (Master
and Slave) of daisy chaining.
1. Connect one end of a UTP cable with RJ-45 connectors to the OUT port of the connected
PDU.
2. Connect the other end of the cable to the IN port of the chained PDU. Repeat both steps until
you have connected the desired number of PDUs.
NOTE: For performance reasons, Avocent recommends connecting no more than 128 outlets per serial
port.
Turning On the Console Server
The console server is supplied with single or dual AC or DC power supplies.
WARNING: Always execute the shutdown command through the web manager, CLI or DSView software
under the Overview/Tools node before turning the console server off, then on again. This will ensure the
reset doesn't occur while the file system in Flash is being accessed, and it helps avoiding Flash memory
corruptions.
AC power
To turn on a console server with AC power:
1. Make sure the console server is turned off.
2. Plug the power cable into the console server and into a power source.
3. Turn the console server on.
4. Turn on the power switches of the connected devices.

12.....Avocent® ACS 6000 Advanced Console Server
DC power
DC power is connected to DC-powered console servers by way of three wires: Return (RTN),
Ground (GND) and -48 VDC.
WARNING: It is critical that the power source supports the DC power requirements of your console server.
Make sure that your power source is the correct type and that your DC power cables are in good condition
before proceeding. Failure to do so could result in personal injury or damage to the equipment.
The following diagram shows the connector configuration for DC power.
DC Power Connection Terminal Block
Number Description Number Description
1 Power switch 3 GND (Ground)
2 RTN (Return) 4 -48 VDC
DC Power Connection Details
To turn on a console server with DC power:
1. Make sure the console server is turned off.
2. Make sure DC power cables are not connected to a power source.
3. Remove the protective cover from the DC power block by sliding it to the left or right.
4. Loosen all three DC power connection terminal screws.
5. Connect your return lead to the RTN terminal, your ground lead to the GND terminal and your
-48 VDC lead to the -48 VDC terminal and tighten the screws.
6. Slide the protective cover back into place over the DC terminal block.
7. If your console server has dual-input DC terminals, repeat steps 3-6 for the second terminal.
8. Connect the DC power cables to the DC power source and turn on the DC power source.
9. Turn on the console server.

Installation.....13
10. Turn on the power switches of the connected devices.
Configuring a Console Server
A console server may be configured at the appliance level through the command line interface
accessed through the CONSOLE or Ethernet port. All terminal commands are accessed through a
terminal or PC running terminal emulation software.
NOTE: To configure using DSView software, see the DSView Software Installer/User Guide. To configure
using the console server’s web manager, see Chapter 3. To configure using Telnet or SSH, see the ACS
6000 Command Reference Guide.
To connect a terminal to the console server:
1. Using a null modem cable, connect a terminal or a PC that is running terminal emulation
software (such as HyperTerminal®) to the CONSOLE port on the back panel of the console
server. An RJ-45 to DB9 (female) cross adaptor is provided.
The terminal settings are 9600 bits per second (bps), 8 bits, 1 stop bit, no parity and no flow
control.
2. Turn on the console server. When the console server completes initialization, the terminal will
display the login banner plus the login prompt.
Using Telnet or SSH
An authorized user can use a Telnet or SSH client to make a connection directly to the console of a
device if all of the following are true:
The Telnet or SSH:
•protocol is enabled in the selected security profile
•protocol is configured for the port
•client is available, and it is enabled on the computer from which the connection is made
To use Telnet to connect to a device through a serial port:
For this procedure, you need the username configured to access the serial port, the port name (for
example, 14-35-60-p-1), device name (for example, ttyS1), TCP port alias (for example, 7001) or
IP port alias (for example, 100.0.0.100) and the hostname of the console server or its IP address.
To use a Telnet client, enter the information in the dialog boxes of the client.
-or-
To use Telnet in a shell, enter the following command:

14.....Avocent® ACS 6000 Advanced Console Server
# telnet [hostname |IP_address]
login: username:[portname | device_name]
-or-
# telnet [hostname | IP_address]TCP_Port_Alias
login: username
-or-
# telnet IP_Port_Alias
login: username
To close a Telnet session:
Enter the Telnet hotkey defined for the client. The default is Ctrl ] + q to quit, or enter the text
session hotkey for the CLI prompt and then enter quit.
To use SSH to connect to a device through a serial port:
For this procedure, you need the username configured to access the serial port, the port name (for
example, 14-35-60-p-1), TCP port alias (for example, 7001), device name (for example, ttyS1),
and the hostname of the console server, IP address or IP Port alias (for example, 100.0.0.100).
To use an SSH client, enter the information in the dialog boxes of the client.
-or-
To use SSH in a shell, enter the following command:
ssh -l username:port_name [hostname | IP_address]
-or-
ssh -l username:device_name [hostname | IP_address]
-or-
ssh -l username:TCP_Port_Alias [hostname | IP_address]
-or-
ssh -l username IP_Port_Alias
To close an SSH session: