HP AB500A - Integrated Lights-Out Advanced Quick guide

Planning and configuration recommendations
for Integrated Lights-Out processors
technology brief, 2nd edition
Abstract.............................................................................................................................................. 3
Introduction......................................................................................................................................... 3
IT environment assessment .................................................................................................................... 3
Planning considerations for network configuration ................................................................................... 4
Private management network............................................................................................................. 4
Network port configurations available to iLO ...................................................................................... 5
iLO common network .................................................................................................................... 5
iLO Shared Network Port .............................................................................................................. 5
iLO on dedicated management network.......................................................................................... 6
Considerations when configuring the iLO network ............................................................................ 7
Network cabling in dense rack environments................................................................................... 7
Out-of-band management using iLO’s virtual serial port..................................................................... 8
iLO configuration................................................................................................................................. 9
Single iLO device............................................................................................................................. 9
Multiple iLO devices ......................................................................................................................... 9
Automated setup .......................................................................................................................... 9
Initial deployment ....................................................................................................................... 10
Naming conventions................................................................................................................... 10
iLO network settings ....................................................................................................................... 10
Proxy servers ............................................................................................................................. 10
Configuring IP port assignments ................................................................................................... 10
IP port assignment for blades ....................................................................................................... 11
Implementing iLO network security architecture...................................................................................... 12
Default local iLO users accounts....................................................................................................... 12
Advantages of directory integration.................................................................................................. 12
How to begin directory implementation ............................................................................................ 13
Methods for directory services implementation................................................................................... 13
HP default schema method .............................................................................................................. 14
Support for nested groups ........................................................................................................... 15
HP extended schema method........................................................................................................... 15
Required Software...................................................................................................................... 15
Extending the directory schema.................................................................................................... 16
Roles......................................................................................................................................... 16
Integrating iLO login into complex network directories........................................................................ 17
Configuring iLO to access the directory service.................................................................................. 18
Local versus directory accounts ........................................................................................................ 18
Additional security considerations .................................................................................................... 19
Two-factor authentication............................................................................................................. 19
Restricting access to the Remote Console port ................................................................................ 20

Protecting SNMP traffic ............................................................................................................... 21
Using iLO with other HP management tools........................................................................................... 21
Integration with HP Systems Insight Manager..................................................................................... 21
Configuring iLO for access with Systems Insight Manager Single Sign-on.............................................. 23
How it works ............................................................................................................................. 23
Integrating iLO usage with Onboard Administrator ............................................................................ 23
Unattended server deployment......................................................................................................... 25
Deploying servers using Rapid Deployment Pack ............................................................................... 25
Taking advantage of advanced Remote Consoling ................................................................................ 26
Configuring and using Shared Remote Console ................................................................................. 26
Configuring and managing Console Replay...................................................................................... 28
Creating a central repository for use with iLO’s virtual media feature ....................................................... 29
Scripted Virtual Media.................................................................................................................... 29
XML scripting ............................................................................................................................. 29
XML examples............................................................................................................................ 30
CLP scripting.............................................................................................................................. 30
Scripting web server requirements ................................................................................................ 31
Managing multiple iLO devices ........................................................................................................... 31
HP Systems Insight Manager ........................................................................................................... 32
CPQLOCFG.EXE, HPONCFG.EXE, and script files ............................................................................. 32
Appendix A ...................................................................................................................................... 33
Using barcode scanning to ease mass-configuration of iLO devices...................................................... 33
Command-line switches................................................................................................................... 34
Deploying iLO devices.................................................................................................................... 34
Updating iLO devices ..................................................................................................................... 35
Appendix B....................................................................................................................................... 36
Using a RAM drive to ease mass-deployment of iLO-based servers....................................................... 36
Overview ...................................................................................................................................... 36
The master boot diskette.................................................................................................................. 36
The custom deployment tool ............................................................................................................ 37
For more information.......................................................................................................................... 39
Call to action .................................................................................................................................... 39

Abstract
This document identifies specific planning and configuration practices for using the HP Integrated
Lights-Out (iLO) and the HP Integrated Lights-Out 2 (iLO 2) management processors to reduce
complexity and simplify management of the datacenter and remote sites. Although, management
processors may not be applicable in all computing environments, HP recommends implementing these
guidelines as appropriate to the specific IT infrastructure.
Introduction
Server remote management is a necessity for IT organizations of all sizes. One of the HP Integrated
Lights-Out (iLO) products is right for any organization where it’s important to minimize downtime,
have the ability to remotely manage servers regardless of condition, and perform complex operations
such as initial server deployments. HP Integrated Lights-Out is HP’s building block management tool.
It improves server experience in initial deployment, reconfiguration, and operation. By setting up
each server to be monitored with iLO HP, administrators can benefit from the long record of
undisputed leadership in lights-out remote management with iLO.
The iLO device is an autonomous management processor that resides on the system board of a host
server. This device contains its own processor, memory, and network interface that allow it to operate
independently from the host server. Using iLO, IT administrators can manage a ProLiant server
remotely through its entire life cycle: initial deployment, operation, and redeployment.
Unlike other management solutions, iLO devices are entirely independent of the state of the operating
system (OS) or server hardware. These devices provide seamless control of remote servers in full
graphics mode (when using the iLO Advanced feature set). The Virtual Media feature of iLO allows IT
administrators to perform remote ROM upgrades and server deployments. All these capabilities
combine to provide administrators with the ability to respond quickly to downtime events, diagnose
OS or server problems remotely, increase uptime, and reduce the loss of business revenue.
This paper discusses system planning, configuration, and deployment of iLO management processors.
It is assumed that the reader is familiar with the general features of iLO. Reference material is
available in the “For more information” section at the end of this document. More information about
iLO technology is also available from the HP website at www.hp.com/servers/ilo.
This document supports both iLO devices; however, certain functions described herein may only be
supported on one and not the other. A designation of “iLO only” or “iLO 2 only” indicates that the
function is exclusive to that device. iLO firmware is backward-compatible. For example, the latest
versions of iLO 2 firmware support any iLO 2 processor. For consistency and best feature support,
use the latest version of iLO 2. If no designation is present then the function is supported on both
devices.
IT environment assessment
Before deploying and configuring an iLO device, it is helpful to assess the IT environment. Table 1
outlines areas to consider when planning the use of Lights-Out technology and the resulting benefits in
the data center.
3

Table 1. Assessing the IT environment
Target Criteria Potential improvement
Asset management Where are servers located (in datacenters
or at remote sites)?
Where would it be helpful to use iLO?
How many servers exist in the computing
environment?
Deploying iLO can eliminate the need
for keyboards, video monitors, and
mice, which reduces cabling complexity
and increases server density in the
datacenter.
Systems
management
How are remote sites and data center
servers currently managed?
Can the servers be managed remotely
through lights-out technology?
The iLO device provides seamless
access to the server, which eliminates
the need for an administrator to be
present in front of the server.
Software or
operating system
How many different operating systems are
running on the servers? What is the plan
to take them all to the latest release?
Ensuring that the latest drivers are
downloaded as needed
Security Is the network as secure as possible?
Does the datacenter use virtual private
networks or include firewalls?
Can all servers use directory services and
authentication?
Can the datacenter benefit from two-factor
authentication?
The iLO device provides multiple levels
of security, including directory
authentication, Secure Sockets Layer
(SSL) encryption, event generation for
failed login attempts, lockout of
configuration utilities, enforced delay
after unsuccessful login attempts, two-
factor authentication, and configurable
internet protocol (IP) port assignments.
When planning future server purchases, a customer can determine whether a server includes iLO by
referring to this Web page:
http://h18013.www1.hp.com/products/servers/management/remotemgmt/supported-servers.html.
Customers that have a large installed based of iLO devices and frequently add more may want to
purchase a Master License Agreement (MLA) from HP. An MLA allows the customer to purchase a
single activation key for multiple licenses of the ProLiant Essentials Value Packs, such as the iLO
Advanced Pack. After the MLA is in place with HP, the customer purchases the desired number of
license-only part numbers whenever additional licenses for iLO Advanced are needed. This simplifies
the software licensing process and reduces the amount of physical documentation that is shipped to
the customer. Additional information is available from the HP website:
http://h18004.www1.hp.com/products/servers/proliantessentials/license/licensebuy.html.
Planning considerations for network configuration
Before deploying iLO devices, an administrator should consider the setup and design of the network
on which the iLO devices will reside.
Private management network
The iLO devices allow browser access to the host ProLiant servers through a seamless, hardware-
based, OS-independent remote console. For security reasons, HP recommends that customers
establish a private management network that is separate from their data network and that only
administrators are granted access to that management network. The iLO private management network
uses a shared network port. The autosensing iLO network interface card (NIC) operates at 10/100
megabits per second (Mbps) and links at the same speed as the host.
4

Network port configurations available to iLO
Possible configurations between the system network interface card NIC and the iLO based NIC
provide the user with choices to best suit individual system requirements (Figure 1). Choosing between
these options depends on knowing the benefits and cautions connected with each.
Figure 1. Three methods of iLO connectivity
Server
iLO
Mgmt
Port
Standard
Gigabit
Port
Common Network
Access
Server
iLO
Mgmt
Port
Standard
Gigabit
Port
Corporate Network
Management Network
Dedicated Network
Access
Server
iLO
Mgmt
Port
Shared
Port Access
Corporate/Management
Network
Standard
Gigabit
Port
Corporate/Management
Network
iLO common network
The iLO management port can be connected to the same network used by the server’s main
10/100/1000 NIC to allow iLO control from anywhere on the network. Using a common network
simplifies installation, since all cables attach to the same network; however, iLO management
performance may be hindered by corporate network traffic.
iLO Shared Network Port
The iLO Shared Network Port feature on ProLiant servers allows system administrators to access iLO
using a network connection shared with the host operating system. SNP enables this shared
connection with a single cable. The ProLiant server Shared Network Port feature implements a
sideband connection between the main NIC and the iLO. This sideband connection maintains a
second (and separate) MAC address. This separate MAC address is assigned to iLO and allows iLO
to obtain a separate IP address. Thus, iLO and the server’s NIC each have their own separate MAC
and IP addresses.
With iLO 2 only, shared network port provides a high-speed, full-featured connection to iLO. First
generation, iLO only servers with shared network port are limited-to a low-speed (text only) connection
to iLO when using the shared port.
When teaming host NICs, the iLO Shared Network Port can still be used, however iLO does not
benefit from teaming fault tolerance, nor does Shared Network Port prevent teaming, since iLO and
the host have separate MAC and IP addresses.
This feature reduces the number of network connections required to manage the server. The Shared
Network Port operates as miniature network switch, routing iLO information to the iLO network
interface and server operating system information to the operating system network interface. Using
this routing, where both ports are connected to the corporate network, allows fewer network
connections to the system. This approach enables access to iLO from anywhere on the network. One
5

issue to consider when implementing the iLO common network approach is that there will be an
increase in traffic on the corporate network.
A corporate network configuration reduces the amount of networking hardware and infrastructure
required to support iLO because iLO uses existing DNS and DHCP servers and routers. Additionally,
with iLO 2 only, the shared network port performance is comparable to the iLO Dedicated Network
Port.
Note:
The iLO Shared Network Port function is available only on a limited number
of ProLiant servers. This function is supported by both the NIC and iLO
firmware.
Optional use of VLAN tags allows segregation of management traffic.
iLO on dedicated management network
Use of the iLO port on a separate management network improves performance, security, and provides
redundant access to the server when a hardware failure occurs on the corporate network. In this
configuration, iLO cannot be accessed directly from the corporate network.
A separate management network increases the security through the ability to physically control which
workstations are connected to the network.
6

Considerations when configuring the iLO network
Administrators can use a hierarchical decision tree (Figure 2) to analyze the benefits of choosing
particular network configurations.
Figure 2. Planning iLO network implementation
Is there a
dedicated
management
network?
Yes
Should iLO be
accessible
from the
network?
Port
constrained?
Port
constrained?
How to implement iLO
network
Yes No
Deploy iLO on
dedicated network
Use iLO Shared
Network Port
capability (if
available) and
connect to the
production network
Connect iLO to the
Production network
No
Yes
Use iLO Shared Network
Port capability- Assign
VLAN ID to the
management network
and connect to a switch
configured to support
VLAN
Yes
No
No
Connect the dedicated
iLO network to a new
management network
HP recommends using the Dedicated Management Network and the dedicated iLO network port for
highest performance and security. If port constrained, administrators can use the iLO shared network
port with VLAN on supported ProLiant servers.
Network cabling in dense rack environments
When deploying multiple iLO-enabled servers in very dense rack environments, it is beneficial to
consolidate all of the iLO network connections to a rack-mounted hub or access switch (Figure 3). The
administrator may then uplink all Lights-Out Management network traffic via a single output from the
hub/switch into a distribution switch in the enterprise network infrastructure.
Using an access switch for Lights-Out management traffic on the network provides the following
benefits:
•Simplifies cable management inside the rack
•Makes more efficient use of available bandwidth
•Reduces the number of network cables run to the rack for management traffic
•Reduces usage of more expensive enterprise network infrastructure ports
7

Figure 3. Consolidating multiple iLO devices into a single rack-mounted access switch
Out-of-band management using iLO’s virtual serial port
The Virtual Serial Port (iLO) and Remote Serial Console (iLO 2) functions allow access to the physical
serial port of the server virtually through the iLO network connection. These two functions are
technically equivalent; only the names changed between iLO and iLO 2. The Remote Serial Console
option relies on the Virtual Serial Port. The Virtual Serial Port must be correctly enabled and
configured in the host RBSU. There are three methods of accessing the Remote Serial Console or
Virtual Serial Port:
•Using a Windows or Linux browser, a Java applet is launched which provides VT320 console
capability to the serial port connection.
•Using a telnet client, a command can be issued to connect to the serial port.
•Using a SSH client in a manner similar to that from the telnet client.
The Remote Serial Console or Virtual Serial Port function enables access to the Microsoft EMS
(Emergency Management Services) SAC (Special Administration Console), and the Linux serial
console, as well as to the ProLiant System ROM BIOS Serial Console Redirection.
For more information on Remote Serial Console (iLO 2) and Virtual Serial Port (iLO) functions see the
iLO users guide and Integrated Lights-Out Virtual Serial Port papers referenced in “For more information”
at the end of this paper.
8

iLO configuration
Each iLO device can be configured individually in multiple ways: through the ROM-Based Setup Utility
(RBSU), through the web browser interface, through the Command Line Protocol (CLP), or through a
scripted setup over the network or from the host. This allows the administrator to configure iLO using
the appropriate means for their environment, and enables 1:1 configuration (such as using a browser)
or 1:many configuration (such as using a scripted setup).
Single iLO device
RBSU is the recommended method to set up a single iLO device initially. RBSU allows configuration of
the iLO network address as well as a local user account. After initial setup using iLO RBSU, the iLO
device is available on the network; and subsequent configuration and management can be
accomplished by other means. RBSU is available every time the server is booted and can be run
remotely using the iLO Remote Console. RBSU is not intended for continued administration. Other
tools such as the web browser or scripting tools are better suited for that.
See the iLO User Guide for more information about ea the configuration methods discussed here.
Links to the iLO User Guides may be found on the ‘For more information’ page at the end of this
document.
Multiple iLO devices
Administrators faced with the deployment of multiple iLO compliant servers should employ efficient
configuration and management methods.
Automated setup
Deploying a large number of iLO-enabled servers is best accomplished by using several OS specific,
automated setup enablers. These enablers include the Lights-Out Configuration Utility
(CPQLOCFG.EXE), the Online Configuration Utility (HPONCFG.EXE), and a Perl interpreter that
communicates with iLO. These utilities support the use of script files allowing administrators to
configure and manage user accounts on multiple iLO devices simultaneously. HP has developed and
made available sample XML and Perl scripts files that can be adjusted for the targeted environment.
Additionally, HP recommends using a bar code scanner (see Appendix A) to further facilitate
automation.
Administrators can expand or change the sample XML scripts to perform other functions such as to
power up or down servers or determine who has access rights to iLO. The iLO User Guide includes
the supported XML commands for additional script development.
Appendix A discusses, in detail, how to use these utilities, their respective sample script files and the
bar code reader in order to automate the deployment and configuration of multiple iLO devices.
The CPQLOCFG.EXE, HPONCFG.EXE, and the sample scripts files are available from the HP website
at the links found in Table 2. The CPQLOCFG.EXE version 2.5 or greater must be used for iLO
devices.
Table 2. Links to Online Configuration utilities and XML scripting samples
Software Links
CPQLOCFG.EXE http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang
=en&cc=US&swItem=MTX-
5ee197c5bd7641359f45d876b1&prodTypeId=15351&prodSeriesId=397989
HPONCFG.EXE
for Windows
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lan
g=en&cc=us&prodTypeId=18964&prodSeriesId=1146658&prodNameId=1135772
&swEnvOID=1005&swLang=8&mode=2&taskId=135&swItem=MTX-
ea306043175c40bcb35952a862
9

Software Links
HPONCFG.EXE
for Linux
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang
=en&cc=us&prodTypeId=18964&prodSeriesId=1146658&prodNameId=1135772&s
wEnvOID=2025&swLang=8&mode=2&taskId=135&swItem=MTX-
0e9ae397b9224e3dae2fb457d5
XML scripting
sample for
Windows
http://h20000.www2.hp.com/bizsupport/TechSupport/SoftwareDescription.jsp?lang
=en&cc=us&prodTypeId=18964&prodSeriesId=1146658&prodNameId=1135772&s
wEnvOID=1005&swLang=8&mode=2&taskId=135&swItem=MTX-
84d9a19b43b84516ac2d26d01f
Initial deployment
HP recommends using a bar code scanner to further facilitate automation. Appendix A discusses, in
detail, how to use these utilities, their respective sample script files and the bar code reader in order
to automate the deployment and configuration of multiple iLO devices.
HP recommends that administrators use these sample files and a bar code reader to scan all the
passwords and Domain Name System or Service (DNS) names from the network settings tag into a
spreadsheet or database. (An administrator can manually enter the passwords and DNS names into a
spreadsheet; however, manual entry is much more time-consuming and error-prone than scanning.)
Then, using the appropriate XML script, the administrator can configure the group of iLO devices, add
the license keys for the iLO Advanced functionality, upgrade firmware on the iLO devices, add a new
user, or change user privileges.
After initially configuring iLO, it is possible to continue deploying the server, including the operating
system installation. Various methods are available to perform OS installation and configuration,
including iLO virtual media, Rapid Deployment Pack, or custom installation tools. Appendix B outlines
a sample custom installation tool that allows installation of the operating system during a mass
deployment operation.
Naming conventions
When deploying many iLO devices, it is helpful to name them according to a consistent convention,
for example: ServerName_iLO. This convention clearly identifies which server is hosting the iLO
device and makes it easier to set up proxy settings for wildcard usage.
iLO network settings
The Network Settings and DCHP/DNS tabs of the Network section allow administrators to view and
modify network settings for iLO 2. The Network Settings tab of the Network section displays NIC IP
address, subnet mask, and other TCP/IP related settings. All users can view the Network Settings, but
only users with the Configure iLO 2 Settings privilege can change these settings.
Proxy servers
Each iLO device can be accessed by its short name (for example, remote21), fully qualified name (for
example, remote21.domain.com), or Internet protocol (IP) address. The browser needs to be
configured to bypass the proxy server for each method used to access the iLO device.
Configuring IP port assignments
Administrators can manually configure the HTTP, Remote Console, and Virtual Media ports used by
the iLO device. Normally, a web browser automatically attempts to connect with port 80 when given
an IP address. Using the port configuration capability, the administrator can redirect the HTTP,
Remote Console, and Virtual Media ports to administrator-defined ports (Table 3). This redirection
prevents others from accessing the HTTP, Remote Console, and Virtual Media ports without specific
knowledge of the port numbers. Once the HTTP port is re-directed, a user must specify that port along
with the IP address to access the login screen. This may be particularly useful for customers who wish
10