Vertiv Avocent ACS6000 Installation and maintenance instructions

Avocent® ACS6000 Advanced
Console Server
Installer/User Guide

Technical Support Site
If you encounter any installation or operational issues with your product, check the pertinent section of
this manual to see if the issue can be resolved by following outlined procedures. Visit
https://www.VertivCo.com/en-us/support/ for additional assistance.

TABLE OF CONTENTS
1 Introduction 1
1.1 Features and Benefits 1
1.1.1 Access options 1
1.1.2 Web manager 1
1.1.3 IPv4 and IPv6 support 2
1.1.4 Flexible users and groups 2
1.1.5 Security 2
1.1.6 Authentication 2
1.1.7 VPN based on IPSec 3
1.1.8 Packet filtering 3
1.1.9 SNMP 3
1.1.10 Data logging, notifications, alarms and data buffering 3
1.1.11 Power management 3
1.1.12 Auto discovery 3
1.1.13 FIPS module 3
2 Installation 5
2.1 Getting Started 5
2.1.1 Supplied with the console server 5
2.1.2 Additional items needed 5
2.2 Rack Mounting 5
2.3 Connecting the Hardware 6
2.3.1 Connecting device consoles or modems to serial ports 8
2.4 Turning On the Console Server 9
2.4.1 AC power 10
2.4.2 DC power 10
2.5 Configuring a Console Server 11
2.5.1 Using Telnet or SSH 11
3 Accessing the Console Server via the Web Manager 13
3.1 Web Manager Overview for Administrators 13
3.2 Wizard Mode 14
3.3 Expert Mode 16
3.4 Access 16
3.5 System Tools 17
3.5.1 Upgrading firmware 17
3.5.2 Upgrading the bootcode 18
3.5.3 Configuration files 19
3.5.4 Configuration Integrity 19
3.6 System 20
3.6.1 Security 20
3.6.2 HTTPS Certificate 22
Vertiv | Avocent® ACS6000 Advanced Console Server Installer/User Guide i

3.6.3 Bootp Configuration Retrieval 23
3.6.4 Date and Time 24
3.6.5 Help and Language 25
3.6.6 General 25
3.6.7 Boot Configuration 25
3.6.8 Information 26
3.6.9 Usage 26
3.7 Network 26
3.7.1 Settings 26
3.7.2 Link Layer Discovery Protocol 27
3.7.3 Network Failover 28
3.7.4 Devices 29
3.7.5 IPv4 and IPv6 static routes 30
3.7.6 Hosts 30
3.7.7 Firewall 30
3.7.8 IPSec (VPN) 32
3.8 SNMP Configuration 39
3.9 Ports 40
3.9.1 Serial ports 40
3.9.2 Multi-Session Menu 46
3.9.3 Auxiliary ports 46
3.9.4 CAS Profile 47
3.9.5 Dial-in Profile 51
3.9.6 Dial-out Profile 52
3.10 Pluggable Devices 53
3.10.1 Device configuration 54
3.11 Authentication 54
3.11.1 Appliance authentication 55
3.11.2 Authentication servers 55
3.12 Users Accounts and User Groups 56
3.12.1 Local accounts 57
3.12.2 User Groups 58
3.12.3 DSView software access rights 63
3.13 Event Notifications 63
3.13.1 Event List 64
3.13.2 Event Destinations 64
3.13.3 Trap Forward 65
3.13.4 Data Buffering 65
3.13.5 Appliance logging 65
3.13.6 Sensors 65
3.14 Power Management 66
3.14.1 PDUs 67
Vertiv | Avocent® ACS6000 Advanced Console Server Installer/User Guide ii

3.14.2 Login 68
3.14.3 Outlet Groups 68
3.14.4 Network PDUs 68
3.15 Active Sessions 69
3.16 Monitoring 69
3.17 Change Password 70
3.18 Web Manager Overview for Regular Users 70
4 Appendices 71
Appendix A: Technical Specifications 71
Appendix B: Zero-touch provisioning 72
Appendix C: Recovering a Console Server's Password 77
Appendix D: Port Information for Communication with the DSView Software 78
Appendix E: Accessing a Console Server with a DSView Software Installation via Dial-up 79
4.0.1 Installing DSView software with an OOB back door 79
4.0.2 Configuring dial-up for a console server 79
Appendix F: Internal Modem 81
4.0.3 AT+MS modulation selection 83
4.0.4 Set telephone extension option 85
4.0.5 AT S registers 85
4.0.6 Basic modem result codes 85
4.0.7 Digital line guard 86
4.0.8 Sleep mode operation 86
4.0.9 Disconnecting a call 86
4.0.10 Selecting country codes 87
4.0.11 Using caller ID 87
Vertiv | Avocent® ACS6000 Advanced Console Server Installer/User Guide iii

Vertiv | Avocent® ACS6000 Advanced Console Server Installer/User Guide iv

1 INTRODUCTION
The Avocent® ACS6000 advanced console server is a 1U appliance that serves as a single point for access
and administration of connected devices, such as target device consoles, modems and power devices.
Console servers support secure remote data center management and out-of-band management of IT
assets from any location worldwide.
NOTE: Unless noted, references to a console server refer to all models in the 60XX series.
Console servers provide secure local (console port) and remote (IP and dial-up) access. The console
servers run the Linux®operating system with a persistent file system in Flash memory, and can be
upgraded from either FTP or a DSView™4 management software server.
NOTE: Unless otherwise noted, all references to DSView software in this document refer to version 4 or
greater.
Multiple administrators can be logged into the console server at the same time and can use the web
manager, the Command Line Interface (CLI utility) or DSView software to access and configure the
console server.
One USB port supports modem (V.92), storage devices and USB hubs. Two fast Ethernet ports support
connections to more than one network or configuration of Ethernet bonding (failover) for redundancy
and greater reliability. For dial-in and secure dial-back with Point-to-Point Protocol (PPP), optional internal
modems can be factory installed, or you can use external modems.
1.1 Features and Benefits
1.1.1 Access options
Secure access is available through the following local (analog console port) and remote (digital IP and
dial-up) options:
•LAN/WAN IP network connection.
•Dial-up to a factory-configured internal modem (optional), a modem connected either to a
serial port or the AUX port (which is only possible when an internal modem is not installed) or in
the USB port.
•Target device connection. An authorized user can make a Telnet, SSH v1, SSH v2 or Raw
connection to a target device. For Telnet or SSH to be used for target device connections, the
Telnet or SSH service must be configured in the Security Profile that is in effect.
•Console server console connection. An administrator can log in either from a local terminal or
from a computer with a terminal emulation program that is connected to the console port and
can use the CLI utility. The CLI utility prompt (--|- cli>) displays at login.
More than one administrator can log into the console server and have an active CLI or web manager
session. All sessions receive the following warning message when the configuration is changed by another
administrator or by the system: The appliance configuration has been altered from outside of your
session. Upon receipt of this message, each administrator needs to verify that changes made during the
session were saved.
1.1.2 Web manager
Users and administrators can perform most tasks through the web manager (accessed with HTTP or
HTTPS). The web manager runs in Microsoft®Internet Explorer®, Mozilla®Firefox®, and Google® Chrome®
Vertiv | Avocent® ACS6000 Advanced Console Server Installer/User Guide 1

on any supported computer that has network access to the console server. The list of supported client
browsers and their versions are available in the release notes.
1.1.3 IPv4 and IPv6 support
The console server supports dual stack IPv4 and IPv6 protocols. The administrator can use the web
manager or CLI to configure support for IPv4 addresses only or for both IPv4 and IPv6 addresses. The
following list describes the IPv6 support provided in the console server:
•DHCP
•Dial-in and dial-out sessions (PPP links)
•DSView software integration
•eth0 and eth1 Ethernet interfaces
•Firewall (IP tables)
•HTTP/HTTPs
•Linux kernel
•Remote authentication: Radius, Tacacs+ and LDAP servers
•SNMP
•SSH and Telnet access
•Syslog server
NOTE: Remote authentication NFS and IPSec are not supported with IPv6.
1.1.4 Flexible users and groups
An account can be defined for each user on the console server or on an authentication server. The admin
and root users have accounts by default, and either can add and configure other user accounts. Access
to ports can be optionally restricted based on authorizations an administrator can assign to custom user
groups. For more information, see Users Accounts and User Groups on page 56.
1.1.5 Security
Security profiles determine which network services are enabled on the console server. Administrators can
either allow all users to access enabled ports or allow the configuration of group authorizations to restrict
access. You can also select a security profile, which defines which services (FTP, ICMP, IPSec, SNMPand
Telnet) are enabled and SSH and HTTP/HTTPS access. The administrator can select either a
preconfigured security profile or create a custom profile. For more information, see Security on page 20.
1.1.6 Authentication
Authentication can be performed locally, with One Time Passwords (OTP), a remote LDAP, RADIUS,
TACACS+ authentication server or a DSView server. The console server also supports remote group
authorizations for the LDAP, RADIUS and TACACS+ authentication methods. Fallback mechanisms are
also available.
Any authentication method configured for the console server or the ports is used for authentication of
any user who attempts to log in through Telnet, SSH or the web manager. For more information, see
Authentication on page 54.
Vertiv | Avocent® ACS6000 Advanced Console Server Installer/User Guide 2

1.1.7 VPN based on IPSec
If IPSec is enabled in the selected security profile, an administrator can use the VPN feature to enable
secure connections. IPSec encryption creates a secure tunnel for dedicated communications between the
console server and other computers that have IPSec installed. ESP and AH authentication protocols, RSA
Public Keys and Shared Secret aresupported. For more information, see IPSec (VPN) on page 32.
1.1.8 Packet filtering
An administrator can configure a console server to filter packets like a firewall. Packet filtering is
controlled by chains, which are named profiles with user-defined rules. The console server filter table
contains a number of built-in chains that can be modified but not deleted. An administrator can also
create and configure new chains.
1.1.9 SNMP
If SNMP is enabled in the selected security profile, an administrator can configure the Simple Network
Management Protocol (SNMP) agent on the console server to answer requests sent by an SNMP
management application.
The console server SNMP agent supports SNMP v1/v2 and v3, MIB-II and Enterprise MIB. For more
information, see SNMP Configuration on page 39.
NOTE: The text files with the Enterprise MIB (ACS6000-MIB.asn) and the TRAP MIB (ACS6000-
TRAP-MIB.asn) are available in the appliance under the /usr/local/mibs directory.
1.1.10 Data logging, notifications, alarms and data buffering
An administrator can set up data logging, notifications and alarms to alert administrators of problems with
email, SMS, SNMP trap or DSView software notifications. An administrator can also store buffered data
locally, remotely or with DSView management software. Messages about the console server and
connected servers or devices can also be sent to syslog servers.
1.1.11 Power management
The console server enables users who are authorized for power management to turn power on, turn power
off and reset devices plugged into a connected power distribution unit (PDU). The power devices can be
connected to any serial port or to the AUX/Modem port (if an internal modem is not installed). For more
information, see Power Management on page 66.
1.1.12 Auto discovery
An administrator can enable auto discovery to find the hostname of a target connected to a serial port.
Auto discovery’s default probe and answer strings have a broad range. An administrator can configure
site-specific probe and answer strings. Auto discovery can also be configured through the DSView
software.
1.1.13 FIPS module
The 140 series of Federal Information Processing Standards (FIPS) are U.S. government computer security
standards that specify requirements for cryptography modules.
The console server uses an embedded cryptographic module that is based on the FIPS 140-2 validated
cryptographic module(s) (certificate number 1747) running on a Linux PPC platform. For more
information, see FIPS module on page 21.
Vertiv | Avocent® ACS6000 Advanced Console Server Installer/User Guide 3

Vertiv | Avocent® ACS6000 Advanced Console Server Installer/User Guide 4
This page intentionally left blank.