HP Integrated Lights-Out 2 User Guide

More documents

Recommendations

Info

When using Microsoft® Active Directory, it is possible to place one group within another or nestedgroups. Role objects are considered groups and can include other groups directly. Add the existingnested group directly to the role, and assign the appropriate rights and restrictions. New users can beadded to either the existing group or the role.Novell eDirectory does not allow nested groups. In eDirectory, any user that can read a role is considereda member of that role. When adding an existing group, organizational unit or organization to a role,add the object as a read trustee of the role. All the members of the object are considered members of therole. New users can be added to either the existing object or the role.When using trustee or directory rights assignments to extend role membership, users must be able to readthe LOM object representing the LOM device. Some environments require the same trustees of a role toalso be read trustees of the LOM object to successfully authenticate users.Using multiple rolesMost deployments do not require the same user to be in multiple roles managing the same device.However, these configurations are useful for building complex rights relationships. When buildingmultiple-role relationships, users receive all the rights assigned by every applicable role. Roles can onlygrant rights, never revoke them. If one role grants a user a right, then the user has the right, even if theuser is in another role that does not grant that right.Typically, a directory administrator creates a base role with the minimum number of rights assigned andthen creates additional roles to add additional rights. These additional rights are added under specificcircumstances or to a specific subset of the base role users.For example, an organization can have two types of users, administrators of the LOM device or hostserver and users of the LOM device. In this situation, it makes sense to create two roles, one for theadministrators and one for the users. Both roles include some of the same devices but grant differentrights. Sometimes, it is useful to assign generic rights to the lesser role and include the LOM administratorsin that role, as well as the administrative role.An admin user gains the login right from the regular user group. More advanced rights are assignedthrough the Admin role, which assigns additional rights—Server Reset and Remote Console.The Admin role assigns all admin rights—Server Reset, Remote Console, and Login.Directory-enabled remote management 130
How directory login restrictions are enforcedTwo sets of restrictions potentially limit a directory user's access to LOM devices. User access restrictionslimit a user's access to authenticate to the directory. Role access restrictions limit an authenticated user'sability to receive LOM privileges based on rights specified in one or more Roles.Restricting rolesRestrictions allow administrators to limit the scope of a role. A role only grants rights to those users thatsatisfy the role's restrictions. Using restricted roles results in users with dynamic rights that can changebased on the time of day or network address of the client.IMPORTANT: When directories are enabled, access to a particular iLO 2 is based on whether the userhas read access to a Role object that contains the corresponding iLO 2 object. This includes but is notlimited to the members listed in the role object. If the Role is set up to allow inheritable permissions topropagate from a parent, then members of the parent which have read access privileges will also haveaccess to iLO 2. To view the access control list, navigate to Users and Computers, open the propertiesscreen for the Role object and select the Security tab.For step-by-step instructions on how to create network and time restrictions on a role, refer to "ActiveDirectory Role Restrictions (on page 119)" or "eDirectory Role Restrictions (on page 126)" sections.Role time restrictionsAdministrators can place time restrictions on LOM roles. Users are granted the rights specified for theLOM devices listed in the role, only if they are members of the role and meet the time restrictions for thatrole.LOM devices use local host time to enforce time restrictions. If the LOM device clock is not set, the roletime restriction fails unless no time restrictions are specified on the role.Role-based time restrictions can only be satisfied if the time is set on the LOM device. The time is normallyset when the host is booted, and it is maintained by running the agents in the host operating system,which allows the LOM device to compensate for leap year and minimize clock drift with respect to thehost. Events, such as unexpected power loss or flashing LOM firmware, can cause the LOM device clockto not be set. Also, the host time must be correct for the LOM device to preserve time across firmwareflashes.Directory-enabled remote management 131
Page 1 and 2:
HP Integrated Lights-Out 2User Guid
Page 3 and 4:
ContentsOperational overview ......
Page 5:
Schema-free HPLOMIG-based setup ...
Page 9 and 10:
iLO 2 overviewiLO 2 Standard provid
Page 11 and 12:
functionality can be provided by va
Page 13 and 14:
A separate network increases the se
Page 15 and 16:
4. Select Network>NIC>TCP/IP, press
Page 17 and 18:
Install iLO 2 device driversThe iLO
Page 19 and 20:
Configuring iLO 2In this sectioniLO
Page 21 and 22:
3. Click Upgrade iLO 2 Firmware.4.
Page 23 and 24:
• Scripted virtual media• Apple
Page 25 and 26:
3. Click Add.4. Complete the fields
Page 27 and 28:
Group administrationThe Group Accou
Page 29 and 30:
Parameter Default value Description
Page 31 and 32:
If the iLO 2 installation is comple
Page 33 and 34:
4. Verify that the iLO Management I
Page 35 and 36:
Password guidelinesEncryptionThe fo
Page 37 and 38:
By default, iLO 2 creates a self-si
Page 39 and 40:
necessary security, the following c
Page 41 and 42:
10. Change Certificate Owner Field
Page 43 and 44:
Owner Field is set to SAN, iLO 2 ob
Page 45 and 46:
The test page displays the results
Page 47 and 48:
To change network settings for iLO
Page 49 and 50:
After iLO 2 resets, the Shared Netw
Page 51 and 52:
5. Navigate to the Virtual LAN ID f
Page 53 and 54:
• Verify NSLOOKUP correctly resol
Page 55 and 56:
On select p-Class blades in enclosu
Page 57 and 58:
Subnet Mask—Assigns the subnet ma
Page 59 and 60:
This configuration causes the iLO 2
Page 61 and 62:
Using iLO 2In this sectioniLO 2 bro
Page 63 and 64:
• Last Used Remote Console displa
Page 65 and 66:
Temperaturesfan failure, some fan o
Page 67 and 68:
DiagnosticsThe iLO 2 processor reco
Page 69 and 70:
The status of these self-tests is i
Page 71 and 72:
Remote Console Information screenRe
Page 73 and 74:
Supported hot keysThe Program Remot
Page 75 and 76:
• Ctrl-Alt-Del—Enters the key s
Page 77 and 78:
Security informationIf Remote Conso
Page 79 and 80: High-Performance Mouse option. You
Page 81 and 82: Graceful shutdown• No—Server wi
Page 83 and 84: Processor StatesSelecting the Proce
Page 85 and 86: You can access virtual media on a h
Page 87 and 88: Virtual Floppy and USB key drives d
Page 89 and 90: 3. Click Connect.To use an image fi
Page 91 and 92: 4. Click Create. The virtual media
Page 93 and 94: Rack ViewThe Rack View page present
Page 95 and 96: Enclosure informationEnclosure info
Page 97 and 98: Power component informationSelectin
Page 99 and 100: Enclosure bay IP addressingDuring t
Page 101 and 102: Field Possible value DescriptionDNS
Page 103 and 104: BL p-Class and BL c-Class featuresT
Page 105 and 106: • Flexibility—You can create a
Page 107 and 108: 10. Select the certificate authorit
Page 109 and 110: NOTE: When connected through the Di
Page 111 and 112: Schema PreviewThe Schema Preview sc
Page 113 and 114: Management snap-in installerThe man
Page 115 and 116: Snap-in installation and initializa
Page 117 and 118: d. Add users to the role. Click the
Page 119 and 120: MembersAfter user objects are creat
Page 121 and 122: Active Directory Lights-Out managem
Page 123 and 124: e. Repeat the process for several m
Page 125 and 126: Role managed devicesThe Role Manage
Page 127 and 128: To remove any of the entries, highl
Page 129: Directory-enabled remote management
Page 133 and 134: Using DNS-based restrictions can cr
Page 135 and 136: • HP SIM can:• Manage multiple
Page 137 and 138: • Windows® Server 2003• Novell
Page 139 and 140: 1. Click Start and select Programs>
Page 141 and 142: This page determines if the HP Exte
Page 143 and 144: • Role DN—The role distinguishe
Page 145 and 146: NOTE: The feature associated with t
Page 147 and 148: HP Systems Insight Manager integrat
Page 149 and 150: Clicking on a status icon for iLO 2
Page 151 and 152: Troubleshooting iLO 2In this sectio
Page 153 and 154: LED indicatorPOST code(activitycomp
Page 155 and 156: Event log displayEvent log explanat
Page 157 and 158: The DHCP server must be configured
Page 159 and 160: • The use of the diagnostic port
Page 161 and 162: AlertFailed Login AttemptGeneral Er
Page 163 and 164: 2. On the Level of Privacy screen,
Page 165 and 166: Terminal Services proxy stops respo
Page 167 and 168: For example, when User1 logs in, th
Page 169 and 170: 1. Attempt to connect to iLO 2 thro
Page 171 and 172: Directory services schemaIn this se
Page 173 and 174: SyntaxOptionsRemarksDistinguished N
Page 175 and 176: Lights-Out Management specific LDAP
Page 177 and 178: DescriptionSyntaxOptionsRemarksLoca
Page 179 and 180: Acronyms and abbreviationsACPIAdvan
Page 181 and 182:
HPONCFGHP Lights-Out Online Configu
Page 183 and 184:
RASremote access serviceRBSUROM-Bas
Page 185 and 186:
IndexAaccess options 23, 28, 33acce
Page 187 and 188:
memory 66Microsoft software 104, 11
Page 189:
virtual media 59, 84, 85, 87, 91, 1
show all

HP Integrated Lights-Out 2 User Guide

Create successful ePaper yourself

Delete template?

Save as template?