HP Integrated Lights-Out 2 User Guide

Role address restrictionsRole address restrictions are enforced by the LOM firmware, based on the client's IP network address.When the address restrictions are met for a role, the rights granted by the role apply.Address restrictions can be difficult to manage if access is attempted across firewalls or through networkproxies. Either of these mechanisms can change the apparent network address of the client, causing theaddress restrictions to be enforced in an unexpected manner.User restrictionsYou can restrict access using address or time restrictions.User address restrictionsAdministrators can place network address restrictions on a directory user account, and these restrictionsare enforced by the directory server. Refer to the directory service documentation for details on theenforcement of address restrictions on LDAP clients, such as a user logging in to a LOM device.Network address restrictions placed on the user in the directory might not be enforced in the expectedmanner if the directory user logs in through a proxy server. When a user logs in to a LOM device as adirectory user, the LOM device attempts authentication to the directory as that user, which means thataddress restrictions placed on the user account apply when accessing the LOM device. However,because the user is proxied at the LOM device, the network address of the authentication attempt is thatof the LOM device, not that of the client workstation.IP address range restrictionsIP address range restrictions enable the administrator to specify network addresses that are granted ordenied access by the restriction. The address range is typically specified in a low-to-high range format. Anaddress range can be specified to grant or deny access to a single address. Addresses that fall within thelow to high IP address range meet the IP address restriction.IP address and subnet mask restrictionsIP address and subnet mask restrictions enable the administrator to specify a range of addresses that aregranted or denied access by the restriction. This format has similar capabilities as an IP address range butmight be more native to your networking environment. An IP address and subnet mask range is typicallyspecified using a subnet address and address bit mask that identifies addresses that are on the samelogical network.In binary math, if the bits of a client machine address, added with the bits of the subnet mask, match therestriction subnet address, then the client machine meets the restriction.DNS-based restrictionsDNS-based restrictions use the network naming service to examine the logical name of the client machineby looking up machine names assigned to the client IP addresses. DNS restrictions require a functionalname server. If the name service goes down or cannot be reached, DNS restrictions cannot be matchedand will fail.DNS-based restrictions can limit access to a single, specific machine name or to machines sharing acommon domain suffix. For example, the DNS restriction, www.hp.com, matches hosts that are assignedthe domain name www.hp.com. However, the DNS restriction, *.hp.com, matches any machineoriginating from HP.DNS restrictions can cause some ambiguity because a host can be multi-homed. DNS restrictions do notnecessarily match one-to-one with a single system.Directory-enabled remote management 132