topic improve ILO security in Server Management - Remote Server Management

improve ILO security

RicRey — Sun, 21 Jul 2019 18:48:54 GMT

I have an HPE DL180G9 server, and it has ILO 2.70 I wanted to know if there is any one to improve security since my ILO has a direct internet connection, without going through any filter ... maybe there is some way to limit it to a specific ip that I can connect?

Re: improve ILO security

Jimmy Vance — Sun, 21 Jul 2019 20:39:53 GMT

iLO best practices suggest not to place the iLO directly exposed on any external network.

Re: improve ILO security

RicRey — Sun, 21 Jul 2019 22:01:43 GMT

Is there a way to improve security? ...

what happens is that the company where the server is hosted has no budget at this time to implement a managed switch or a firewall as such ... can you give me any suggestions ??? Is there something in the ILO that allows this?

Re: improve ILO security

RicRey — Mon, 22 Jul 2019 01:39:41 GMT

on that server I have a virtual machine, will it be possible to configure one of the virtual machines as a firewall router for the iLO ip?

Re: improve ILO security

PeterWolfe — Mon, 22 Jul 2019 14:53:26 GMT

> on that server I have a virtual machine, will it be possible to configure one of the virtual machines as a firewall router for the iLO ip?

No. The iLO network is out-of-band. Both the dedicated iLO port and the shared-port feature.

> what happens is that the company where the server is hosted has no budget at this time to implement a managed switch or a firewall as such ... can you give me any suggestions

Don't deploy the system in this way (don't put the iLO directly on the Internet until you do have the budget for the firewall, etc). From a security perspective that is the only correct answer.

Re: improve ILO security

RicRey — Mon, 22 Jul 2019 19:58:42 GMT

Maybe they have some firewall model that they recommend me?

Re: improve ILO security

PeterWolfe — Mon, 22 Jul 2019 21:19:46 GMT

Several folks sell very inexpensive edge router/firewall type devices. I'm thinking products like Netgate: https://www.netgate.com/solutions/pfsense/sg-1100.html and Ubiquiti: https://www.ui.com/edgemax/edgerouter-x/. They both seem to offer VPN features and firewall features and are inexpensive. I have no personal experience with either of these devices (i.e. this is not a product recommendation). Other vendors I'm sure have equivalent entry level offerings.