How to access ILO without giving Gateway in EBIPA settings in OA GUI

[chuckk281]

We had a question from a customer with a special security requirement. He doesn’t want outsiders to have access the iLOs of the servers. Monty had some suggestions: There are a couple of approaches to prevent iLO access from the management network connected to the OA Management Port: 1 – If the management network does not support DHCP and the OA is not configured to provide an EBIPA bay based IP address to the iLO, then the iLO will not have an IP address and won’t be accessible outside the enclosure. As described in my previous email, this will also severely limit the server information provided by the OA, and the OA CLI ‘connect server’ and OA GUI links to iLO GUI and remote consoles will not work. In addition, the OA will indicate on the server status that the iLO Network is not operational. 2 – Use OA EBIPA to configure the iLO IP address to a non-routable private IP address such 192.168.x.y. Remote clients will not be able to access this subnet, but the OA will have the extended server information. The OA GUI links to the iLO GUI and remote consoles will not work since the client will not be able to access those IP addresses. You would need to change the iLO SSH setting to disable in order to disable the OA CLI ‘connect server’ command from working. 3 – Change the iLO settings to disable SSH and clear all the ports for virtual media and remote consoles. This change will also prevent the OA from accessing extended server information. If the customer wants to prevent server power control from an OA user – then the user account must not be an OA administrator (automatic administrator role for all bays), they can be OA operators or OA users with no server bay permissions. Sounds like an extreme security use case, they will lose a lot of information and control on those server blades.