How to access iLO from external network?

[wuitsung]

Inside my network I can just type private ip or the dns name to go the iLO page, but how about if I am not in my network? Do I open ports on firewall? what's the port do i need to open? is there any other secure way of doing this?

[Johan Guldmyr]

I suppose you need to do some NAT as well if iLO is on a private IP.

[Torsten.]

This really depends on your hardware (e.g. blade vs. non-blade) and infrastructure.

You normally access iLO via browser (http/https) or serial or telnet/ssh - so you need top "open" the appropriate ports.

Keep in mind, the iLO is just like a "normal" server from this point of view.

[Jimmy Vance]

You can open the required ports in your firewall, but that's not considered a best practice. The secure way would be to have a VPN connection to your internal network.

[wuitsung]

thank you, if i need to open port, what's the port do i need to open?

And VPN seems secure, but if my pc got virus infected it will also infect the server right? as they are in the same network...

[Jimmy Vance]

get into the web interface of iLO and under the networking section it shows all the required ports (or search the forums, this subject has been discussed many times before)

I wouldn't worry about a virus infectin iLO, but if you expose it on the Internet by opening your firewall it can be attacked.

[Michael A. McKenney]

I would only access them from a SSL VPN. Leave them inside the firewall. Come into your network from a SSL VPN, then access them. I placed mine in a 192.168.100.x subnet and gave DNS entries for each server. I would not allow them visibility to the outside world.

[wuitsung]

how did you setup ssl vpn? do you use a hardware firewall? is it cisco or anything else? so do you need a vpn client on your external workstation or the ssl vpn can be done by going to https site?

[fwalder48]

It seems no here is answering your question, but is telling you a lot of things you already know. The https port to enable is 443. I do agree that a VPN is a much safer option, which would have SSL built in. The question with your and my situation is how do you access a non-routable IP address from a different broadcast domain with transmission control (layer 3 and 4 respectively)? Your first responder is possibly correct that some sort of NAT is needed, or some type of RAS. Window Server has both option, but I have not been able to configure either correctly. Even my DNS will not work because it is misconfigured. FYI: I'm running Windows Server 2016 Standard on an HP DL380 Gen9.