iLO and Java version

[Jesper Saks]

Hi,

As a last resort I am hoping that someone in this forum will have an answer for my question. I cannot access the "remote console" function on any of my iLOs with the latest firmware installed (v 1.64), all I get is either a blank screen OR a red "X" in the top left side corner. I have tried different versions of the Java runtime, the last one being 1.4.2_07 and none of the 1.4.x work! Unfortunately I cannot use 1.3.x as our financial system needs a 1.4 version... Does anyone have a solution to this problem or knows when HP might begin supporting version 1.4.x??? I would be really interested to know...

Thanks.
Jesper

[Ken Henault]

I took a look at my system, and I noticed I have both 1.3.1_02 and 1.4.1_04 installed when I check in add/remove programs. When I bring up the ILO remote console, and check the Java Console, I see that it is running under the 1.4.1_04 JVM.

Let us know if this helps.

[Derek_31]

Just be aware that old versions of Java have highly critical security flaws that can allow remote code exploits. I would strongly recommend you upgrade to a patched version. We are using 1.4.2_06 w/o problems with iLO and SIM.

[Jesper Saks]

Hi,

Thank you for your responses, I really appreciate it. I did resolve the issue... It turns out the problem turned out to be a DNS entry for the iLOs, once that was corrected it worked fine with the 1.4.2_07 version...

Thanks.
Jesper

[Raymon_1]

Which DNS issues do you mean ?

Ik have placed al ilo boards in a subdomain

boardname.ilo.domain.nl it also reverse lookups as the right boardname

and in the ilo config i placed boardname and ilo.domain.nl as domain name

[AJ Paisley]

I am having the exact same issue with just one machine. The others can connect with out issue. Can you please explain more clearly as to what DNS settings you are refering to?

[AJ Paisley]

I resolved my issue and here is how it did it.

I also had SIM 4.2 on this box so I had to remove the 1.4.XX version SIM installs and then I installed Java 5.0 Now both SIM and ILO are working fine. There must me some compatibility issues with the Java the SIM 4.2 installs and the the one that Ilo handles.

[Cory Hug]

I'm having this same problem. The remote console doesn't work on ANY of our new servers we just deployed with RILOE II boards. Java 1.3.1 works, but none of the 1.4.x or 1.5 versions work. As with the original poster, we also require at least Java 1.4.x for some other applications. Looking at the Java Console log screen, it gets a Bad Magic Number error when trying to launch the remote console screen in Java versions 1.4.x or 1.5. There were a couple mentions of DNS issues? Can whoever that was give more detail? We do have both forward and reverse lookups for the RILOEII boards. We also configure the host name and the domain in the IP config on the card. Is there anything else we need to set?

Thank you!

[Cory Hug]

Okay, I have a bit of an update on my issue. I was thinking more about the DNS issue. As I mentioned in my previous post we do have both forward and reverse DNS entries for the RILOEII board. BUT, when typing in the url into the IE window, we usually just type the main board name and NOT the including the domain name. That's because we're on an intranet and our workstation PC assumes the domain name. So, for example, I would just type in http://riloeiiboardname in the address line. Also as mentioned in my original message, using this method the remote console screen works fine with Java version 1.3.1, but not with any of the 1.4.x or 1.5 versions. But I got to thinking and tried typing in the full url in IE including the domain name, for example, http://riloeiiboardname.mycompany.com

I still get to the board itself as expected, but it won't accept any login ID and password. I have 2 different ID's created on the board and neither of them work. But if I use just the http://riloeiiboardname url (without the domain name) then I can sign in with both ID's just fine.

I'm wondering if whatever's interfering with the sign-on may also be causing issues with the remote console, if it is a DNS issue. But would possibly cause the login issue?

[acartes]

As far as JVMs go, iLO officially is supported using 1.3.1_02 and 1.4.2, so mileage may vary with others.

As far as the RILOE II login problems go when using the full DNS name, they are strange! If you use the IP address, do you have any problems? Do you get the https:// login prompt, or do you have problems before then? Also, what RILOE II firmware are you using?

You probably should open a support case to look at the login issue.

[Cory Hug]

JVM 1.4.2 doesn't work for us either.

Getting to the board with the IP address works fine, as far as logging in goes, but the remote console screen still doesn't work.

When using the full DNS name, I do get the login prompt. It just won't take any ID and password I put in. It acts like it's an invalid ID and password, even though the exact same ID and pw log in successfully if I use only the board name (without the DNS domain) or the IP address directly.

The RILOEII firmware I have is the latest 1.15.

[Cory Hug]

We've solved it. It turned out not to be an HP issue at all, but I wanted to post it here in case somebody else runs into this and is as puzzled as we were.

This turned out be a pretty complicated issue because it involves an interaction between 2 separate things. Either one by itself wouldn't have caused this issue, it's the combination of the two that created it.

My company uses an auto-config .pac file for proxy configuring in Internet Explorer. The idea being that it detects the host you're connecting to and if it's an internal host (on our own Intranet) then it shouldn't route traffic through the proxy servers. If the host is outside our network, then traffic is routed through the proxy servers.

The first part of this stemmed from the fact that we discovered that the .pac file didn't have all of our subnets included in it so it was routing traffic for some of our internal subnets through our proxy servers when it didn't need to be. It just so happens that all of the servers that my team manages are on those missed subnets. In talking with other people in our company I found some servers on other subnets where the RILOE remote console screen worked fine because those subnets were proprely included in the .pac file.

The 2nd part has to do with our proxy server. Our proxy server has a security "feature" that blocks signed Java applets that DON'T come from a trusted root issuer. Of course, these RILOE boards by default have self-created certificates that don't go back to a trusted issuer (like Thwate or Verisign, etc.).

So again, it's a combination of these 2 together that caused the problem.
If the auto-config .pac file didn't incorrectly route traffic through the proxy servers it wouldn't be a problem. Or, if the proxy server didn't have this security feature turned on then it wouldn't be a problem even if the traffic was being routed through the proxy.

The solution in our case was that they fixed the .pac file to make sure our WAN subnets were included and traffic to them was not routed through the proxy server.

It could also have been fixed by shutting off the "feature" on the proxy server that blocked the applet, but our security folks don't want to do that because it blocks potentially malicious applets from external web sites.

I also know that the RILOE boards can import a 3rd party certificate and that might also solve this since it could have a certificate with a trusted root that the proxy server would allow. But it would be a big hassle for as many servers as we have, not only to set up initially but also to maintain every time we replace, add, or remove a server (my team manages about 60 servers, and the company as a whole has a couple hundred).

Oh, we also found out why JRE 1.3.1 doesn't have this issue. JRE 1.3.1 can't handle auto-config proxy settings so it just ignores them and doesn't send any traffic through the proxy. Of course this means we can't run any Java applets from external web sites with the JRE 1.3.1 version.

[Arron_3]

I'm also having this problem on both iLO and RIB2 boards. I'm running JRE 5.0 and when I launch the remote desktop window, a java warning box pop's up, but off the screen. I've disabled aplet caching, and every security option I can within the java console, but I'm still not able to get it to work correctly.

We're using self signed certificates and I've added our entire certificate tree within the JRE console. I didn't have any problems with version Sun Java 1.3 or with MS Java.

[Doug Wolff]

I am having a similar problem to Arron but only with RILOE. I'll be checking the HP site for the latest drivers and then trying to go back to JRE 1.5.0_04.