HP Sim V5.1 Managing HP Servers through firewalls with SIM

[Melinda Cooper]

I've got a W2K3 SP1 server with HP SIM V5.1 installed. We've got two servers we are attempting to manage through the firewall. These two servers are NOT on our domain but in a workgroup located in the DMZ zone.
I've been working with the network admins and we've got them set up pretty much to be notified for critical situations, however, would someone know where a list of ports are that are being utilized?
We've got port 161/162.
I'm not sure where the configuration file resides.
There is a daily event at 2:07 that we are getting from SIM that these two servers are unreachable, then they come back. So we're not sure what ports to check.
I do have the whitepaper on this (three case studies)

[Aravindh Rajaram]

The document is available at http://h10018.www1.hp.com/wwsolutions/misc/hpsim-helpfiles/ManagingHPServers-withHPSIM.pdf

[Melinda Cooper]

I already have that document. I was wondering if there was a known area where the config files are that show the ports or if I'm not thinking of the correct area?

[Andrew_346]

http://h20000.www2.hp.com/bc/docs/support/SupportManual/c00210041/c00210041.pdf

I manage 3 servers in my DMZ with SIM.

I open TCP: 80, 2381, 2301; UDP 161/162 to the management server only.

The only thing I have a problem with is the daily system identification job (runs @ 4:05PM) which causes my SonicWALL to think one of the servers is port scanning back to the mgmt server... If I could only figure that one out...

[Melinda Cooper]

I just got paged again for the two servers that are in the DMZ as being unreachable/reachable. Our network admins added some additional ports as listed below.

I've spoken with the network admins and what we have for ports opened are:
ICMPT or TCP 80
2301
2381
161/162
280
22

I just spoke with HP and they keep referring me to the same technical brief I already have.

Now we'll wait to see what notifications we get.

[Andrew_346]

Have you tried removing and re-discovering those servers manually in SIM?

SNMP configured correctly?

IPSec running on DMZ servers?

[Melinda Cooper]

Yes, IPSec is running on both and I believe our SNMP is configured correctly.
SNMP is read-write
127.0.0.1 & SIM server

We are getting notifications from SIM on our reboots.

[Andrew_346]

IPSec runs by default on all Windows server platforms, but do you have any IPSec policies configured?

[Melinda Cooper]

No, we just have the default IPSec policy running, nothing else configured.

[Andrew_346]

What time zone are you in? I'm going to guess and say Pacific.

[Melinda Cooper]

Yes, we are in Pacific Daylight Saving time, north of Seattle, WA.

[Andrew_346]

In the SIM console, look under Tasks & Logs --> View All Scheduled Tasks.

What time does your Daily System Identification job run?

[Melinda Cooper]

This particular task runs daily at 2:05 p.m. I ran it manually after the network admins updated the ports and didn't get a page for either server that is in the DMZ zone so I'm hoping they fixed the problem.

[Andrew_346]

Good deal.

This particular job runs at 4:05 for me and my SonicWalls pick up a port scan from the managed system. Still can't figure out why the managed server tries to respond back to the management server on so many ports:

07/08/2007 16:05:25.304 - Alert - Intrusion Prevention - Possible port scan detected - 10.0.11.3, 2069, X2 - 10.0.10.9, 3730, X0 - TCP scanned port list, 3709, 3711, 3712, 3717, 3718

11.3 is the server in the DMZ, 10.9 is the mgmt server.

But neither server ever show any errors in their logs. Just the SonicWALL...

I miss a good Cisco network...

[Melinda Cooper]

After 2:05 p.m. I'll send a message to let you know what happens. We still have a few ports that we're not sure of. I think we are close.

[Melinda Cooper]

Closing thread