ILO4 Cannot disable IPV6

[HPE-Queries]

I cannot seem to disable the IPV6 self-assigned address on ILO4 based servers.

On an ML350 Gen9 ILO4 dedicated ILO NIC port there is no GUI click option to physically disable IPV6

when using CLI commands:     "oemhpe_ip6 options"    command there is no IPV6_ACTIVE=NO option

using CLI command:    oemhpe_ip6 options set ipv6_active=no

results in:                Request Failed - Invalid Setting

the only CLI command option is:   ipv6_active=yes    so it looks likes the IPV6 is forced to be turned on?

Following an over zealous auditor, IPV6 has been deamed a security risk and I've been requested to disable it

is this actually possible on ILO4?

I've successfully done this on all the ILO5 servers

[sudhirsingh]

@HPE-Queries 

Did you tried GUI option, 
ILO4 console under Network -> iLO Dedicated Network Port-> IPv6 tab-> uncheck all.

Regards,

Sudhir

[HPE-Queries]

Thanks for the reply

Yes, I've been using the GUI and un-ticking all the IPv6 options for years thinking that disabled it and as it turns out, blissfully unaware that the original self-assigned IPv6 address (when the iLO4 is first turned on with default DHCP options) is still assigned to the ILO4 NIC even after all the IPv6 option ticks are unticked and supposedly disabled.

I cannot find any way to actually "disable" the IPv6 on an iLO4 server?, not in the GUI or in the Console?

No matter what I deselect or turn off the IPv6 address is persistently assigned and responding fully to the network.

Disabling IPv6 on iLO5 servers works perfectly.

Just seems to be iLO4 servers, I've patched to the latest firmwares etc but no change in behaviour

IPv6 is on, whether you like it or not.

[sudhirsingh]

@HPE-Queries

ILO configuration option is also available in Intelligent Provisioning as well, and likely enabled by default.

Trying disabling it.

Intelligent Provisioning
-> iLO Configuration Utility
-> Network Settings
-> IPv6
-> [Disable DHCPv6 in Stateless Mode (Other)]

If still same, You can update Intelligent Provisioning to later version and check.

Regards,

Sudhir

[HPE-Queries]

Thanks;  Normally, updating the Intelligent Provisioning firmware requires a full reboot of the servers and they are live production servers so I will schedule this for the next maintenance window and advise following.