Avocent® Universal Management Gateway Appliance Installer/User Guide

122 Pages·2017·4.26 MB·English

Avocent® Universal Management Gateway
Appliance
Installer/UserGuide
Theinformationcontainedinthisdocumentissubjecttochangewithoutnotice
andmaynotbesuitableforallapplications.Whileeveryprecautionhasbeen
takentoensuretheaccuracyandcompletenessofthisdocument,Vertiv
assumesnoresponsibilityanddisclaimsallliabilityfordamagesresultingfrom
useofthisinformationorforanyerrorsoromissions.Refertootherlocal
practicesorbuildingcodesasapplicableforthecorrectmethods,tools,and
materialstobeusedinperformingproceduresnotspecificallydescribedinthis
document.
Theproductscoveredbythisinstructionmanualaremanufacturedand/orsold
byVertiv.ThisdocumentisthepropertyofVertivandcontainsconfidential
andproprietaryinformationownedbyVertiv.Anycopying,useordisclosureof
itwithoutthewrittenpermissionofVertivisstrictlyprohibited.
Namesofcompaniesandproductsaretrademarksorregisteredtrademarksof
therespectivecompanies.Anyquestionsregardingusageoftrademarknames
shouldbedirectedtotheoriginalmanufacturer.
TechnicalSupportSite
Ifyouencounteranyinstallationoroperationalissueswithyourproduct,checkthepertinentsectionofthis
manualtoseeiftheissuecanberesolvedbyfollowingoutlinedprocedures.
Visithttps://www.VertivCo.com/en-us/support/foradditionalassistance.
Vertiv|Avocent®UniversalManagementGatewayApplianceInstaller/UserGuide
TABLE OF CONTENTS
1ProductOverview 1
1.1 FeaturesandBenefits 1
1.1.1 Secureaccess 1
1.1.2 Autosense 1
1.1.3 Webuserinterface(UI) 2
1.1.4 VGAandUSBconnections 2
1.1.5 CLIsetupport 3
1.1.6 IPv4andIPv6support 3
1.1.7 Security 3
1.1.8 Datalogging,notifications,alarmsanddatabuffering 3
1.1.9 Powermanagement 3
1.1.10 Autodiscovery 3
1.1.11 Controlofvirtualmediaandsmartcard-capableappliances 4
1.1.12 Flexibleusersandgroups 4
1.1.13 Avocent®DSView™managementsoftwareplug-in 4
2Installation 5
2.1 SuppliedwiththeAppliance 5
2.2 RackandWallMounting 5
2.2.1 Rackmounting 5
2.2.2 Cablinginstallation,maintenanceandsafetytips 6
2.3 ConnectingtheHardware 7
2.3.1 Applianceconnectors 7
2.3.2 Connectingtargets 8
2.4 TurningOntheAppliance 10
2.5 VerifyingtheConnections 10
2.5.1 FrontandrearpanelpowerstatusLEDs 10
2.5.2 RearpanelEthernetconnectionLEDs 11
2.5.3 Rearpanelautosensing/dedicatedIPportLEDs 11
2.6 ConfiguringtheAppliance 11
2.7 ConfigurationExample 11
2.7.1 UsingTelnetorSSHtoaccessaserialtarget 13
3InitialApplianceSetup 15
3.1 ConnectingtoYourNetwork 15
3.2 AssigninganIP Address 15
3.3 ConnectingLocallyorThroughtheConsolePort 15
3.4 SettingUpYourNetwork 16
3.5 Firewall 16
3.5.1 Portrequirements 17
i
3.6 ExternalNetworkPortUsage 19
4WebUserInterface 23
4.1 WebUIOverview 23
4.2 UsingtheSidebar 24
4.2.1 Adminrole 24
4.2.2 Operatorrole 24
4.2.3 Userrole 25
4.3 Tabs 25
4.3.1 Targets 25
4.3.2 Sensors 25
4.3.3 Events 25
4.3.4 Administration 25
5Administration 27
5.1 ApplianceSettings 27
5.1.1 SSH 28
5.1.2 HelpFile 28
5.1.3 EmailSettings 28
5.2 Defaults 28
5.3 NetworkSettings 28
5.3.1 Networkmodes 28
5.3.2 BridgeGroupConfiguration 30
5.3.3 Hosts 31
5.3.4 Routes 31
5.3.5 OSPFandBGP 32
5.3.6 NetworkShare 33
5.4 Users 33
5.4.1 Userrolegroup 33
5.4.2 Usersgroup 34
5.5 PasswordPolicy 34
5.6 PreemptionLevels 34
5.6.1 Addingauser 35
5.6.2 Authentication 36
5.6.3 UserTargetAccess 37
5.6.4 UserTargetRights 38
5.6.5 Groups 38
5.7 Targets 42
5.7.1 Licenses 42
5.7.2 Portconfiguration 43
5.7.3 SP management 50
5.7.4 Firmwareupgradeandrepository 53
ii Vertiv|Avocent®UniversalManagementGatewayApplianceInstaller/UserGuide
5.7.5 Serialmanagement 56
5.7.6 PDU management 59
5.8 AssetLocation 61
5.8.1 RFID tag 61
5.8.2 KVMmanagement 61
5.8.3 Targetgroups 71
5.9 Startup 72
5.10 Firmware 72
5.10.1 Backingupandrestoringapplianceconfiguration 73
5.11 USB Devices 73
5.12 Sensors 74
5.12.1 ComDigitalInput 75
5.12.2 Digitalinputs 75
5.12.3 Environment 76
5.12.4 RS485 environmentsensor 76
5.12.5 PDUTemperatureSensorsDelta 77
6Monitoring 79
6.1 Notificationdestinations 79
6.1.1 SNMP 79
6.1.2 Syslog 80
6.1.3 Email 80
6.1.4 DigitalOutput 81
6.2 Sessions 81
6.3 Support 81
6.4 Security 82
6.4.1 Certificate 83
6.4.2 FIPS 140-2 83
6.4.3 AddressFilter 83
6.5 FirewallandNAT 85
6.5.1 Interfaces 85
6.5.2 Definednetworks 87
6.5.3 Hosts 88
6.5.4 Services 89
6.5.5 Policy 91
6.5.6 1-to-1NAT 97
7Targets 99
7.1 ServiceProcessors 100
7.1.1 Properties 100
7.1.2 System 100
7.1.3 SEL 101
iii
7.1.4 Sessions 101
7.1.5 Power 102
7.1.6 Sensors 102
7.1.7 Logs 102
7.1.8 IML 103
7.1.9 SystemInfo 103
7.1.10 NodeManager 103
7.2 UMIQModules 103
7.3 KVMSessionOptimization 104
7.4 SerialConsole 105
7.5 PDU 105
7.5.1 Properties 105
7.5.2 Outlets 105
7.5.3 Overview 105
7.5.4 Current,Voltage,PowerConsumption,EnergyConsumption 106
7.5.5 Settings 106
7.6 PowerOutlet 107
7.7 AccessibleTargets 107
8SensorsandEvents 109
8.1 Sensors 109
8.2 Events 109
8.2.1 Fan 109
8.2.2 Temperature 109
8.2.3 Power 109
8.2.4 CPUanddiskusage 109
Appendices 111
AppendixA: TechnicalSpecifications 111
AppendixB: InstallationChecklist 113
AppendixC: ForgottenPassword 115
AppendixD: BootingfromtheNetwork 116
AppendixE: CreatinganSP File 117
AppendixF: TroubleshootingSPs 118
AppendixG: ApplianceTroubleshooting 119
AppendixH: TroubleshootingFromtheApplianceShell 121
AppendixI: FirewallandNAT ConfigurationScenarios 123
AppendixJ: VideoResolution 125
iv Vertiv|Avocent®UniversalManagementGatewayApplianceInstaller/UserGuide
1 PRODUCT OVERVIEW
TheAvocent®UniversalManagementGatewayapplianceservesasasinglepointforsecurelocalandremoteaccessand
administrationoftargetdevices.TheAvocent®UniversalManagementGatewayappliancesupportssecureremotedata
centermanagementandout-of-bandmanagementofITassetsfromanylocationworldwide.Itprovideskeyboard,video
andmouse(KVM)capabilitiesandcanalsoremotelyperformservermanagementtasks,includingpowercontroland
consoleaccess,onmanagedtargetdevices.Multipleadministratorscanbeloggedintotheapplianceatthesametimeand
canusethewebuserinterface(UI),thecommandlineinterface(CLI)orDSView™4managementsoftwaretoaccessand
configuretheappliance.
NOTE:AllinstancesofDSView™softwareinthisdocumentrefertoDSView™softwareversion4.5orhigher.
TheAvocent®UniversalManagementGatewayappliancecombinesKVMoverIP,ServiceProcessorManagement(SPM)
andaccessandserialconsolemanagementaccess.Itgivesyouflexibletargetdevicemanagementcontrolandsecure
remoteaccessfromanywhereatanytime.
1.1 Features andBenefits
1.1.1 Secureaccess
Youcansecurelyaccesstheappliancethroughthefollowinglocal(analogconsoleport)andremote(digitalIP)options:
• LAN/WANIPnetworkconnection.
• Serialtargetdeviceconnection.AnauthorizedusercanmakeaTelnet,SSHv1,SSHv2orrawconnectiontoa
targetdevice.ForTelnetorSSHtobeusedforserialtargetdeviceconnections,theTelnetorSSHservice
mustbeconfiguredintheSecurityProfilethatisineffect.
• Consoleconnection.Anadministratorcanlogineitherfromalocalterminalorfromacomputerwithaterminal
emulationprogramthatisconnectedtotheconsoleportandcanusetheCLI.
1.1.2 Autosense
TheAvocent®UniversalManagementGateway2000appliancehaseightautosensingportsthatcanbeusedforeither
serviceprocessor(SP) orserialconnectivityandmanagement.Ithasanadditional32RJ45portswhichareintendedsolely
forSPconnectivityandmanagement.TheAvocent®UniversalManagementGateway4000and6000applianceshave40
autosensingportsthatcanbeusedforserviceprocessor(SP) orserialconnectivityandmanagement.
Portsthatsupportautosensingaredesignatedonthebackoftheappliancewithasmallturquoiselinenexttotheport
number.PortsindicatewhichmodeofoperationiscurrentlyactivewithagreenoramberconnectionLED.Bydefault,all
portscapableofautosensingareinautomode.Itisrecommendedtoleavetheportsettoautosense.Thisisindicatedby
havingboththegreenandamberLEDsilluminated.Ifaportisstaticallysettooneofthetwomodes,thecorresponding
LEDwillbetheonlyoneilluminated.
Figure1.1 AutosensingPort
1
Networkandserialmode
Theautosensingportscanoperateinnetworkorserialmode.Eachmajormodehassubmodescalledportclasses.The
networkportclassisfornetworkorSPconnections.Theportwillautosensenetworktargetsbutwillneedtobemanually
configuredforSPconnectedtargets.TheserialportclassisforconsoleconnectionsorPDUconnections.Bydefault,the
serialportclasswillautosensetoaconsoleconnectionandwillneedtobemanuallyconfiguredforaPowerDistributionUnit
(PDU)connection.Theportswillautosenseandswitchtotheappropriatemodedependingonthetargetattachedtothe
appliance.
Whenaportisinnetworkmode,thegreenLEDwillbeilluminated.TheappliancewillprovideanIPaddresstothenetwork
deviceattachedtoit.Itisonlyintendedtobeconnectedtothedevicetobemanagedoraccessed.Theappliancewillnot
functionasatraditionalnetworkswitchorcommonnetworkaccessfirewall.Itisaspecialpurposeapplianceintendedfor
targetdeviceaccessandmanagement.
CAUTION:SincetheapplianceissuesIPaddressesusingDHCP,theycouldconflictwithaproductionDHCP
infrastructure.ProperVLANsegmentationmustbeassignedonthenetworktoavoidthisconflict.
IPaddressescanalsobeassignedstaticallytoSPs,andtheappliancecanscanIPrangestodiscoverthem.
Whenaportisinserialmode,theamberLEDwillbeilluminated.Theappliancewillassigntheconsoleportclassbydefault
andauto-detectwhethertoapplytheAvocent®orCisco®softpinout.Thespeed,flowcontrol,parityanddata-sizeareall
predefinedforconnectivitytostandardRS232serverconsolesbutcanbemodifiedonaper-portbasis.Inadditionto
consolemode,asupportedAvocent®PDUcanbeconnectedtoandmanagedfromtheappliance.
1.1.3 Webuserinterface(UI)
UsersandadministratorscanperformmosttasksthroughthewebUI (accessedwithHTTPS).ThewebUIrunsinMicrosoft
InternetExplorer®andMozillaFirefox®browsersonanysupportedcomputerthathasnetworkaccesstotheappliance.
AnadministratorcanusethewebUItocreateuseraccounts,authorizegroupsandconfiguresecurityandports.Authorized
userscanaccessconnecteddevicesthroughthewebUItotroubleshoot,maintain,cyclepower,ortorebootconnected
devicesandchangetheirpassword.FormoreinformationonthewebUI,seeWebUserInterfaceonpage23.
1.1.4 VGAandUSBconnections
StandardVGAandUSBconnectionscanbeusedtoattachanLCDtray.Theseportsarelocatedonthefrontofthe
appliance.TheVGAconsoleportcanbeusedforlaunchingsessionstotargetsorforperformingNetBootfirmware
recoveries.TheUSBportsareusedforconnectingUSBkeyboard,mouse,smartcardreader,CD,DVDormassstorage
devices.
Table1.1 VGAConsoleHotkeys
KEYCOMBINATION OPERATION
Alt+Tab Toggletonextviewinacycliclist
Alt+F1 ViewwebUI
Alt+F2 ViewUserShell
Alt+ Esc Closecurrentviewandsession
NOTE:PressALT-F1duringtheappliancebootprogressscreentodisplayverboseoutput.
2 Vertiv|Avocent®UniversalManagementGatewayApplianceInstaller/UserGuide
1.1.5 CLIsetupport
TheserialsetupportprovidesaccesstotheCLIandShell.TheappliancedoesnotsupportrootaccesstotheBashShell.
TheCLIisintendedformanagingandconfiguringtheappliance.
1.1.6 IPv4andIPv6support
TheappliancesupportsdualstackIPv4andIPv6protocols.TheadministratorcanusethewebUIorCLItoconfigure
supportforIPv4and/orIPv6addresses.ThefollowinglistdescribestheIPv4andIPv6supportprovidedintheappliance:
• DHCP
• DSViewsoftwareintegration
• Ethernetinterfaces,GB1(eth0)andGB2(GB2(eth1))
• Firewall(IPtables)
• HTTPS
• Linuxkernel
• Remoteauthentication:ADandLDAPservers
• SSHandTelnetaccess
• Syslogserver
NOTE:RemoteauthenticationNFS,NISandIPSecarenotsupportedwithIPv6.
1.1.7 Security
TheSecuritysettingsallowadministratorstodeterminewhichnetworkservicesareenabledontheappliance.
1.1.8 Datalogging,notifications,alarmsanddatabuffering
Anadministratorcansetupdatalogging,notificationsandalarmstoalertadministratorsofproblemswithemailandsyslog
messages.Anadministratorcanalsostorebuffereddatalocally.Messagesabouttheapplianceandconnectedserversor
devicescanalsobesenttosyslogservers.
1.1.9 Powermanagement
TheAvocent®UniversalManagementGatewayapplianceenablesuserswhoareauthorizedforrackpowerdistributionunits
(PDU)andserviceprocessor(SP)powermanagementtoturnpoweron,turnpoweroffandresetserversviatheirembedded
SPdevicespluggedintoaconnectedrackPDU.
1.1.10 Autodiscovery
Anadministratorcanenableautodiscoverytofindthehostnameofatargetconnectedtoaport.Autodiscovery’sdefault
probeandanswerstringshaveabroadrange.Anadministratorcanconfiguresite-specificprobeandanswerstrings.Auto
discoverycanalsobeconfiguredthroughtheDSView™software.
SupportedSPs
TheappliancesupportsrackandbladeserverSPsfromthefollowingvendors:Dell®,HP,IBM®,Cisco®,Fujitsu®,Oracle®Sun
andadditionalIPMIimplementations.ForacompletelistofSPssupportedbyyourappliance,visit
https://www.VertivCo.comtoseethereleasenotesthatmatchyourappliancefirmwareversion.
1ProductOverview 3
1.1.11 Controlofvirtualmediaandsmartcard-capableappliances
TheAvocent®UniversalManagementGatewayapplianceallowsyoutoview,moveorcopydatalocatedonvirtualmediato
andfromanytargetdevice.Manageremotesystemsmoreefficientlybyallowingoperatingsysteminstallation,operating
systemrecovery,harddriverecoveryorduplication,BIOSupdatingandtargetdevicebackup.
SmartcardssuchastheCommonAccessCard(CAC)canbeusedtostoreidentificationandauthenticationtoenable
accesstocomputers,networksandsecureroomsorbuildings.
VirtualmediaandsmartcardreaderscanbeconnecteddirectlybyusingUSBportslocatedontheappliance.Inaddition,
virtualmediaandsmartcardreadersmaybeconnectedtoanyremoteworkstationthatisrunningtheremotewebUI or
DSView™managementsoftwareandisconnectedtotheapplianceusinganEthernetconnection.
1.1.12 Flexibleusersandgroups
Anaccountcanbedefinedforeachuserontheapplianceoronanauthenticationserver.Anadministratorhasanaccount
bydefaultandcanaddandconfigureotheruseraccounts.Accesstoportscanbeoptionallyrestrictedbasedon
authorizationsanadministratorcanassigntocustomusergroups.
1.1.13 Avocent®DSView™managementsoftwareplug-in
TheDSView™managementsoftwaremaybeusedwiththeappliancetoallowITadministratorstoremotelyaccess,monitor
andcontroltargetdevicesonmultipleplatformsthroughasingle,web-baseduserinterface.DSView™softwareproxyand
SSH Pass-throughfeaturesenableconvenientandsecureremoteaccessforLANandWAN clients.Formoreinformation,
seetheAvocent®DSView™4ManagementSoftwarePlug-InfortheAvocent®UniversalManagementGatewayAppliance
TechnicalBulletin.
4 Vertiv|Avocent®UniversalManagementGatewayApplianceInstaller/UserGuide