HP Ilo 4 User Guide

							Configuringkeymanagerservers
ToconfigurekeymanagerserversiniLO:
1.NavigatetotheAdministration→KeyManagerpage.
2.Enterthefollowinginformation:
•PrimaryKeyServer—TheprimarykeyserverIPaddressorFQDNandport.
•SecondaryKeyServer—ThesecondarykeyserverIPaddressorFQDNandport.
3.Optional:Forconfigurationswithaprimaryandsecondarykeyserver,selecttheRequire
Redundancycheckboxtocheckforserverredundancy.
HPrecommendsenablingthisoption.Whenthisoptionisdisabled,iLOwillnotverifythat
encryptionkeysarecopiedtobothoftheconfiguredKeyServers.
4.ClickApply.
Addingkeymanagerconfigurationdetails
1.NavigatetotheAdministration→KeyManagerpage.
ThelistediLOAccountonESKMaccountnameisilo-.Theaccountname
isread-onlyandisusedwheniLOcommunicateswiththeESKM.
2.EnterthefollowinginformationintheKeyManagerConfigurationsection:
•Group—TheLocalGroupcreatedontheESKMforusewithiLOuseraccountsandthe
keysiLOimportsintotheESKM.Whenkeysareimported,theyareautomatically
accessibletoalldevicesassignedtothesamegroup.
•ESKMLocalCACertificateName(optional)—ToensurethatiLOiscommunicatingwitha
trustedESKMserver,enterthenameofthelocalcertificateauthoritycertificateinESKM.
UsingHPEnterpriseSecureKeyManagerwithiLO251 
						

							ItistypicallynamedLocalCAandislistedinESKMunderLocalCAs.iLOwillretrieve
thecertificateanduseittoauthenticatetheESKMserver(s)foralltransactionsgoing
forward.
•LoginName—TheLocalUsernamewithadministratorpermissionsthatisconfiguredon
theESKM.ThisistheESKMdeploymentuser.
Thedeploymentuseraccountmustbecreatedbeforeyouaddkeymanagerconfiguration
detailsiniLO.
•Password—ThepasswordfortheLocalUsernamewithadministratorpermissionsthatis
configuredontheESKM.
3.ClickUpdateESKM.
iLOverifiesthataniLOaccountnamedilo-existsontheESKM.
Iftheaccountexists,iLOverifiesthattheaccountpasswordiscorrect.Ifthepasswordis
incorrect,iLOupdatesthepassword.ThispasswordisautomaticallygeneratedbyiLOand
mighthavebeenchangedifiLOwasrestoredtothefactorydefaultsettings.Iftheaccount
doesnotexist,iLOcreatesit.
IfiLOisnotamemberofanESKMLocalGroup,itwilltrytocreateagroupwiththerequested
name.IfiLOisalreadyamemberofanESKMLocalGroup,itwillignorethegroupentered
inStep2,andwillusetheexistinggroupassignmentthatispresentontheESKM.Attempted
groupchangesiniLOdonotaffectcurrentkeygrouppermissionsthataresetontheESKM.
Ifanewgroupassignmentisneeded,youmustmakethechangesontheESKMbeforeupdating
theiLOsettings.
IfyouenteredtheESKMLocalCACertificateNameinStep2,certificateinformationislisted
intheImportedCertificateDetailssectionoftheEnterpriseSecureKeyManagerpage.
SeetheHPSecureEncryptionInstallationandUserGuideformoreinformationaboutgroupsand
theirusewithkeymanagement.
TestingtheESKMconfiguration
AfterthekeymanagerconfigurationiscompleteiniLO,youcanusetheTestESKMConnections
featuretoverifytheconfigurationsettings.ThetestsconfirmthatiLOandtheESKMserversareset
uptoprovidekeymanagementservicesforHPSecureEncryption.Duringthetest,iLOattempts
thefollowingtasks:
•ConnectstotheprimaryESKMserver(andsecondaryESKMserver,ifconfigured)byusing
SSL.
•TriestoauthenticatetotheESKMbyusingtheconfiguredcredentialsandaccount.
•ConfirmsthattheversionoftheESKMsoftwareiscompatiblewithiLO.
TotesttheESKMconfiguration:
1.NavigatetotheAdministration→KeyManagerpage.
2.ClickTestESKMConnections.
ThetestresultsaredisplayedintheEnterpriseSecureKeyManagerEventstable.
ViewingEnterpriseSecureKeyManagerevents
1.NavigatetotheAdministration→KeyManagerpage.
2.ScrolltotheEnterpriseSecureKeyManagerEventssection.
Eacheventislistedwithatimestampanddescription.
Viewingremotemanagementtoolinformation
iLO41.30andlaterallowsremotemanagementthroughsupportedtoolssuchasHPOneView.
252UsingiLO 
						

							TheassociationbetweeniLO4andaremotemanagementtoolisconfiguredbyusingtheremote
managementtool.Forinstructions,seeyourremotemanagementtooldocumentation.
WheniLOisunderthecontrolofaremotemanagementtool,theiLOGUIincludesthefollowing
enhancements:
•AmessagesimilartothefollowingisdisplayedontheiLOloginpage:
Warning! Some iLO settings are managed by .
Changes made directly in iLO will be out of sync with the centralized
settings.
•ApagecalledisaddedtotheiLOnavigationtree.
Startingaremotemanagementtool
WheniLOisunderthecontrolofaremotemanagementtool,usethefollowingproceduretostart
theremotemanagerGUIfromiLO.
1.Navigatetothepage.
2.ClickLaunch.
Theremotemanagementtoolstartsinaseparatebrowserwindow.
Deletingaremotemanagerconfiguration
Ifyoudiscontinuetheuseofaremotemanagementtoolinyournetwork,youcanremovethe
associationbetweenthetoolandiLO.
IMPORTANT:HPrecommendsthatyouremovetheserverfromtheremotemanagementtool
beforeyoudeletetheremotemanagerconfigurationiniLO.Donotdeletetheremotemanager
configurationforatoolthatisstillinuseonthenetworkandismanagingtheserverthatcontains
thecurrentiLOsystem.
1.Navigatetothepage.
2.ClicktheDeletebuttonintheDeletethisremotemanagerconfigurationfromthisiLOsection.
Awarningmessagesimilartothefollowingappears:
Proceed with this deletion only if this iLO is no longer under the
control of .
3.ClickOK.
ThepageisremovedfromtheiLOnavigationtree.
UsingiLOwithHPOneView
HPOneViewinteractswithaniLOmanagementprocessortoconfigure,monitor,andmanagean
HPProLiantserver.HPOneViewconfiguresseamlessaccesstotheiLOgraphicalremoteconsole,
Viewingremotemanagementtoolinformation253  
						

							enablingyoutolaunchtheiLOremoteconsolefromtheHPOneViewuserinterfaceinasingle
click.YouriLOprivilegesaredeterminedbytheroleassignedtoyourHPOneViewappliance
account.
HPOneViewmanagesthefollowingiLOsettings:
•Theremotemanagementtool
•SNMPv1trapdestination
•SNMPv1readcommunity
•HPSSOcertificate—HPOneViewaddsatrustedcertificatetotheAdministration→Security→HP
SSOpage.
•NTP(timeserver)configuration
•UserAccount—HPOneViewaddsanadministrativeuseraccounttoiLOwiththename
_HPOneViewAdmin.
•Firmwareversion—WhenyouaddaservertoHPOneView,ifasupportedversionoftheiLO
firmwareisnotinstalled,HPOneViewupdatesthefirmware.
IMPORTANT:ForbestperformancewhenusingHPOneViewwithHPiLO4,HPrecommends
thatyoudonotdeleteorchangethesesettingsbyusingtheiLOwebinterface.
FormoreinformationaboutHPOneView,seehttp://www.hp.com/go/oneview/docs.
UsingtheEmbeddedUserPartition
HPiLO4storesfilessuchasActiveHealthSystemdataandtheIntelligentProvisioningsoftware
innon-volatileflashmemorythatisembeddedonthesystemboard.Thisflashmemoryiscalled
theiLONAND.HPProLiantGen9serverswitha4GBiLONANDallowyoutousea1GB
non-volatileflashmemorypartitionasifitwasanSD-cardattachedtotheserver.Whenthe
EmbeddedUserPartitionisenabled,youcanaccessitthroughtheserveroperatingsystem.
TheEmbeddedUserPartitionisaccessiblethroughtheserverOSforreadandwriteaccesswhen
theserverisconfiguredforLegacyBIOSorUEFIbootmode.
Todeterminewhetheryourserverincludesa4GBiLONAND,seetheserverQuickSpecsathttp://
www.hp.com/go/qs.
YoucanusetheEmbeddedUserPartitionfortaskssuchas:
•StoringUEFIshellscriptsandtesttools.UEFIscriptscanberunautomaticallywhentheserver
bootstotheembeddedUEFIshell.Tousethisfeature,placeastartup.nshshellscriptfile
intherootdirectoryoftheEmbeddedUserPartition.
ThisfeatureissupportedonlywhentheserverisconfiguredfortheUEFIbootmode.
Formoreinformation,seetheHPUEFIShellUserGuideforHPProLiantGen9Serversonthe
HPwebsite:http://www.hp.com/go/ProLiantUEFI/docs.
•InstallingandbootingfromVMwareESXi(UEFImodeonly)
ToselecttheEmbeddedUserPartitionforanOSorhypervisorinstallation,selectthevolume
HPiLOLUN.
254UsingiLO  
						

							•StoringiLOscripts
•StoringiLOlanguagepacks
ForinformationaboutconfiguringaccesstotheEmbeddedUserPartition,see“Configuringthe
EmbeddedUserPartition”(page255).
ConfiguringtheEmbeddedUserPartition
YoucanusetheUEFISystemUtilities,UEFIShell,andHPRESTfulInterfacetooltoconfigurethe
EmbeddedUserPartition.
ConfiguringtheEmbeddedUserPartition(UEFISystemUtilities)
UsethefollowingproceduretoenableordisabletheEmbeddedUserPartitionbyusingtheUEFI
SystemUtilities.
1.Optional:Ifyouaccesstheserverremotely,startaniLOremoteconsolesession.
Youcanusethe.NETIRCorJavaIRC.
2.Restartorpowerontheserver.
3.PressF9intheHPProLiantPOSTscreen.
TheSystemUtilitiesscreenappears.
4.FromtheSystemUtilitiesscreen,selectSystemConfiguration→BIOS/PlatformConfiguration
(RBSU)→SystemOptions→USBOptions→EmbeddedUserPartitionandpressEnter.
5.Selectoneofthefollowingoptions:
•Enabled
•Disabled(default)
UsingtheEmbeddedUserPartition255 
						

							6.PressF10tosaveyourselection.
7.Restarttheserver.
8.AfteryouenabletheEmbeddedUserPartition,formatitbyusingtheserveroperatingsystem
software.
Oncethepartitionisformatted,itcanbeaccessedforreadandwriteaccessfromtheserver
operatingsystem.
ConfiguringtheEmbeddedUserPartition(UEFIShell)
UsethefollowingproceduretoconfiguretheEmbeddedUserPartitionbyusingtheUEFIShell.
1.BoottotheUEFIShell.Forinstructions,seetheHPUEFIShellUserGuideforHPProLiantGen9
Servers.
2.UsethefollowingcommandtoenabletheEmbeddedUserPartition:
sysconfig-sembeddeduserpartition=Enabled
3.Restarttheserver.
4.AfteryouenabletheEmbeddedUserPartition,formatitbyusingtheserveroperatingsystem
software.
Oncethepartitionisformatted,itcanbeaccessedforreadandwriteaccessfromtheserver
operatingsystem.
ConfiguringtheEmbeddedUserPartition(HPRESTfulInterfaceTool)
1.EnableordisabletheEmbeddedUserPartition.
ForinformationaboutconfiguringtheEmbeddedUserPartitionwiththeHPRESTfulInterface
Tool,seetheRESTfulInterfaceTooldocumentationatthefollowingwebsite:http://
www.hp.com/go/restfulinterface/docs.
2.AfteryouenabletheEmbeddedUserPartition,formatitbyusingtheserveroperatingsystem
software.
Oncethepartitionisformatted,itcanbeaccessedforreadandwriteaccessfromtheserver
operatingsystem.
256UsingiLO 
						

							ConfiguringtheEmbeddedUserPartitionbootsettings
YoucanusetheUEFISystemUtilities,UEFIShell,HPRESTfulInterfacetool,oriLOwebinterface
toconfiguretheEmbeddedUserPartitionbootsettings.
ConfiguringtheEmbeddedUserPartitionbootordersetting(iLOwebinterface)
UsethefollowingproceduretochangethepositionoftheEmbeddedUserPartitionintheServer
BootOrderlist.
NOTE:ThisfeatureisnotavailablewhentheLegacyBIOSbootmodeisselected.
1.NavigatetotheVirtualMedia→BootOrderpage.
2.SelecttheEmbeddedUserPartitiondeviceintheServerBootOrderlist,andclickUporDown
tomoveitupordowninthebootorder.
TheEmbeddedUserPartitionislistedwithanamesimilartothefollowing:
Internal Virtual USB 4 : Embedded User.
3.ClickApply.
Thefollowingmessageappears:
Successfully set boot order.
ConfiguringtheEmbeddedUserPartitionforone-timeboot(iLOwebinterface)
UsethefollowingproceduretosetthepositionoftheEmbeddedUserPartitionintheServerBoot
Orderlist.
NOTE:ThisfeatureisnotavailablewhentheLegacyBIOSbootmodeisselected.
1.NavigatetotheVirtualMedia→BootOrderpage.
UsingtheEmbeddedUserPartition257 
						

							2.SelectUEFITargetintheSelectOne-TimeBootOptionlist.
3.SelecttheEmbeddedUserPartitionfromtheSelectUEFITargetOptionlist.
TheEmbeddedUserPartitionislistedwithanamesimilartothefollowing:
Internal Virtual USB 4 : Embedded User.
4.ClickApply.
Thefollowingmessageappears:
Successfully set one-time boot option.
TheCurrentOne-TimeBootOptionvalueisupdatedtoshowtheselection.
ConfiguringtheEmbeddedUserPartitionbootordersetting(UEFISystemUtilities)
UsethefollowingproceduretochangethepositionoftheEmbeddedUserPartitionintheUEFI
BootOrderlist.
NOTE:ThisfeatureisnotavailablewhentheLegacyBIOSbootmodeisselected.
1.Optional:Ifyouaccesstheserverremotely,startaniLOremoteconsolesession.
Youcanusethe.NETIRCorJavaIRC.
2.Restartorpowerontheserver.
3.PressF9intheHPProLiantPOSTscreen.
TheSystemUtilitiesscreenappears.
4.FromtheSystemUtilitiesscreen,selectSystemConfiguration→BIOS/PlatformConfiguration
(RBSU)→BootOptions→UEFIBootOrderandpressEnter.
TheUEFIBootOrderscreenappears.
258UsingiLO 
						

							5.PressEntertoopentheUEFIBootOrderlist.
TheEmbeddedUserPartitionislistedwithanamesimilartothefollowing:
Internal Virtual USB 4 : Embedded User Partition.
6.UpdatethepositionoftheEmbeddedUserPartitioninthebootorderlist,asneeded.
•Usethearrowkeystonavigatewithinthebootorderlist.
•Pressthe+key(plus)tomoveanentryhigherinthebootlist.
•Pressthe-key(minus)tomoveanentrylowerinthelist.
7.PressF10tosaveyourselection.
8.FromtheSystemUtilitiesscreen,selectExitandResumeBoot.
FormoreinformationabouttheUEFIBootOrderlist,seetheHPUEFISystemUtilitiesUserGuide
forHPProLiantGen9Servers.
ConfiguringtheEmbeddedUserPartitionforone-timeboot(UEFISystemUtilities)
UsethefollowingproceduretosetthepositionoftheEmbeddedUserPartitionintheOneTime
BootMenu.
NOTE:ThisfeatureisnotavailablewhentheLegacyBIOSbootmodeisselected.
1.Optional:Ifyouaccesstheserverremotely,startaniLOremoteconsolesession.
Youcanusethe.NETIRCorJavaIRC.
2.Restartorpowerontheserver.
3.PressF9intheHPProLiantPOSTscreen.
TheSystemUtilitiesscreenappears.
4.FromtheSystemUtilitiesscreen,selectOneTimeBootMenu,andthenpressEnter.
TheOne-TimeBootMenuscreenappears.
UsingtheEmbeddedUserPartition259 
						

							5.SelecttheEmbeddedUserPartitionoption,andthenpressEnter.
TheEmbeddedUserPartitionislistedwithanamesimilartothefollowing:
Internal Virtual USB 4 : Embedded User Partition.
TheserverresumesthebootprocessandbootsfromtheEmbeddedUserPartition.
FormoreinformationabouttheOne-TimeBootMenu,seetheHPUEFISystemUtilitiesUserGuide
forHPProLiantGen9Servers.
ConfiguringtheEmbeddedUserPartitionbootordersetting(UEFIShell)
UsethefollowingproceduretoconfiguretheEmbeddedUserPartitionbyusingtheUEFIShell.
1.BoottotheUEFIShell.Forinstructions,seetheHPUEFIShellUserGuideforHPProLiantGen9
Servers.
2.UsethefollowingcommandtoconfiguretheEmbeddedUserPartitionbootordersetting:
sysconfig -s uefibootorder=settingvalue
WheresettingvalueisaUEFIbootorderoption.
NOTE:Forinformationaboutusingthiscommand,seetheHPUEFIShellUserGuideforHP
ProLiantGen9Servers.
ConfiguringtheEmbeddedUserPartitionforone-timeboot(UEFIShell)
UsethefollowingproceduretoconfiguretheEmbeddedUserPartitionbyusingtheUEFIShell.
1.BoottotheUEFIShell.Forinstructions,seetheHPUEFIShellUserGuideforHPProLiantGen9
Servers.
260UsingiLO