HP Integrated Lights-Out 2 User Guide

Encryption settings
You can view or modify the current encryption settings using the iLO 2 interface, CLP, or RIBCL.
To view or modify current encryption settings using the iLO 2 interface:
1. Click Administration>Security>Encryption.
The Encryption page appears, displaying the current encryption settings for iLO 2. Both the
current negotiated cipher and the encryption enforcement settings appear on this page.
• Current Negotiated Cipher displays the cipher in use for the current browser session.
After logging in to iLO 2 through the browser, the browser and iLO 2 negotiate a cipher
setting to use during the session. The Encryption page Current Negotiated Cipher section
displays the negotiated cipher.
Encryption Enforcement Settings displays the current encryption settings for iLO 2. Enforce
AES/3DES Encryption (if enabled) enables iLO 2 to only accept connections through the
browser and SSH interface that meet the minimum cipher strength. A cipher strength of
at least AES or 3DES must be used to connect to iLO 2 if this setting is enabled. Enforce
AES/3DES Encryption can be enabled or disabled.
2. To save changes, click Apply.
When changing the Enforcement setting to Enable, close all open browsers after clicking
Apply. Any browsers that remain open might continue to use a non-AES/3DES cipher.
To view or modify current encryption settings through the CLP or RIBCL, see the HP Integrated
Lights-Out Management Processor Scripting and Command Line Resource Guide at http://
h20000.www2.hp.com/bizsupport/TechSupport/DocumentIndex.jsp?contentType=SupportManual&
lang=en&cc=us&docIndexId=64179&taskId=135&prodTypeId=18964&prodSeriesId=1146658.
Connecting to the iLO 2 using AES/3DES encryption
After enabling the Enforce AES/3DES Encryption setting, iLO 2 requires you to connect through
secure channels (web browser, SSH, or XML port) using a cipher strength of at least AES or 3DES.
To connect to iLO 2 through a browser, the browser must be configured with a cipher strength of
at least AES or 3DES. If the web browser is not using AES or 3DES ciphers, iLO 2 displays an
error message informing you to close the current connection and select the correct cipher.
See your browser documentation to select a cipher strength of at least AES or 3DES. Different
browsers use different methods of selecting a negotiated cipher. You must log out of iLO 2 through
the current browser before changing the browser cipher strength. Any changes made to the browser
cipher setting while logged in to iLO 2 might enable the browser to continue using a non-AES/3DES
cipher.
All client operating systems and browsers supported by iLO 2, support the iLO 2 AES/3DES
Encryption feature except when using Windows 2000 Professional with Internet Explorer. By
default, Windows 2000 Professional does not support AES or 3DES ciphers. If a client uses
Windows 2000 Professional, you must use another browser, or update the operating system.
Internet Explorer does not have a user-selectable cipher strength setting. You must edit the registry
to enable Internet Explorer to connect to iLO 2 when the Enforce AES/3DES Encryption setting is
enabled. To enable AES/3DES encryption in Internet Explorer, open the registry and set
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\
FIPSAlgorithmPolicy to 1.
54 Configuring iLO 2