Managing your HP servers through firewalls with HP SIM (481364-002, February 2008)

ManualsBrandsHP ManualsSoftwareHP Systems Insight Manager 5.x HP-UX Software

Abstract .............................................................................................................................................. 3

Acronyms in text .................................................................................................................................. 3

Introduction ......................................................................................................................................... 5

HP management products ..................................................................................................................... 6

Case 1: management protocols banned from DMZ ................................................................................. 6

Asset management ........................................................................................................................... 6

Fault management ............................................................................................................................ 6

Case 2: separate management network .................................................................................................. 7

Asset Management ........................................................................................................................... 8

Fault Management ............................................................................................................................ 8

Case 3: managing through a firewall using a single network .................................................................... 8

Asset Management ......................................................................................................................... 10

SNMP ....................................................................................................................................... 11

DMI .......................................................................................................................................... 11

WBEM ...................................................................................................................................... 11

WMI ......................................................................................................................................... 11

WS-MAN .................................................................................................................................. 12

SSH .......................................................................................................................................... 12

Fault management .......................................................................................................................... 12

Configuration Management ............................................................................................................. 13

Version Control .......................................................................................................................... 15

Replicate Agent Settings .............................................................................................................. 15

SSH .......................................................................................................................................... 15

Performance Management ............................................................................................................... 15

Vulnerability and Patch Manager (VPM) ............................................................................................ 15

Virtual Machine Management Pack Ports (VMM) ................................................................................ 17

Insight Power Manager (IPM) ........................................................................................................... 18

System Management Homepage ...................................................................................................... 18

HP Insight Orchestration (HPIO) ....................................................................................................... 18

Version Control Agent (VCA) ........................................................................................................... 19

Version Control Repository Manager – VCRM .................................................................................... 19

Insight Control Environment-Linux ...................................................................................................... 19

Server Migration Pack Universal Edition ............................................................................................ 20

Virtual Server Environment ............................................................................................................... 20

HP Smart Update Manager ............................................................................................................. 21

Rapid Deployment Pack .................................................................................................................. 23

Conclusion ........................................................................................................................................ 24

Appendix A: Configuring a separate management network .................................................................... 25

Managing HP

servers through firewalls with

Insight Software

Summary of content (26 pages)

PAGE 1
Managing HP servers through firewalls with Insight Software Abstract .............................................................................................................................................. 3 Acronyms in text .................................................................................................................................. 3 Introduction .......................................................................................................................................
PAGE 2
For more information .......................................................................................................................... 26 Call to action .....................................................................................................................................
PAGE 3
Abstract This paper identifies possible ways of managing HP servers with HP Systems Insight Manager and Insight Software deployed in the area of the network that is considered more secure than the standard production network. This is not a best practices document. This document provides information that can enable system administrators to create management solutions appropriate for specific computing environments. Acronyms in text The following acronyms are used in the text of this document.
PAGE 4
UDP User Datagram Protocol WBEM Web-Based Enterprise Management WMI Windows Management Instrumentation WS-Management Web Services for Management XML Extensible Markup Language 4
PAGE 5
Introduction Managing systems in a secure environment is a challenge that most system administrators face. It requires a careful balance between critical security requirements and the need to effectively manage and maintain the systems. Within an Internet connected architecture, there is typically a more secure zone, commonly referred to as the de-militarized zone (DMZ).
PAGE 6
HP management products The following HP products are possible management options for HP servers deployed in the DMZ: • HP Insight Control Environment (ICE)-Linux • HP Insight Management Agents (Agents) • HP Insight Management WBEM Providers for Windows (Insight Providers) • HP Insight Orchestration (HPIO) • HP Insight Power Manager (IPM) • HP Smart Update Manager (HP SUM) • HP Systems Insight Manager (HP SIM) • HP WEBM Services for HP-UX • ProLiant Essentials Performance Management Pack (PMP) • Rapid Deploy
PAGE 7
feature. Administrators can set up and configure the Agent Event Notifier during the agent deployment. In Linux operating systems, if a hardware problem occurs, emails are automatically sent to the root email on the managed system. The Insight Agents for Microsoft Windows also create Windows Event Log entries. A management tool such as HP OpenView Operations or Microsoft Operations Manager operating in the same environment can then collect the log entries and send them back to a centralized server.
PAGE 8
anyone compromises the DMZ network, he or she cannot compromise the iLO network. This architecture permits administrators to use iLO on servers located in the DMZ, or in the internal network, without the risk of compromising sensitive data. This separation is accomplished through the use of a dedicated NIC or the iLO 2 Shared Network Port with its Virtual Local Area Network (see the paper titled “HP Integrated Lights-Out security technology” available at http://h20000.www2.hp.
PAGE 9
In some situations, the firewall may simply restrict communication between specific IP addresses. For example, the firewall may allow the exchange of any IP packets between the managed system and the CMS. However, because host names and IP addresses can be spoofed, a higher level of restriction can be imposed through the firewall; that is, the firewall can permit only non-spoofable protocols.
PAGE 10
Asset Management HP SIM provides asset management services by first discovering and identifying the managed systems, gathering data from instrumentation running on each managed system, storing this data in a SQL database, and finally providing reporting capabilities on this gathered data. These steps require communication between the CMS and managed system as described in the following paragraphs. First the managed systems and the instrumentation running on them must be identified.
PAGE 11
2 Not required for asset management Selecting the protocols that must be enabled through the firewall depends on the types of system to be managed. Issues associated with each protocol are discussed below. Ideally, WBEM will be used to manage servers located through a firewall. SNMP SNMP gives the best management coverage but at the highest risk.
PAGE 12
Figure 4 WMI Mapper on managed Windows system behind firewall WBEM WMI Mapper WBEM WMI Management Server WMI Mapper DMZ Data Center The WMI Mapper is included with the Windows version of HP SIM but can also be used with other versions. It is available with the HP SIM software or from the HP website at http://www.hp.com/go/hpsim. The mapper can be installed on a Windows system to allow WBEM access to that system.
PAGE 13
Table 2 How HP agents communicate faults CMS In2 Managed System Out In Y Y Y Protocol1 Description 162 SNMP SNMP Trap 25 SMTP SMTP E-mail 50004 HTTPS/HTTP WBEM event receiver (configurable) Out Y Y Port Y Notes: 1 All ports are for TCP and UDP The CMS will normally have all managed system ports open, as the CMS is a managed system itself. Firewalls may be configured to block these ports if the CMS is not to be managed from another system.
PAGE 14
Y3 Y Y Y 2367 RMI HP SIM RMI connection 2381 HTTPS Web agent Web server 5432 ProstgreSQL Server database Y Y 5988 HTTP WBEM service Y Y 5989 HTTPS WBEM service Y 50000 HTTPS HP SIM Web server Y 50001 HTTPS HP SIM SOAP (configurable6) Y 50002 HTTPS HP SIM SOAP with client certificate authentication (configurable7) Y 50003 HTTP HP SIM SOAP (configurable8) 50004 HTTPS/HTTP WBEM event receiver (configurable) Y 50005 WBEM WBEM Events Y 50006 PostgreSQL PostgreSQL Y
PAGE 15
4 Many CMS outgoing ports are used for discovery. The exact UDP/TCP ports used by DMI are dynamic and vary from system to system, but they tend to be around 32,780 and higher. 5 6 Port number is configurable in mx.properties using MX_SOAP_PORT. 7 Port number is configurable in mx.properties using MX_SOAP_SSO_PORT. Port number is configurable in mx.properties using MX_SOAP_HTTP_PORT; port can be enabled/disabled in globalsettings.props using HTTP_SOAP_PORT_ENABLE with “true” or “false.
PAGE 16
In2 Out In Y Y Out Y Y Y Y Y Y Y 280 TCP HP SIM HTTP port 50000 TCP HP SIM HTTPS port 22 TCP HP SIM SSH port 50001 TCP HP SIM secure Simple Object Access Protocol (SOAP) port 161 TCP/UDP SNMP 162 TCP/UDP SNMP traps Y Y 5989 TCP HP SIM Web-Based Enterprise Management(WBEM)/WMI Mapper Secure port Y Y 2301,2 381,49 400 TCP HP ProLiant Agents Y Y 445 TCP MSDE Named Pipes Communications Y Y 1434 UDP MSDE Shared Instance Support Notes: 1 All ports are for TCP and
PAGE 17
Notes: 1 All ports are for TCP and UDP. The CMS will normally have all managed system ports open, as the CMS is a managed system itself. Firewalls may be configured to block these ports if the CMS is not to be managed from another system.
PAGE 18
The CMS will normally have all managed system ports open, as the CMS is a managed system itself. Firewalls may be configured to block these ports if the CMS is not to be managed from another system. 2 Insight Power Manager (IPM) This section is based on the assumption that HP IPM is behind the firewall with the CMS.
PAGE 19
Y 50000 HTTPS SOAP over HTTPS – LSU Controller to HP SIM Y 40420 HTTPS RMI over HTTPS – LSU Controller to VMM Y 51001 HTTPS RMI over HTTPS – LSU Controller to LSA (VSE logical server management) Y 50000 HTTPS SOAP over HTTPS – LSU Controller to LSU Deployment Service connector Y 1433 TCP JDBC over TCP – talk via JDBC to SQL Server Notes: 1 All ports are for TCP and UDP. The CMS will normally have all managed system ports open, as the CMS is a managed system itself.
PAGE 20
Y Y 80 HTTP SUSE deployment Y Y 60000 RHEL deployment Y Y 2709 Mond (On Managed node) Y Y 514 Syslog-ng (On Managed node) Y Y 5666 Nrpe (On Managed node) Notes: 1 All ports are for TCP and UDP. The CMS will normally have all managed system ports open, as the CMS is a managed system itself. Firewalls may be configured to block these ports if the CMS is not to be managed from another system.
PAGE 21
Table 17 Ports for communication between the CMS and managed nodes CMS In2 Managed System Port Protocol1 Description Out In Out Y Y 5989 HTTPS Used by WBEM. Y Y 2381 HTTPS Used by web agents. Y Y 22 SSH-2 Used by the Distributed Task Facility (DTF). Y Y 9143 OpenSSL Used by Application Discovery. Y 9617,9618 Y Y Y Global Workload Manager uses on CMS.
PAGE 22
Manager to pass information between processes on the local workstation where HP Smart Update Manager is executed, and the next available one is used to receive messages from remote servers. Y 62000 and 62001 These ports (or the first two ports available after 62000) are used for internal process communications on the system running HPSUM on each target Y 62286 This port is the default for some internal communications. It is the listening on the remote side if there is no conflict.
PAGE 23
next available one is used. Y Y 7 ICMP ICMP Echo Reply/Request is used to determine if target devices have successfully rebooted or not Notes: 1 All ports are for TCP and UDP. The CMS will normally have all managed system ports open, as the CMS is a managed system itself. Firewalls may be configured to block these ports if the CMS is not to be managed from another system. 2 Rapid Deployment Pack This section is based on the assumption that RDP is behind the firewall with the CMS.
PAGE 24
Conclusion This has paper identified various options available for managing HP systems in a secure environment. The solutions explained here are intended only as a framework for exploring the options. Each system administrator can and should tailor a solution for his network based on these options.
PAGE 25
Appendix A: Configuring a separate management network To configure a separate management network using HP Systems Insight Manager, install HP Systems Insight Manger on the secondary network by completing the following steps: 1. Configure SNMP to accept packets only from the IP addresses used on the management network, or bind SNMP to the secondary network interface (if the operating system allows this): • On Windows systems: From the Control Panel, open the Services menu.
PAGE 26
For more information For additional information, refer to the resources listed below. Source Hyperlink ProLiant server management http://h18013.www1.hp.com/products/servers/management/index.html HP Systems Insight Manager http://www.hp.com/go/hpsim Understanding HP Systems Insight Manager Security http://h10018.www1.hp.com/wwsolutions/misc/hpsimhelpfiles/HPSIM_53_Security.pdf WBEM Providers for HP SIM www.hp.