User guide

22
Firewall
To prevent unauthorized access to the remote system, IDRAC 6 provides the following features:
• IP address filtering (IPRange) — defines a specific range of IP addresses that can access the
iDRAC 6
• IP address blocking — limits the number of failed login attempts from a specific IP address
IP Blocking
This feature is disabled in the IDRAC 6 default configuration. Use the RACADM config subcommand or
the Web-based interface to enable this feature.
Additionally, use this feature in conjunction with the appropriate session idle timeout values and
defined security plan for your network.
IP Filtering (IPRange) and IP address filtering (or IP Range Checking) allows iDRAC6 to be accessed only
from clients or management workstations whose IP addresses are within a user specific range. All other
logins are denied.
Invalid Login Attack Blocking
To prevent a repeat attack and a password guess attack to your remote system, the IDRAC 6 provides IP
address blocking. This feature limits the number of failed login attempts from a specific IP address.
The IP blocking feature dynamically determines when excessive login failures have occurred from a
specific IP address and blocks (or prevents) the IP address from logging into the IDRAC 6 for the time
span configured in the IDRAC 6.
As login failures accumulate from a specific IP address, they are "aged" by an internal counter. When
the login failures reach the maximum age of the internal counter window, they are deleted (or forgiven).
When a valid login occurs from an IP address that is not penalized (the excessive login failures are being
held in cfgRacTuneIpBlkPenaltyTime), all previous login failures for the IP address are deleted. The
failure history cannot be cleared except by a valid login attempt. When the excessive failures are
detected, login will be blocked for a pre-selected time span. However, this feature can be disabled to
allow login from the targeted IP address.
NOTE: Dell strongly recommends using the IP blocking feature and setting the limit on invalid login
attempts to your environment requirements.
Event Logging
The iDRAC Log can be viewed in the browser interface or retrieved using the RACADM CLI. It will show
open and closed sessions with timestamps. It will also show failed login attempts to create an audit trail
of evidence if there ever was a breach.