WIXLIB

McAfee SIEMIPMI / RMM Setup and Configuration GuideV1.3November 2015

IntroductionThis document is designed to provide the reader with all the steps and information onimplementing and using the Intelligent Platform Management Interface (IPMI) and RemoteManagement Monitor capabilities supported in the McAfee SIEM operating environmentv9.4 and later.The Intelligent Platform Management Interface (IPMI) is a standardized computersystem interface used by system administrators for out‐of‐band management of computersystems and monitoring of their operation. It is a way to manage a computer that may bepowered off or otherwise unresponsive by using a network connection to the hardwarerather than to an operating system or login shell.IPMI information is exchanged though Baseboard Management Controllers (BMCs), whichare located on IPMI‐compliant hardware components. The BMC is a specializedmicrocontroller embedded on the motherboard of a computer, generally a server. The BMCmanages the interface between system management software, in this case RMM andplatform hardware. Using low‐level hardware intelligence instead of the operating systemhas two main benefits: First, this configuration allows for out‐of‐band server management;Second, the operating system is not burdened with transporting system status data.IPMI functions are designed to work in any of three scenarios: Before an OS has booted (allowing, for example, the remote monitoring orchanging of BIOS settings) When the system is powered down (but still attach to power) After OS or system failure – the key characteristic of IPMI compared with in‐band system management such as by remote login to the operating systemusing SSHRemote monitoring and management (RMM) is a collection of information technologytools that are found on workstations and servers. These tools gather information regardingthe applications and hardware operating within an environment as well as supply activityreports allowing administrators to resolve any issues. RMM usually provides a set of ITmanagement tools like trouble ticket tracking, remote desktop monitoring, support, and userinformation through a complete interface.Within the McAfee SIEM appliance family, IPMI is provided through the Intel RMM4 moduleinstalled into every McAfee GEN4 SIEM Appliance.

IPMI and RMM Setup and Configuration GuideMcAfee SIEMRevision HistoryAugust 2014V1.0First Public ReleaseNovember 2014V1.1 August 2015V1.2 Updated link to motherboard manual.November 2015V1.3 Added disclaimer on IPMI being disabled for security concerns. Added steps to enable or disable via IPMItoolAdded Revision History SectionAdded links to motherboard SDR return codes.Corrected page numberCorrected password on page 103

IPMI and RMM Setup and Configuration GuideMcAfee SIEMTable of ContentsBIOS Update5Enabling IPMI15IPMItool20Updating your appliance(s) to enable IPMI and RMMTurning on IPMI via ESM Management InterfaceCommand line IPMI syntax and examplesBMC Web Console32Appendix A51Appendix B53Using the web console interfaceCommand line arguments for IPMItoolCommand syntax for IPMItoolAppendix C60SDR Entity ValuesAppendix DSDR Type Values614

IPMI and RMM Setup and Configuration GuideMcAfee SIEMBIOS UpdateIPMI and RMM capabilities are only supported on the Generation 4 (GEN4) SIEM appliances. Beforeproceeding with this document, make sure you have GEN4 appliances. The two images below highlight thestark differences between Generation 3 and Generation 4 SIEM appliances. While the examples belowdisplay the 2U Gen4 appliance and the 3U Gen3 appliance, the orange bezel is always indicative of a Gen3appliance.GEN4 ApplianceGEN3 ApplianceWithin the Gen4 SIEM appliance family, there are some exceptions on which platforms support IPMIcapabilities. Below is a table of what is and is not supported.IPMI SupportedIPMI NOT SupportedAll Standalone ESM ModelsAny DAS Models(These devices do not have an IPMI port)All Combination ESM ModelsAny Receiver (ERC) in HA mode regardless of Model(All available ports are used to configure HA)All Non-HA Receivers (ERC)All ACE AppliancesAll ADM AppliancesAll DEM Appliances5

IPMI and RMM Setup and Configuration GuideMcAfee SIEMBIOS UpdateBefore IPMI and Remote Management can be supported within the McAfee SIEM environment, the BIOS foreach appliance must be at a specific release to enable capabilities within the SIEM Management interface andSIEM operating environment. As outlined in the previous section, remote management is only available onGeneration 4 and later appliances as well as operating environment v9.4 and later. See previous section for adescription of the appliances to ensure you have a GEN4 appliance.Check current appliance versionIPMI and RMM capabilities are only supported in the SIEM operating environment v9.4 and above. To checkwhich McAfee SIEM Operating Environment version your appliance(s) are currently at, log into your ESMusing any flash capable browser. Once the login screen appears, check the lower left corner of the browserfor the version number. It should be version 9.4.0 or greater. See Figure 1 for an example. If your appliancedoes not have this version, access the McAfee download page to obtain the latest release. Once it has beenupgraded, continue with the steps following this topic.The download link is: igure 1While all McAfee SIEM appliances should be on the same operating environment release, it is possible thatthis may not be the case in your environment. We recommend checking each appliance’s SIEM OperatingEnvironment version. To do this, select the appliance and click the Properties icon (White Square in icon barabove device tree display) and the resulting dialog will display the version. An example of this is in Figure 2.Figure 2Check current appliance BIOS versionOnce you have identified your appliance as GEN4 hardware and that you are on the proper SIEM operatingenvironment version, you should check your BIOS version to ensure that it requires a BIOS update.Depending on when you received your appliance(s), its BIOS may have already been updated.6

IPMI and RMM Setup and Configuration GuideMcAfee SIEMBIOS UpdateTo check the BIOS version, SSH into the appliance and issue the following command:McAfee-ETM-6000 # dmidecode –t 0Figure 3 displays an example of the output the command will generate.McAfee-ETM-6000 # dmidecode -t 0# dmidecode 2.10SMBIOS 2.6 present.172 structures occupying 10014 bytes.Table at 0x000EB570.Handle 0x0000, DMI type 0, 24 bytesBIOS InformationVendor: Intel Corp.Version: SE5C600.86B.02.02.0002.122320131210Release Date: 12/23/2013Address: 0xF0000Runtime Size: 64 kBROM Size: 8192 kBCharacteristics:PCI is supportedBIOS is upgradeableBIOS shadowing is allowedBoot from CD is supportedSelectable boot is supportedEDD is supported5.25"/1.2 MB floppy services are supported (int 13h)3.5"/720 kB floppy services are supported (int 13h)3.5"/2.88 MB floppy services are supported (int 13h)Print screen service is supported (int 5h)8042 keyboard services are supported (int 9h)Serial services are supported (int 14h)Printer services are supported (int 17h)ACPI is supportedUSB legacy is supportedBIOS boot specification is supportedTargeted content distribution is supportedBIOS Revision: 4.6McAfee-ETM-6000 #Figure 3The correct BIOS version release date should be at or later than the example highlighted (yellow) above.If yours is not, continue with the steps on the following pages. If your BIOS version is at or later than thisrelease date, continue onto the ESM Setup section on page 16.If your appliance BIOS Release date is before 12/23/2013 AND you are running v9.5.0 The IPMIdialogs are disabled within the GUI. To correct, you will have to perform the BIOS upgrade steps inthe following pages.7

IPMI and RMM Setup and Configuration GuideMcAfee SIEMBIOS UpdateObtaining the BIOS update packageTo upgrade the appliance BIOS you will need extract the proper Intel Security BIOS update package to a USBflash drive. These compressed packages are located on the ESM appliance in the following directory:/etc/areca/system bios update/The BIOS packages located here are specific Intel Security (McAfee) SIEM Appliances. Do notattempt to use any other BIOS packages other than what is located here.The directory will contain files similar, but not exactly, as the ones below:850-1773-03 032514.zip850-1904-00 012714.zipContents-README.txtBecause BIOS packages may change between SIEM operating environment releases, please refer tothe Contents-README.txt file for the correct package that is to be used for the appliance youare upgrading.After you have identified which ZIP package is appropriate for the appliance you are upgrading, use anapplication like SCP or WinSCP to download the ZIP package. If your environment requires both zippackages, please extract each zip to its own properly labeled USB flash drive. Mixing the packages couldrender an appliance un‐bootable.Once you have downloaded the zip package, unzip it to the root of your USB flash drive. The drive you useshould be empty, should be a 4GB drive or less and can be formatted using Windows or Linux file systems. Italso does not have to be bootable. The directory on the USB flash drive will look similar to Figure 4 below.Figure 48

IPMI and RMM Setup and Configuration GuideMcAfee SIEMBIOS UpdateNext, insert the USB flash drive into an unused USB port on the back of the appliance being upgraded. Therear of both appliances (1U and 2U), and their respective USB ports, are highlighted in Figure 5.Figure 5Once the USB flash drive has been attached, re‐boot the appliance. To ensure a proper shutdown, use eitherthe SIEM Administrative interface (browser‐based GUI) or a monitor and keyboard attached to the system toaccess the LCD emulator in the upper left corner of the console. The shutdown process may take severalminutes so that it can safely complete any outstanding task. Please be patient.Once the system boots normally, it will display the McAfee Boot Splash screen as shown in Figure 6.Do not make a selection. Let the system boot as normal. It will auto recognize that the USB drive isattached and boot from it. The McAfee Splash screen may take up to 60 seconds before proceeding.Figure 69

IPMI and RMM Setup and Configuration GuideMcAfee SIEMBIOS UpdateAfter the McAfee boot splash clears, the system willrecognize the USB and will start to boot. However,depending on when you received your SIEM appliance,there may have been a BIOS password set and it willneed to be entered in order for the automated BIOSupdate process to start. If this is the case in yourenvironment, the example in Figure 7 will appear. Thepassword you enter will depend on the type of applianceyou are updating.For 1U Appliances use:For 2U Appliances use:Figure 7appl1an@ppl1@nc3Once you have successfully entered the BIOS password, you should see a screen similar to Figure 8.Figure 8At this point it should start updating the system automatically and you will see messages scroll across thescreen. The entire process can take as much as 15 to 20 minutes to complete. There are multiple phases ofthe update process as the various subsystems of the motherboard are updated. You may notice that theappliance cooling system power cycle a number of times, this is normal. You may also notice messagesindicating password failures, this also is normal.Do not interrupt or reset the update process, remove power to the system, or use the keyboard(unless prompted) while the update is taking place. Doing so could result in an unbootablesystem.10