- Notes, cautions, and warnings
- Overview
- Built in iDRAC and PowerEdge Security
- Securely Configuring iDRAC Web Server
- Securely Using TLS/SSL Certificate
- Federal Information Processing Standards (FIPS)
- Secure Shell (SSH)
- Network Security Configuration
- Interfaces and Protocols to Access iDRAC
- iDRAC Port Configuration
- IPMI and SNMP Security Best Practices
- Secure Enterprise Key Manager (SEKM) Security
- iDRAC9 Group Manager
- Virtual Console and Virtual Media Security
- VNC Security
- User Configuration and Access Control
- Configuring Local Users
- Disabling Access to Modify iDRAC Configuration Settings on Host System
- iDRAC User Roles and Privileges
- Superroot User
- Recommended Characters in Usernames and Passwords
- Password Strength Policy
- Secure Default Password
- Changing the Default Login Password using Web Interface
- Force Change of Password (FCP)
- Simple 2-Factor Authentication (Simple 2FA)
- RSA SecurID Two Factor Authentication (2FA) iDRAC9 Datacenter
- Active Directory
- LDAP
- Customizable Security Banner
- System Lockdown Mode
- Securely Configuring BIOS System Security
- Secure Boot Configuration
- Securely Erasing Data
- LCD Panel
- Server Inventory, Lifecycle Log, Server Profiles, and Licenses Import and Export
- Security Events Lifecycle Log
- Default Configuration Values
- Network Vulnerability Scanning
- Security Licensing
- Field Service Debug (FSD)
- Best Practices
- Appendix - White papers
iDRAC9 Security Configuration Guide
Group Manager Networking
Group Manager uses IPv6 link local networking to communicate between iDRAC’s (excluding the web browser GUI). Link local communication is defined as non-routed packets which means any iDRAC separated by a router cannot be joined in a local group. If the iDRAC-dedicated port or shared LOM is assigned to a vLAN, the vLAN limits the number of iDRAC’s that can be joined in a group (iDRAC’s must be on the same vLAN and traffic must not pass through a router).
When Group Manager is enabled, iDRAC enables an IPv6 Link Local address regardless of the iDRAC's current user-defined network configuration. Group Manager can be used when iDRAC is configured for IPv4 or IPv6 IP addresses.
Group Manager uses mDNS to discover other iDRAC’s on the network and sends encrypted packets for normal inventorying, monitoring, and management of the group using the link local IP address. Using IPv6 link local networking means that the Group Manager ports and packets never leave the local network or be accessible to external networks.
Ports (Specific to Group Manager unique functionality does not include all iDRAC ports) are:
- 5353 (mDNS)
- 443 (webserver) - configurable
- 5670 (Multicast group communication)
- C000 -> F000 dynamically identifies one free port for each member to communicate in the group
NOTE:Security scanners flag Group Manager usage of mDNS on the IPv6 link local network to discover neighbor iDRAC’s. iDRAC sends group name, Service Tag, and IPv6 address in the mDNS record.
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please provide ratings (1-5 stars).
Please select whether the article was helpful or not.
Comments cannot contain these special characters: <>()\