Integrated Dell Remote Access Controller 7 (iDRAC7) Version 1.50.50 User's Guide

Configuring IP Filtering and IP Blocking Using RACADM

You must have configure iDRAC7 privilege to perform these steps.

To configure IP filtering and IP blocking, use the following RACADM objects:

With config command:
- cfgRacTuneIpRangeEnable
- cfgRacTuneIpRangeAddr
- cfgRacTuneIpRangeMask
- cfgRacTuneIpBlkEnable
- cfgRacTuneIpBlkFailCount
- cfgRacTuneIpBlkFailWindow
With set command, use the objects in the iDRAC.IPBlocking group:
- RangeEnable
- RangeAddr
- RangeMask
- BlockEnable
- FailCount
- FailWindow
- PenaltyTime

The cfgRacTuneIpRangeMask or the RangeMask property is applied to both the incoming IP address and to the cfgRacTuneIpRangeAddr or RangeAddr property. If the results are identical, the incoming login request is allowed to access iDRAC7. Logging in from IP addresses outside this range results in an error.

The login proceeds if the following expression equals zero:

Using legacy syntax: cfgRacTuneIpRangeMask & (<incoming-IP-address> ^ cfgRacTuneIpRangeAddr)
Using new syntax: RangeMask & (<incoming-IP-address> ^ RangeAddr)

where, & is the bitwise AND of the quantities and ^ is the bitwise exclusive-OR.

Examples for IP Filtering

The following RACADM commands block all IP addresses except 192.168.0.57:

Using config command:

racadm config -g cfgRacTuning -o cfgRacTuneIpRangeEnable 1
                                                racadm config -g cfgRacTuning -o cfgRacTuneIpRangeAddr 192.168.0.57
                                                racadm config -g cfgRacTuning -o cfgRacTuneIpRangeMask 255.255.255.255

Using set command:

racadm set iDRAC.IPBlocking.RangeEnable 1
                                                racadm set iDRAC.IPBlocking.RangeAddr 192.168.0.57
                                                racadm set iDRAC.IPBlocking.RangeMask 255.255.255.255

To restrict logins to a set of four adjacent IP addresses (for example, 192.168.0.212 through 192.168.0.215), select all but the lowest two bits in the mask:
- Using set command:
```
racadm set iDRAC.IPBlocking.RangeEnable 1
                                                racadm set iDRAC.IPBlocking.RangeAddr 192.168.0.212
                                                racadm set iDRAC.IPBlocking.RangeMask 255.255.255.252
                                             
```
The last byte of the range mask is set to 252, the decimal equivalent of 11111100b.

Examples for IP blocking

The following example prevents a management station IP address from establishing a session for five minutes if it has failed five login attempts within a minute.

Using config command:

racadm config -g cfgRacTuning -o cfgRacTuneIpRangeEnable 1
                                                racadm config -g cfgRacTuning -o cfgRacTuneIpBlkFailCount 5
                                                racadm config -g cfgRacTuning -o cfgRacTuneIpBlkFailWindow 60

Using set command:

racadm set iDRAC.IPBlocking.RangeEnable 1
                                                racadm set iDRAC.IPBlocking.FailCount 5
                                                racadm set iDRAC.IPBlocking.FailWindow 60

The following example prevents more than three failed attempts within a minute, and prevents additional login attempts for an hour;

Using config command:

racadm config -g cfgRacTuning -o cfgRacTuneIpBlkEnable 1
                                                racadm config -g cfgRacTuning -o cfgRacTuneIpBlkFailCount 3
                                                racadm config -g cfgRacTuning -o cfgRacTuneIpBlkFailWindow 60
                                                racadm config -g cfgRacTuning -o cfgRacTuneIpBlkPenaltyTime 3600

Using set command:

racadm set iDRAC.IPBlocking.BlockEnable 1
                                                racadm set iDRAC.IPBlocking.FailCount 3
                                                racadm set iDRAC.IPBlocking.FailWindow 60
                                                racadm set iDRAC.IPBlocking.PenaltyTime 3600

For more information, see the RACADM Command Line Reference Guide for iDRAC7 and CMC available at dell.com/support/manuals.

Welcome

Welcome to Dell

Integrated Dell Remote Access Controller 7 (iDRAC7) Version 1.50.50 User's Guide

Configuring IP Filtering and IP Blocking Using RACADM

Rate this content