HPE C7000 on Wojciech Marusiak IT Blog

Installing signed SSL certificates in HP c7000 enclosure

Wed, 23 Sep 2015 07:00:15 +0000

Installing signed SSL certificate in HP c7000 enclosure isnt’ difficult thing to do. From my experience most of the time you will spend is to setup Certificate Authority. If you work in bigger company most likely you already have working Certificate Authority. If you don’t have it you certainly can create it.

Here you can find some guides how to install Certificate Authority:

Linux based Certificate Authority https://jamielinux.com/docs/openssl-certificate-authority/
Windows based Certificate Authority http://www.rickroetenberg.com/install-certificate-authority/

Installing signed SSL certificates in HP c7000 enclosure

In my particular setup I used Certificate Authority which use certificate-signing request (CSR). You can read more in Wikipedia: https://en.wikipedia.org/wiki/Certificate_signing_request.

Generating certificate-signing request in HP c7000 enclosure

Login to enclosure and go to Enclosure Information, expand Active Onboard Administrator and select Certificate Administration. You will see details about your old self signed certificate.
As I mentioned at the beginning we will use CSR request with Certificate Authority. I will not go through CSR signing itself. Switch to Certificate Request tab and select Generate a certificate-signing request (CSR). You need to fill in mandatory fields with asterisk *****.
Country (C)
State or Provice (ST)
City or Locality (L)
Organization Name (O)
Common Name (CN)
Again - if your CA supports additional optional information than by all means use it. Some Certificate Authorities simply strip certificates from that information - it depends how is it configured.
Once you filled all information click Apply and CSR will be generated.
As you can see on picture below CSR is generated.
Once you will upload CSR to your CA and generate certificate from it export it to Base-64 encoded X.509 (.CER) format.
Last thing we have to do is to import certificate into Onboard Administrator. Navigate to Certificate Upload, paste your signed certificate and click Upload.
Once certificate is uploaded you will be signed out and SSL certificate will be replaced.
Onboard Administrator is uploading certificate.
Wait until your sessions is reloaded.
As you see my certificate is replaced and valid.

Summary

As you see procedure is fairly simple (besides Certificate Authority itself). What you need to do next is replace standby Onboard Administrator certificate.

HP OneView SSL certificate replacement

Tue, 07 Jul 2015 08:56:35 +0000

In my previous post we configured HP OneView to manage HP c7000 enclosure. Today I will show you how to replace self signed certificate with one from trusted Certificate Authority.

Login to your appliance and in main menu click **Settings.
In Actions menu click Create certificate signing request.
In Certificate Signing Request section fill necessary field - Country, State or province, City. Common name will be taken from appliance settings. Fill only fields which are relevant and used by your Certificate Authority.
Once you fill all fields click OK and you will see base64 encoded certificate request.
Go through certificate approval process and once it is done you can upload signed certificate to your appliance.
In Actions menu click Import Certificate.
Paste base64 encoded certificate into field and click OK.
Wait for certificate import.
Once it is imported click in main Setting menu Certificate.
You will see in your browser that certificate is valid (trusted) and you can view details of you certificate.

This concludes how to install signed SSL Certificate in HP OneView.

How to generate new self-signed certificate in HP c7000 enclosure

Mon, 09 Mar 2015 14:36:04 +0000

For a period of days I am working on replacing self-signed certificates in my environment and I found one issue with my enclosure. My certificate authority supports only 2048 Bits Certificate Signing Requests and in my case enclosure had 1024 Bits certificate. I found solution how to quickly fix problem and replace self-signed certificate.

Hardware details:

HP c7000 enclosure

Onboard Administrator: 4.30

How to generate 2048 Bits certificate

Procedure itself is really simple. According to HP documentation http://h20564.www2.hp.com/hpsc/doc/public/display?docId=emr_na-c03659074 if you reset Onboard Administrator then new key will be generated.

HP info

To switch from 1024-bit to 2048-bit keys you needed to first reset the OA configuration to factory defaults which would cause the generation of new keys.

Certificate generation

Starting from Onboard Administrator version 3.56 you can do it easier.

Simply login to Onboard Administrator using SSH and execute this command

`1`	`generate key all 2048`

You will be asked if you want to regenerate private keys. Answer yes and Onboard Administrator will be restarted.

After restart you will have new fresh 2048 Bits certificate.

Repeat same step for second Onboard Administrator.

HP c7000 Blade Enclosure Configuration

Wed, 28 Jan 2015 09:00:33 +0000

Managing you blade infrastructure might be sometimes challenging. I decided to guide you through components of HP c7000 Enclosure and components you can use. After short introduction I went through initial configuration and additional settings which I thing are quite useful.

HP c7000 Enclosure overview

The HP BladeSystem c7000 Enclosure goes beyond just Blade servers. It consolidates server, storage, networking and power management into a single solution that can be managed as a unified environment.

The BladeSystem c7000 enclosure provides all the power, cooling, and I/O infrastructure needed to support modular server, interconnect, and storage components today and throughout the next several years. The enclosure is 10U high and holds up to 16 server and/or storage blades plus optional redundant network and storage interconnect modules.

Intelligent Infrastructure support: Power Discovery Services allows BladeSystem enclosures to communicate information to HP Intelligent PDUs that automatically track enclosure power connections to the specific iPDU outlet to help ensure redundancy and prevent downtime. Location Discovery Services allows the c7000 to automatically record its exact location in HP Intelligent Series Racks, eliminating time-consuming manual asset tracking.

HP BladeSystem Onboard Administrator is the built-in enclosure management processor, subsystem, and firmware base used to support the HP BladeSystem c-Class enclosures and all the managed devices contained within them. Onboard Administrator provides a single point from which to perform management tasks on server blades or switches within the enclosure.

Together with the enclosure’s HP Insight Display, the Onboard Administrator was designed for both local and remote HP BladeSystem c-Class administration.

This module and its firmware provide:

Wizards for simple, fast setup and configuration
Highly available and secure local or remote access to the HP BladeSystem infrastructure
Security roles for server, network, and storage administrators
Automated power and cooling of the enclosure
Agentless device health and status
Power and cooling information and control

Each enclosure ships with an Onboard Administrator module/firmware. HP BladeSystem Platinum Enclosures can be configured with redundant Onboard Administrator modules to provide uninterrupted manageability of the entire enclosure and blades. When two Onboard Administrator modules are present, they work in an active-standby mode, assuring full redundancy of the enclosure’s integrated management.

HP c7000 Enclosure specification

Technical features

System fan features

10 Active Cool 200 Fans

Form factor

8 Full Height Blades/16 Half-Height Blades
Mixed configurations supported

BladeSystems supported

HP ProLiant, Integrity and Storage blades in either mixed or homogenous configurations

Management features

OneView (OV) software License

Power availability

2400W (6) 1 phase Platinum power supply kits

What’s included

(1) HP BLc7000, (6) Power Supplies, (10) Fans, (1) Onboard Administrator with KVM, and, (16) ROHS Full Licenses OneView

Product differentiator

1 Phase 6 Pwr Supplies 10 Fans ROHS 16 OV Lic

Warranty

3/3/3 (parts-labor-onsite)

Dimensions and weight

Dimensions (W x D x H)

75.89 x 60.65 x 101.29 cm (29.88 x 23.88 x 39.88 in)

Weight

136.08 kg (300 lb)

HP c7000 Enclosure interconnects

HP Virtual Connect

HP Virtual Connect is an essential building block for any virtualized or cloud-ready environment. This innovative, wire-once HP connection management simplifies server connectivity, making it possible to add, move, and change servers in minutes vs. hours or days. Virtual Connect is the simplest way to connect servers to any network and reduces network sprawl at the edge by up to 95 percent.

Main two types Virtual Connect modules used by customers are HP Virtual Connect FlexFabric and HP Virtual Connect Flex-10.

HP Virtual Connect FlexFabric

In short word first one act as pass-thru device and is compatible with all other NPIV standards-based switch products. Any changes to the server are transparent to its associated network, cleanly separating the servers from SAN and relieving SAN Administrators from server maintenance.

QuickSpecs

Performance

(8) 2/4/8Gb Auto-negotiating Fibre Channel uplinks connected to external SAN switches
(2) Fibre Channel SFP+ Transceivers included with the Virtual Connect Fibre Channel Module
(16) 1/2/4/8Gb Auto-negotiating Fibre Channel downlink ports provide maximum HBA performance
HBA Aggregation on uplinks ports using ANSI T11 standards-based N_Port ID Virtualization (NPIV) technology
Allows up to 255 virtual machines running on the same physical server to access separate storage resources
Extremely low latency throughput provides switch-like performance.

Management

Storage management is no longer constrained to a single physical HBA on a server blade
Managed with the Virtual Connect Ethernet Module
Does not add to SAN switch domains or require traditional SAN management
Appears as a pass-thru device to the SAN Manager

Virtual server profiles

Provisioned storage resource is associated directly to a specific virtual machine - even if the virtual server is re-allocated within the BladeSystem
Ability to pre-configure server I/O connections
Ability to move, add, or change servers on the fly
Once defined, SAN Administrators don’t have to be involved in server changes

HP Virtual Connect Flex-10/10D

Performance

16 x 10Gb downlinks to server NICs
Each 10Gb downlink supports up to 4 FlexNICs or 3 FlexNICs and 1 iSCSI FlexHBA
Each iSCSI FlexHBA can be configured to transport Accelerated iSCSI protocol.
Each FlexNIC and iSCSI FlexHBA is recognized by the server as a PCI-e physical function device with adjustable speeds from 100Mb to 10Gb in 100Mb increments when connected to a HP NC553i 10Gb 2-port FlexFabric Converged Network Adapter or any Flex-10 NIC and from 1Gb to 10Gb in 100Mb increments when connected to a NC551i Dual Port FlexFabric 10Gb Converged Network Adapter or NC551m Dual Port FlexFabric 10Gb Converged Network Adapter including NC554FLB Dual Port FlexFabric Adapter
4 x 10Gb cross connects for redundancy and stacking
10 x 10Gb SR, LR, or LRM fiber and copper SFP+ uplinks
Supports up to 4 FlexNICs per 10Gb server connections.
Each FlexNIC is recognized by the server as a PCI-e physical function device with customizable speeds from 100Mb to 10Gb.
Line Rate, full-duplex 600 Gbps bridging fabric
1.0 μs latency
MTU up to 9216 Bytes - Jumbo Frames
Supports up to 128K MAC addresses and 1K IGMP groups
VLAN Tagging, Pass-Thru and Link Aggregation supported on all uplinks
In tunneled VLAN mode, up to 4,096 networks are supported per network uplink and server downlink. In mapped VLAN mode, up to 1,000 networks are supported on network uplinks per Share Uplink Set, domain or module and on server downlinks up to 162 networks are supported per 10Gb physical port (VC v3.30 or later).
Stack multiple Virtual Connect Flex-10/10D modules with other VC Flex-10/10D, VC FlexFabric or VC Flex-10 across up to 4 BladeSystem enclosures allowing any server Ethernet port to connect to any Ethernet uplink

Management

Virtual Connect Manager is included with every module
HTTPS and a secure, scriptable CLI interface is ready out of the box. Easy setup and management via the Onboard Administrator interface
SNMP v.1, v.2 and v.3, provide ease of administration and maintenance.
Port Mirroring on any uplink provides network troubleshooting support with Network Analyzers
IGMP Snooping optimizes network traffic and reduces bandwidth for multicast applications such as streaming applications
Role-based security for network and server administration with LDAP, TACACS+ and RADIUS compatibility
Remotely update Virtual Connect firmware on multiple modules using Virtual Connect Support Utility 1.10.1 or greater
CLI auto-filling with TAB key
GUI and CLI session timeout for security
QoS configurable based on DOT1P and DSCP
Configurable filtering of multicast traffic
sFlow monitoring

Virtual Connect Server Profiles

Create up to 4 individual FlexNICs with their own dedicated, customized bandwidth per 10Gb downlink connection.
Set FlexNIC speeds from 100Mb to 10Gb per connection
Allows setup of server connectivity prior to server installation for easy deployment
Ability to move, add, or change server network connections on the fly
Once defined, LAN and SAN administrators don’t have to be involved in server changes

Fibre Channel Switches

Brocade 8Gb SAN Switch

Advanced Fabric Services

Hardware Enforced Zoning (included)
Dynamic Path Selection (included)
WebTools (included)
Enhanced Group Management (EGM)
Power Pack+ fabric services software bundle (optional)
- Fabric Vision
- ISL Trunking
- Fabric Watch
- Extended Fabrics
- Advanced Performance Monitoring
Secure Fabric OS (included in base FOS)
SAN Network Advisor (optional)

Manageability

WebTools (included)
Enhanced Group Management (EGM)
Advanced Performance Monitoring (optional Power Pack+ upgrade)
HP OnBoard Administrator (included with HP BladeSystem)
HP Systems Insight Manager (included with HP BladeSystem)
HP Storage Essentials (optional)
API
SNMP

Interoperability

Brocade Access Gateway enables Brocade embedded SAN switches to interoperate with other SAN fabrics running supported firmware. While in Brocade Access Gateway mode, the device must also be connected to an NPIV-enabled edge switch or director. Supported edge environments are listed in the Brocade Fabric OS® release notes.

HP c7000 Enclosure configuration

HP c7000 Enclosure configuration - Insight Display

First step to configure enclosure is IP address configuration using Insight Display.

Navigate to Enclosure Settings
Navigate to Active OA and click OK.
Navigate to Active IPv4 and click OK.
Choose proper value - static IP configuration or DHCP and click OK.
Interface will direct you to Accept button. Click OK.
Now you can enter your IP address. It takes a while and after setting IP address go to Accept.
Do the same with second Onboard Administrator module and now we can switch to web based configuration.

HP c7000 Enclosure configuration - First Time Setup Wizard

After you successfully login to enclosure you will be welcome by First Time Setup Wizard. We will go through it since it configure majority of settings.

Check Do not automatically show this wizard again if you don’t want to be bothered again by this wizard. Click Next.
On the next screen you can choose to enable FIPS (Federal Information Processing Standards) which is in simple words set of standard cryptographic modules. Select it according to your needs.
Select your enclosure and click Next.
If you have previously saved configuration file you can use it to set up enclosure.
Configure Rack Name, Enclosure Name and Date and Time. I suggest to use NTP server to have always up to date time and date settings.
You can change password for Administrator and enable PIN protection before using the enclosure’s Insight Display. Click Next.
In next section we can create additional Local User Accounts. Let us create one just to show you how do we do it. Click New.
Provide User Name, password and Privilege Level. On the right part of the screen choose where user should have access. At the end click Add User.
On the next screen we will configure EBIPA - Enclosure Bay IP Addressing. EBIPA is internal DHCP scope for Blades iLO and devices in enclosure bays (HP Virtual Connect or HP Access Gateway). Click Next.
We need to fill in First EBIPA Address, Subnet Mask, Gateway, Domain and DNS Servers. Next step is to click button Autofill which will fill in whole range.
We do the same for Interconnect Bays and click Next.
You can configure IPv6 in the same way. I skipped this and I moved ahead to next step.
Next step is to configure Directory Groups.
Click New and add Group Name, set privilege level and gave group necessary permissions. After that click Add Group.
Click Next and we will setup Directory Settings.
Select Enable LDAP Authentication and Use NT Account Name Mapping (DOMAIN\username). Provide following settings:
- Directory Server Address.
- Directory Server SSL Port.
- Search Context.
Click Next and we will go ahead to Network Settings.
Provide settings for both Onboard Administrator modules:
- DNS Host Name
- IP Address
- Subnet Mask
- Gateway
- DNS Server 1
- DNS Server 2
Click Next ( I skipped IPv6 configuration) and we will go ahead with next wizard setting.
Almost at the end you can configure SNMP Settings. In my wizard I skipped it.
Last step is to set Power Management settings.
- Power Mode - select AC Redundant, Power Supply Redundant or Not Redundant.
- AC Redundant - In this configuration N power supplies are used to provide power and N are used to provide redundancy.
- Power Supply Redundant: Up to 6 power supplies can be installed with one power supply always reserved to provide redundancy.
- Not Redundant: No power redundancy rules are enforced and power redundancy warnings will not be given.
Dynamic Power - This mode is off by default since the high-efficiency power supplies save power in the majority of situations. When enabled, Dynamic Power attempts to save power by running the required power supplies at a higher rate of utilization and putting unneeded power supplies in standby mode.
Power Limit - Power Limit AC Input Watts over this set limit.
Click Next and you will finish First Time Setup Wizard.

HP c7000 Enclosure configuration - Additional Settings

HP c7000 Enclosure additional settings - Directory Settings

In order to use Active Directory authentication we need to import domain controller certificate into enclosure.

Go to Users/Authentication expand Local Users and click to Directory Settings.
Click on Certificate Upload, paste your certificate and click Upload.
Last step is to test settings. Navigate to Test Settings tab. In order to do it give username and password and click test settings.
After you click Test Settings you have to wait a while for test result.
If everything is set up correctly you should see success. In my case I don’t have Passed in all cases because I can’t ping domain controller, but authentication works.

HP c7000 Enclosure additional settings - Enclosure IP Mode

Similar to Virtual Connect Module, Onboard Administrator support “virtual IP mode”. In simple words it means that by accessing OA you will be always redirected to active OA in enclosure. In order to enable it go to Enclosure Settings click Enclosure TCP/IP Settings and you will find setting in IPv4 Settings tab. Select Enclosure IP Mode and click Apply.

HP c7000 Enclosure additional settings - Onboard Administrator Active/Standby Transition

Another quite useful feature in Onboard Administrator is possibility to switch between Active and Standby OA. In order to switch you simply need to click Transition Active to Standby in Enclosure Settings, Active to Standby.

HP c7000 Enclosure additional settings - Link Loss Failover

Link Loss Failover allows monitoring of network link status of the Active Module. If we enable this function in case Active OA loose network automatic failover to Standby OA will happen. To enable it navigate to Enclosure Settings and click Link Loss Failover. Select Enable Link Loss Failover, provide Failover Interval in seconds and lick Apply.

Summary

This concludes HP c7000 Enclosure configuration. I hope you will find it useful and you enjoyed it.

HP c7000 Onboard Administrator firmware update

Wed, 21 Jan 2015 09:00:27 +0000

Keeping you hardware and software up to date is very important in every environment. Today I will guide you through firmware update in HP c7000 Enclosures.

Onboard Administrator firmware update

The procedure itself is straight forward and there shouldn’t be any problems by executing it.

Login to Onboard Administrator.
Navigate to Active Onboard Administrator and click Firmware Update.
Click Browse and provide path to firmware. Click Upload.
You will see alert that updating Onboard Administrator firmware will cause reboot. Click OK.
Wait for firmware update.
When firmware update is completed Onboard Administrator will be reset.
Flashing takes about 3-5 minutes which is not that long. Onboard Administrator reset takes about the same time. Please remember to clear your browser cache.
After successful flashing firmware will be upgraded.

Onboard Administrator firmware release notes

It is very important to not blindly update firmware and therefore I suggest to read firmware release notes. For example for version 4.30 of Onboard Administrator you can find what has been fixed or what kind of new features are added.

HP Firmware Compatibility Matrix

It is also good to check firmware compatibility matrix. Below you will find current compatibility matrix.

HP Firmware Compatibility Matrix

HP c7000 Onboard Administrator LDAP Active Directory authentication

Fri, 28 Jun 2013 20:54:32 +0000

Since quite a long time I have a pleasure to work with HP Enclosures c7000 and c3000. HP Blades with enclosures is the really great enterprise solution. Over the years I found difficult to manage multiple enclosures with local users and this is where integration with Active Directory makes your life simpler. In few steps, I will guide you how to integrate Onboard Administrator with Active Directory LDAP.

Prerequisites:

Active Directory group with users is created
Domain Controller network traffic (LDAP over SSL) is allowed
Domain Controller Computer certificate is valid,

In order to configure Active Directory LDAP authentication login to Onboard Administrator with local username and password and navigate to Users/Authentication and click Directory Settings.
Please fill fields with following settings: Directory Server SSL Port: 636 Search Context:CN=OA Administrators,OU=Administrator Groups,OU=Administrators,DC=yourdomain,DC=whatever,DC=itis You need to provide OU where Active Directory group is created. For example ? group OA Administrators is located in yourdomain.whatever.itis/Administrators/Administrator Groups/ OU and search context for this group will be). If you don’t know how to find it just run simple dsquery from command line: dsquery group -samid “Group Name”
Search Context 2-6: You can provide up to six groups Search Context if needed.
Select Enable LDAP Authentication
Select Use NT Account Name Mapping (DOMAINusername) - if you will not select this field you will have to login to Onboard Administrator using username@domain format instead of DOMAINusername
Next step is Domain Controller certificate upload. First you need to obtain it from Domain Controller. You can obtain it using following ways:
In browser type https://Domain Controller:636, then view the certificate and select Copy to File and export it to .CER Base-64 encoded X.509 format.
The second way to obtain the certificate is to login to Domain Controller and start mmc and select Certificates Personal for Local Computer and open it. Next, go to Details tab and select Copy to File and export it to.CER Base-64 encoded X.509 format.
After the certificate is exported, open it with notepad and copy file content to clipboard. Navigate to Certificate Upload tab and paste it to field and press Upload button.
In order to check if Active Directory authentication will work go to Test Settings tab and provide domain credentials and press Test Settings.
If test sare passed then Active Directory authentication is configured correctly.:

Directory Server IP Address
Connect to Directory Server
Connect using SSL
Certificate of Directory Server

Next step is to create Directory Groups. The group should reflect Active Directory group created before. In order to create it go to Users/Authentication Directory Groups and create the group. Assign the group to desired bays in the enclosure.
Test if LDAP authentication works.