IDRAC 6 Express unable to authenticate

authenticationdelldell-poweredgedrac

I recently tried to use a Dell iDRAC 6 Express for the first time on a PowerEdge T310. I logged in using the default username and password and clicked around a few of the screens. Suddely the login prompt came back and now it will not accept the default login credentials. I'm pretty sure I didn't change any settings, so I'm not sure why it will not let me log in.

Any suggestions? In case I did change the password unwittingly somehow (though I'm pretty sure I didn't), would there be a way to reset it?

Best Answer

You should be able to reset the iDRAC Express from within the Setup (BIOS).

Just an FYI for others: I learned (rather painfully) that the iDRAC Express does not have remote console functionality, you can only manage power (reboot, power on/off, etc.) as well as monitor fans, temperatures, and a few other features.

Related Solutions

IDRAC Enterprise vs iDRAC Express on Dell Server

The short answer to this is, no. Unfortunately, you need the remote console capability to do this and that feature is only offered with the iDRAC Enterprise. You can only monitor your system (and perhaps do power control) with the Express version.

You can, however, purchase the riser card from Dell to upgrade your Express to Enterprise. We accidentally ordered our R710s with Express and had to buy the cards after-the-fact.

Security – Restrict IPMI access on Dell BMC and iDRAC to an allowed IP range

If you have switched environment and you need to restrict access to IPMI, the way to do it is to make ACL policy on the core switch, so this way you can restrict access from particular networks to this subnet or service. You can use only INPUT chain to do this, for example, if your IPMI is on 192.168.110.0/24 VLAN1 and your Desktop is on 10.0.0.0/24 VLAN2 and isolated LAN on 10.0.1.0/24 VLAN3, you can setup rule as on below example. However, if you want to restrict it on the same subnet, it is not done and cannot be done this way, the restricted client must be on different LAN (routable ip range).

So simply, on the core switch you can load the policy and specify

#Allow Broadcast
From Any To ff:ff:ff:ff:ff:ff Permit

#Allow Multicast
From Any To 224.0.0.0/4 Permit

#Anti-spoofing rules
From 192.168.110.0/24 to 0.0.0.0/0 VLAN1 Permit
From 0.0.0.0/0 to 192.168.110.0/24 VLAN1 Permit
From 10.0.0.0/24 to 0.0.0.0/0 VLAN2 Permit
From 0.0.0.0/0 to 10.0.0.0/24 VLAN2 Permit
From 10.0.1.0/24 to 0.0.0.0/0 VLAN3 Permit
From 0.0.0.0/0 to 10.0.1.0/24 VLAN3 Permit

#Permit IPMI from VLAN2
#You can narrow this rule to allow IPMI only
From 10.0.0.0/24 to 192.168.110.0/24 Permit
From 192.168.110.0/24 to 10.0.0.0/24 Permit

#Allow VLAN3 to VLAN1
From 10.0.1.0/24 to 10.0.0.0/24 Permit
From 10.0.0.0/24 to 10.0.1.0/24 Permit

#Block any other VLAN to VLAN communication, and allow internet browsing for VLAN3 (destination 0.0.0.0/0)
From 10.0.0.0/8 to 10.0.0.0/8 Deny
From 192.168.0.0/16 to 192.168.0.0/16 Deny
From 10.0.0.0/8 to 192.168.0.0/16 Deny
From 192.168.0.0/16 to 10.0.0.0/8 Deny

From 10.0.1.0/24 to 0.0.0.0/0 Permit
From 0.0.0.0/0 to 10.0.1.0/24 Permit

From 0.0.0.0/0 to 0.0.0.0/0 Deny

ps. Your core switch (router forwarding between VLANs) definitely supports this kind of ACL.

Best Answer

Related Solutions

IDRAC Enterprise vs iDRAC Express on Dell Server

Security – Restrict IPMI access on Dell BMC and iDRAC to an allowed IP range

Related Topic