3 ms·
In tiny deployments, use a cheap dumb gigabit switch to connect up all the BMCs to your firewall. Give them a separate DHCP assigned subnet and allow access to
by dsr_ 7y ago
In tiny deployments, use a cheap dumb gigabit switch to connect up all the BMCs to your firewall. Give them a separate DHCP assigned subnet and allow access to it only from your management machine.
In larger deployments, you should have separate management networks anyway.
It's not that SuperMicro has the worst BMC. It's that all BMCs/IPMI/iLO/iDRAC are terrible at security, so you need to treat them just like console ports,
- kbenson 7y agoI think the large problem alluded to (if true), is that if DHCP fails it may switch which NIC it shares with as well. That problematic for many reasons, and many of them are still problems if you separate it to a different network. You generally don't expect a DHCP server going down somewhere, possibly in a side-network where it may not be noticed, to cause a management system to open up on a server's publicly connected NIC when it reboots (man, I hope it requires a reboot!). That renders all your careful segregation of your control network completely useless with one service failure and a reboot. Sucks to be you if that DHCP server is on the same circuit as some other servers and they all power cycle at once, because I bet the BMC tries to DHCP an address before the DHCP server boots entirely. To me, it seems like a very poor default behavior. I can see the benefit if you know what you're doing and want to enable it though.