Users Guide

Configuring IP filtering
In addition to user authentication, use the following options to provide additional security while accessing iDRAC:
● IP filtering limits the IP address range of the clients accessing iDRAC. It compares the IP address of an incoming login to the
specified range and allows iDRAC access only from a management station whose IP address is within the range. All other
login requests are denied.
● When repeated login failures occur from a particular IP address, it prevents the address from logging in to iDRAC for a
preselected time span. If you unsuccessfully log in up to two times, you are allowed to log in again only after 30 seconds. If
you unsuccessfully log in more than two times, you are allowed to log in again only after 60 seconds.
NOTE: This features supports upto 5 IP ranges. You van view / set this feature using RACADM and Redfish.
As login failures accumulate from a specific IP address, they are registered by an internal counter. When the user successfully
logs in, the failure history is cleared and the internal counter is reset.
NOTE: When login attempts are prevented from the client IP address, few SSH clients may display the message: ssh
exchange identification: Connection closed by remote host.
NOTE: If you are using Dell Deployment Toolkit (DTK), see the OpenManage Deployment Toolkit User's Guide available at
https://www.dell.com/openmanagemanuals for the privileges.
Configure IP filtering using iDRAC web interface
You must have Configure privilege to perform these steps.
To configure IP filtering:
1. In iDRAC Web interface, go to iDRAC Settings > Connectivity > Network > Network Settings > Advanced Network
Settings.
The Network page is displayed.
2. Click Advanced Network Settings.
The Network Security page is displayed.
3. Specify the IP filtering settings using IP Range Address and IP Range Subnet Mask.
For more information about the options, see iDRAC Online Help.
4. Click Apply to save the settings.
Federal Information Processing Standards — FIPS is a set of standards used by the United States government agencies
and contractors. FIPS Mode is intended to meet the requirements of FIPS 140-2 level 1. For more information about FIPS,
refer to the FIPS User Guide for iDRAC, and CMC for non MX platforms.
NOTE: Enabling FIPS Mode resets iDRAC to the default settings.
Configuring IP filtering using RACADM
You must have Configure privilege to perform these steps.
To configure IP filtering, use the following RACADM objects in the iDRAC.IPBlocking group:
● RangeEnable
● RangeAddr
● RangeMask
The RangeMask property is applied to both the incoming IP address and to the RangeAddr property. If the results are
identical, the incoming login request is allowed to access iDRAC. Logging in from IP addresses outside this range results in an
error.
NOTE: Configuring IP filtering supports up to 5 IP ranges.
The login proceeds if the following expression equals zero:
RangeMask & (<incoming-IP-address> ^ RangeAddr)
&
Configuring iDRAC
93