Advanced topics > Making HP SUM network ports available

  

 next

Making HP SUM network ports available

HP SUM requires that certain network ports are available. If you lock down network ports, make sure that the ports listed in the network port tables are open so that HP SUM works correctly when connecting to remote node servers and hosts. If you are unable to unlock these network ports, you must run HP SUM locally and update network-based hosts through their web interfaces (for example, the OA, iLO, and VC modules).
[NOTE: ]

NOTE: Use the open_firewall parameter for HP SUM to automatically open the required firewall ports on the local host and any remote servers.

Updates for most node types require network traffic in both directions between the server running HP SUM and the node. The server running HP SUM creates a local HTTP server, which is used to serve firmware binaries to the node and to communicate node status. The remote node issues HTTP requests and posts status updates to the server running HP SUM during the update process. If there is a routing problem or firewall blocking traffic back from the remote node to the system running HP SUM, firmware updates might be blocked, status updates blocked or delayed, or both.

HP SUM Windows network ports

Ports Description Direction

Port 22

Establishes a connection to a remote node via SSH to perform node inventory.

 To remote node

Port 443

A secure data port used to transfer information.

 To remote node

Ports 445 and 137/138/139 (Port 137 is used only if you are using NetBIOS naming service.)

Connects to the remote ADMIN$ share on node servers. These are the standard ports Windows servers use to connect to the remote file shares. If you can connect remotely to a remote Windows file share on the node server, you have the correct ports open.

 To remote node

Port 5989

This port is used for VMware WBEM discovery. Make sure this port is not blocked on the VMware ESXi or VMware vSphere host.

 To remote node

Ports 63001–63002

Updates are passed to the node and retrieved through an internal web server that runs by default on port 63001 for local host HTTP traffic and port 63002 for local and remote secure HTTPs traffic. This allows iLO and VC firmware updates without having to access the host server. It also allows the servers running VMware or other virtualization platforms to update the iLO firmware without requiring a server reboot or a migration of the virtual machines to other servers.

Remote HP Integrity iLO and Superdome 2/X updates require these ports to be open on systems for network traffic in both directions to transfer firmware files.

 To remote node and from remote node

Ports 21 or 63006–63010

You can use these FTP ports to perform switch updates.

 From remote node

HP SUM Linux network ports

Ports Description Direction

Port 22

Establishes a connection to a remote node via SSH to perform node inventory.

 To remote node

Port 443

A secure data port used to transfer information.

 To remote node

Port 5989

This port is used for VMware WBEM discovery. Make sure this port is not blocked on the VMware ESXi or VMware vSphere host.

 To remote node

Ports 63001–63002

Updates are passed to the node and retrieved through an internal web server that runs by default on port 63001 for local host HTTP traffic and port 63002 for local and remote secure HTTPs traffic. This support allows iLO and VC firmware updates without having to access the host server. It also allows servers running VMware or other virtualization platforms to update their iLO without having to reboot their server or to migrate their virtual machines to other servers.

Remote HP Integrity iLO and Superdome 2/X updates require these ports to be open on systems for network traffic in both directions to transfer firmware files.

 To remote node and from remote node

Ports 21 or 63006–63010

You can use these FTP ports to perform switch updates.

 From remote node
[NOTE: ]

NOTE: HP SUM 6.0.0 and later supports /port and /ssl_port options, which allow you to use ports other than 63001 and 63002. Use these options to avoid conflicts with firewalls. HP SUM supports --open_firewall on Linux systems only. HP SUM uses the iptables command to open the HTTP and HTTPS ports used by HP SUM for external access. Open these ports for remote node functionality and for remote browser access. For example:

hpsum /port 80 /ssl_port 443

Beginning with HP SUM 6.3.0, you can use the command /ftp_port to assign which port to use for FTP service. By default FTP port is disabled. Use the command to enable the service.

Changing the port address in the hpsum.ini file

You can change the network ports HP SUM uses by editing the hpsum.ini file or using the /port or /ssl_port CLI parameters. For more information on editing the hpsum.ini file, see Changing the hpsum.ini file.For more information on using HP SUM CLI mode, see HP Smart Update Manager CLI Guide.

The following commonly used alternate network ports are:

  • port=63001 edit to port=80

  • ssl_port=63002 edit to ssl_port=443

Enabling HP SUM ports for VMware nodes

By default, outgoing connections are blocked in VMware servers, except ports 80, 443, and 5989. Use the following steps to enable the default ports of 63001 and 63002. You need to enable these outgoing ports on the VMware server.

  1. Create an HTTP HP SUM firewall rule that enables outgoing connection via port 63001.

  2. Create the file httpSUM.xml in the /etc/vmware/firewall directory. Type the following into the file:

    /etc/vmware/firewall # cat httpHPSUM.xml

    <!-- Firewall configuration information for FDM -->

    <ConfigRoot>

    <service id='0000'>

    <id>httpHPSUM</id>

    <rule id='0000'>

    <direction>outbound</direction>

    <protocol>tcp</protocol>

    <porttype>dst</porttype>

    <port>63001</port>

    </rule>

    <enabled>true</enabled>

    <required>false</required>

    </service>

    </ConfigRoot>

  3. Refresh by using the command, esxcli network firewall refresh.

  4. Repeat the steps for port 63002.

Special network configuration note for HP Integrity servers

HP Integrity servers have management network and production interfaces. These are typically kept on separate subnets in an installation. To perform full remote administration of the server, access is required for both networks. If you keep both networks isolated, you need to perform management and operating systems tasks separately.

prev

 

up

 next

Configuring IPv6 networks 

home

 GatherLogs

Copyright © 2009, 2015 Hewlett-Packard Development Company, L.P.