User manual SYMANTEC OUT OF BAND MANAGEMENT COMPONENT 7.0 SP3 MR1

[. . . ] AltirisTM Out of Band Management Component from Symantec User Guide Version 7. 0 SP3 MR1 AltirisTM Out of Band Management Component from Symantec User Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Documentation version 7. 0 SP3 MR1 Legal Notice Copyright © 2010 Symantec Corporation. Symantec, the Symantec Logo, Altiris, and any Altiris or Symantec trademarks used in the product are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U. S. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. [. . . ] Default: Intel AMT is always on (S0-S5). Idle timeout Once the Intel AMT device wakes up and the host system is not turned on, this parameter determines the minimum time (in minutes) that the Intel AMT device remains operable when there is no activity. The timeout timer is restarted whenever the device is serving requests. If the value of the parameter is zero (the default value), the device will remain on when there is no activity. For example, the AMT is ON parameter is set to Host is ON (S0) or in Standby (S3). When the platform transitions to S3, the Intel AMT device remains awake until there is no activity for the number of minutes set in the Idle Timeout. Any network access to the Intel AMT device causes it to wake up and restart the timeout timer. If you want to use this parameter, set it to three minutes at a minimum. Setup and configuration profile: Domains tab The Domains tab defines the domains from which an Intel AMT computer can initiate configuration by Intel SCS. Click the Add symbol to add a domain. About Out of Band Management Component pages Configuration Profiles page 39 If you want to allow configuration when the platform has no domain name, check Allow configuration when platform has no domain name. Domains tab: Add New Domain Entry dialog box Use this dialog box to add a domain to the list of domains from which an AMT computer can initiate configuration by Intel SCS. Table 2-13 Option Domain name This domain is a home domain Options on the Add New Domain Entry dialog box Description Type the name of the domain. Checking this has the following effects: CIRA (Remote access): If the Intel AMT computer is not in a home domain, the computer will attempt to use CIRA to connect to the SCS (if CIRA is defined). Wi-Fi: If the Intel AMT computer is in a home domain and no wired connection is available, and the profile does not include Wi-Fi parameters, and the host has connected using Wi-Fi, the Intel AMT computer will use the host's Wi-Fi settings as long as the access point is in one of these domains. FQDN validation Check to validate the Intel AMT devices's FQDN when you modify the configuration properties for an Intel AMT device. Intel SCS checks that the device's FQDN matches one of the domains in the domain list of the profile that is used for setup and configuration. Check to allow configuration (using this profile) of an Intel AMT computer that is located in a sub-domain of the domain that you entered in the Domain Name box. For example, if the domain name is mydomain. com, Intel AMT computers in subdomain. mydomain. com can also be configured. Allow sub-domain Setup and configuration profile: Remote Access tab Intel AMT 4. 0 and later support client-initiated remote access. This feature allows a platform containing Intel AMT located outside an enterprise to connect to management consoles inside the enterprise. The connection is accomplished through a Management Presence Server (MPS) located in the DMZ of the enterprise. The Intel AMT device establishes a Mutual Authentication TLS tunnel with the MPS. Multiple consoles can then interact with the Intel AMT device through the tunnel. 40 About Out of Band Management Component pages DNS configuration page For remote access to work, you must configure the Intel AMT platform when the platform is inside the enterprise. You must configure the platform with the information needed to connect with the MPS. A remote access policy contains the parameters that determine the conditions for establishing an MPS connection. The policy also contains the connection parameters to either one or two MPSs. The MPS connection parameters are defined separately. DNS configuration page The computer with Intel SCS installed (the OOB site server computer) must be registered in DNS as ProvisionServer. [. . . ] In mutual authentication, the server also requests a certificate from the client. The Symantec Management Platform service that communicates with the Altiris Agent and the CMDB to provide management, security, and administrative functionality. It processes events, facilitates communications with managed computers, and coordinates the work of the other Symantec Management Platform services. It lets IT administrators connect to a computer's management controller when the computer is turned off, in sleep or hibernate modes, or otherwise unresponsive through the operating system. [. . . ]