This video demonstrates how to use IEEE 802.1X protocol,
and HPE iLO DevID for secure onboarding to a network.
Before we start, let us get familiar with a few concepts.
Organizations with remote offices have challenges like data security,
availability of trained personnel at remote offices,
and management of devices at remote locations.
Automation is adopted in most of these areas to overcome these challenges.
The example here shows an unsecured network with no Authenticator
to validate the identity of who accesses the network.
This results in unauthorized users accessing the network
and tampering sensitive information, data theft, and so on.
Let us see how the access control network operates.
Before accessing the network, users connecting
to an access control enabled network must authenticate themselves.
In this example, the switch acts as the Authenticator.
The user attempting to connect to the network
must authenticate to the network before the local switch grants access.
IEEE 802.1X is an authentication mechanism, popularly used in network security.
There's an open standard for port based network access control,
which allows infrastructure devices to control the NN node access to the network.
This standard uses extensible authentication protocol
for message exchange during the authentication process.
HPE iLO now supports IEEE 802.1X protocol
for network access, authentication and authorization.
In this example, the connected iLO must authenticate itself
before the local switch grants access to the network.
Though the n-node device has a valid link to the switch,
the switch will forward only EAP frames from the device to the network.
The Authenticator repackages these frames
from iLO and sends them to an Authentication Server.
The Authentication Server validates these frames and grants access.
To prove identity, IEEE 802.1X protocol, uses secure DevID,
secure DevID are used as interoperable secure device authentication credentials.
HPE servers with HPE iLO support secure DevID, which is unique to every server.
HPE iLO supports IDevID and LDevID.
Your network must have IEEE 802.1X protocol enabled to use HPE iLO IDevID,
and HPE LDevID for authentication.
If IEEE 802.1X protocol is enabled in your network, enable EAP-TLS,
and enroll the HPE CA certificate in the authentication server.
Registered the IDevIDs and configure the ports in the switch.
You can now securely onboard HPE iLO to this IEEE 802.1X enable network.
HPE iLO IDevID’s factory provisioned and signed by HPE certificate authority.
HPE iLO IDevID has lifetime validity, and is immutable.
You must include the IDEV SKU number in your order to instruct the HPE factory
to provision a server with IDevID.
When you power on the server,
HPE iLO uses IEEE 802.1X EAP-TLS authentication
and connects to the network with ZERO touch.
The Secure Onboarding using IDevID is complete.
HPE iLO LDevID is a user defined server identity.
It is unique in the administrative domain in which the server is used.
HPE iLO LDevID helps in facilitating authentication
and authorization of credentials by local network administrators.
To create and import the LDevID,
generate a CSR for LDevID using HPE iLO Redfish API,
send the CSR to Certificate Authority
and import the LDevID certificate into HPE iLO.
After importing, HPE iLO uses LDevID for authentication
in IEEE 802.1X enabled network.
The Secure Onboarding using LDevID is complete.