User manual SYMANTEC ALTIRIS OUT OF BAND MANAGEMENT COMPONENT 7.0 SP3 IMPLEMENTATION GUIDE V1.0

[. . . ] AltirisTM Out of Band Management Component from Symantec Implementation Guide Version 7. 0 SP3 MR1 AltirisTM Out of Band Management Component from Symantec Implementation Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Documentation version 7. 0 SP3 MR1 Legal Notice Copyright © 2010 Symantec Corporation. Symantec, the Symantec Logo, Altiris, and any Altiris or Symantec trademarks used in the product are trademarks or registered trademarks of Symantec Corporation or its affiliates in the U. S. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. [. . . ] See "Configuring TLS with mutual authentication" on page 100. Configuring TLS When you set up and configure an Intel AMT computer with TLS, Intel SCS accesses the trusted certification authority (CA), enrolls for certificate on behalf of each Intel AMT device, and then installs the certificate into the Intel AMT device. Table 7-1 Step Step 1 Process for configuring TLS Action Meet the requirements for TLS. Description Specific operating system and infrastructure requirements must be met. See "About environment requirements" on page 32. Step 2 Install Microsoft certification CA issues certificates to Intel AMT authority (CA), if it is not already devices. You need this certificate if you want to use the SOL/IDE-R functionality of Intel AMT. See "Exporting the CA Root Certificate for the Altiris Real-Time System Manager software" on page 97. Step 4 Step 5 Configure connection profiles to use the secure mode. Altiris solutions use this connection profile to connect to the Intel AMT devices that are configured in secure mode. See "Configuring the connection profile to use TLS" on page 97. Step 6 Configure Intel AMT computers to use TLS. After this step, the computers can be managed in secure mode only. See "Configuring Intel AMT computers to use TLS" on page 98. Configuring TLS Configuring TLS 97 Exporting the CA Root Certificate for the Altiris Real-Time System Manager software (Optional) To use the SOL/IDE-R functionality of Intel AMT with Real-Time System Manager, you must export the CA root certificate to a file, and then configure the connection profile to use this file. This certificate is used to validate the authenticity of the managed Intel AMT computer and the Notification Server computer during SOL and IDE-R communication. You can obtain the CA root certificate in the following ways: Export the CA root certificate from the Local computer certificate store. Download the CA certificate from the CA computer using the certificate services Web site (http://<ca_server_name>/certsrv/). See "Configuring TLS" on page 96. To export the CA root certificate 1 2 3 4 5 6 7 8 9 On the CA computer, click Start > Run. In the Microsoft Management Console, click File > Add/Remove Snap-in. In the Microsoft Management Console tree, locate your CA root certificate in the Trusted Root Certification Authorities folder, and then open the certificate. 10 Click the Details tab. 12 Use the wizard to export the certificate in the Base-64 encoded X. 509 format. Configuring the connection profile to use TLS You must configure the connection profile to use secure mode for communications with Intel AMT computers. 98 Configuring TLS Configuring TLS If you want to use the SOL/IDE-R functionality, you must configure the connection profile with the trusted root CA certificate that you exported. See "Exporting the CA Root Certificate for the Altiris Real-Time System Manager software" on page 97. This certificate is used to validate the authenticity of the managed AMT computer and the Notification Server computer during SOL and IDE-R sessions. For more information on connection profiles, see the Symantec Management Platform Help. To configure the connection profile to use TLS 1 2 3 4 5 6 In the Symantec Management Console, on the Settings menu, click All Settings. In the left pane, click Monitoring and Alerting > Protocol Management > Connection Profiles > Manage Connection Profiles. Click the connection profile that you use to connect to Intel AMT computers with Real-Time System Manager, and then click the Edit symbol. If you want to use the SOL/IDE-R functionality, in the Trusted CA certificate location box, click Browse and browse to the CA certificate that you exported earlier. See "Exporting the CA Root Certificate for the Altiris Real-Time System Manager software" on page 97. Configuring Intel AMT computers to use TLS Now you can modify one of the existing configuration profiles to use TLS, and then reconfigure your Intel AMT computers. [. . . ] Six power states exist that range from S0 (the system is powered on and fully operational) to S5 (the system is powered off). A shared secret that was previously shared between the two parties using some secure channel before it needs to be used. Notification Server out-of-band management permissions PET (Platform Event Trap) policy power state PSK (Pre-Shared Key) An environment to start computers using a network interface independently of Execution Environment) available data storage devices (like hard disks) or installed operating systems. An administrator can load operating systems and other software onto the device from a server over the network. PXE Boot (Pre-Boot resource Any item that Notification Server can track or manage, such as a user, site, installed application, computer, switch, router, or handheld device. 188 Glossary Resource Manager A feature that displays information about a resource, such as its properties and current state. It also lets you troubleshoot and perform actions on managed resources. [. . . ]