O365 + HPE iLO 4 AlertMail (How to)

[Michael]

Hi all,

 

Case scenario - HPE iLO 4 (even the latest 2.80 firmware) does not support SMTPs, SSL/TLS or authentication of any kind, whereas iLO 5 does out the box. Here's how to get AlertMails working on iLO 4 -

 

 

As per the screenshot, configure settings as -

 

Email Address: [email protected]
Sender Domain: school.bham.sch.uk
SMTP Port: 25
SMTP Server: school-bham-sch-uk.mail.protection.outlook.com

 

On your firewall allow the following on your SMTP outbound rule -

 

SMTP, in addition to SMTPs (which is most likely already enabled)

Add the FQDN: school-bham-sch-uk.mail.protection.outlook.com

 

Amend your SFP record in DNS and specify your school's public IP -

 

v=spf1 include:spf.protection.outlook.com ip4:xx.xxx.xx.xxx -all

 

Wait for DNS to replicate (10 mins+), then try an AlertMail test from iLO 4.

 

I hope this helps someone else in the age of email security and older applications/devices not supporting these requirements

[Domino]

Couple of things here, if that outbound IP is a single NAT for the network, you're essentially allowing anything that can speak out on 25 on that IP to be accepted as long as the email address is valid. Might never be a problem, but worth keeping in mind if there's any enterprising young hacker types on site.

 

Secondly, if you've multiple devices like this, setting up an internal IIS SMTP Relay to accept the mails, and then using the above config to have that send them on to 365 could be better. You can send via TLS (even if the source sends to the internal relay unencrypted) and not have the ILO IPs in a zone with any internet access at all (which is my preference).

[Michael]

All your points are valid, but I think a lot depends how you configure your FW rule.

 

Port 25 should only resolve to the outbound FQDN list as specified in your FW rule. It also depends whether the whole LAN or just the iLO IPs are specified to narrow down the scope.

 

I appreciate it's a medium risk, but I've previously tried relays which were hit and miss.

[Davit2005]

Couple of things here, if that outbound IP is a single NAT for the network, you're essentially allowing anything that can speak out on 25 on that IP to be accepted as long as the email address is valid. Might never be a problem, but worth keeping in mind if there's any enterprising young hacker types on site.

 

Secondly, if you've multiple devices like this, setting up an internal IIS SMTP Relay to accept the mails, and then using the above config to have that send them on to 365 could be better. You can send via TLS (even if the source sends to the internal relay unencrypted) and not have the ILO IPs in a zone with any internet access at all (which is my preference).

 

Could always limit the source IP on the firewall to overcome this :-)

Edited May 27, 2022 by Davit2005

[Domino]

Of course, there are things you could do to limit exposure, but it needs thinking about.

 

The benefit of having an internal relay, aside from enabling TLS for the delivery over the internet, is the rule needs configuring only once regardless of how many additional devices you need to setup.

 

Pays your money, takes your choice.

Edited May 27, 2022 by Domino

[Davit2005]

Depends, you might like to configure so only devices that need to use the relay can. This might be a good way to keep track of where you have used the relay settings too