2

We have managed Supermicro servers in the past which have independent IPMI/BMC network interfaces. These IPMI interfaces are all connected to separate VLANS. With those servers the operating system has no connectivity to the IPMI/BMC interface, and we were never able to connect to devices on the management/IPMI VLAN, which is to be expected behavior.

Now we are deploying a pilot project with Supermicro MicroBlade servers on 628E enclosures and to our surprise the Operating System is able to connect/PING any other device connected on the IPMI/BMC LAN. This would allow any client access to a sensitive and restricted LAN.

The Supermicro MBI-6219G-T blades have access to all IP hosts connected on the IPMI VLAN. We can PING all hosts from the Operating System. Even though LAN1 and LAN2 interfaces are connected to a different subnet/VLAN. How can the OS have access to the IPMI interface? This is a serious security vulnerability for our public cloud hosting service provider environment.

According to this document from Supermicro, our understanding is that the IPMI interfaces are connected to the Management Module (MBM-CMM-001) Switch (SW) which is isolated from the LAN1 and LAN2 interfaces connected to the separate switch modules on the chassis (MBM-GEM-001). Per this phisical separation there should be no access to the IPMI from the OS. This is the first time we see this, and we work with hundreds of Supermicro servers.

These blades are connected to the following management module:

Model: MBM-CMM-001

CMM Firmware Revision : 03.61

Mgmt Switch FW Revision : 02.03

LAN1 and LAN2 interfaces are connected to the Switch Module:

Model: MBM-GEM-001

FW: PG1_1.0.1-12

Any assistance will be greatly appreciated.

Thank you,

0

You must log in to answer this question.

Browse other questions tagged .