Hub network
Review these network considerations to help you set up the network in your datacenter to use XClarity One Hub.
To configure network settings, click Network on the context menu from the Administration view.
Network interfaces
XClarity One Hub supports multiple network interfaces for device management and external services (portal and optionally Internet) communication.
Review the following considerations before configuring the network.
The hub communicates with the portal and optionally the Internet only on the main network (eth0) with one and only one gateway. Only eth0 has a gateway IP address.
If you have devices on private networks, you can integrate those networks by adding additional interfaces to the hub. These interfaces can be used exclusively for communication with devices on the private networks.
The hub can communicate with devices on the main network, additional networks, or both.
When connecting to XClarity One in the cloud, the network interface must be connected to the Internet, preferably through a firewall.
Send automatic problem notification through Call Home
Retrieve service ticket status and history
Retrieve device warranty
Update the firmware catalog and download firmware packages directly from the web (Note that firmware packages can be manually imported.)
Download portal and hub updates directly from the web (Note that updates can be manually imported.)
Perform firmware CVE analysis
IPv4 address settings
XClarity One Hub uses IPv4 network settings. You can configure the IP assignment method, IPv4 address, subnet mask, and default gateway.
For the IP assignment method, you can choose to use a statically-assigned IP address or obtain an IP address from a Dynamic Host Configuration Protocol (DHCP) server. When using a static IP address, you must provide an IP address, subnet mask, and default gateway. The default gateway must be a valid IP address and must be on the same subnet as the network interface.
If DHCP is used to obtain an IP address, the default gateway also uses DHCP.
You can enable or disable an additional network and configure its IP assignment method, IPv4 address, and subnet mask.
- Network address translation (NAT), which remaps one IP address space into another, is not supported.
- Changing the IP address of the XClarity One Hub virtual-appliance after the hub is up and running will cause connectivity issues with the XClarity One portal and all managed devices. If you need to change the IP address, disconnect hub from the portal, and unmanage all managed devices before changing the IP address. After the IP address change is complete, reconnect hub to the portal and re-manage the devices.
- If the network interface is configured to use the DHCP, ensure that IP address changes are minimized by basing the DHCP address on a MAC address or configuring DHCP so that the lease does not expire to avoid communication issues. If the IP address changes when the DHCP lease expires, you must disconnect (delete) the hub from the portal, and then connect it again.
DNS settings
XClarity One Hub uses IPv4 network settings. You can configure the IP assignment method, up to two static DNS IPv4 addresses, and custom host name and domain.
For the IP assignment method, you can choose to use a statically-assigned IP address or obtain an IP address from a DHCP server. When using a static IP address, you must provide an IP address for at least one and up to two DNS servers.
Specify the DNS host name and domain name. You can choose to retrieve the domain name from a DHCP server or specify a custom domain name.
Web proxy settings
When the hub is connected to XClarity One in the cloud, you can optionally configure the hub to use an HTTP web proxy when direct access to the Internet is not available. The web proxy is used to communicate with the portal and to download firmware packages from support.lenovo.com.
When the hub is connected to XClarity One on premises, a web proxy is not needed to communicate with portal or to download firmware packages. In this configuration, the portal downloads firmware packages , and the hub retrieves the packages from the portal. The hub does not download firmware packages directly from support.lenovo.com.
Ensure that you use HTTP2.
Ensure that the proxy server is set up as a non-terminating proxy.
Ensure that the proxy server is set up as a forwarding proxy.
Ensure that load balancers are configured to keep sessions with one proxy server and not switch between them.
After the web proxy is enabled, you can test the connection to the proxy server by clicking Test connection. Enter any hostname or IP address to test the connection between hub and that host. By default, supportapi.lenovo.com is used to test the configuration, which is the hostname used for Call Home.
Firewalls
No inbound firewall rules are needed.
Ensure that the following outbound connections are open on the firewall for XClarity One and hubs. Each DNS represents a geographically distributed system with a dynamic IP address.
| DNS name | Ports | Protocols | Description |
|---|---|---|---|
| xclarityone.lenovo.com | 443 | HTTPS | Connect to the portal in the cloud for both the WebSocket (continuous) and the REST API (on demand) connections. |
| hub.idp.xclarityone.lenovo.com | 443 | HTTPS | Authenticate with the portal in the cloud |
| hub.xclarityone.lenovo.com | 443 | HTTPS | Make requests to the portal in the cloud |
| idp.xclarityone.lenovo.com | 443 | HTTPS | Connect to the identity provider in the portal |
| download.lenovo.com | 443 | HTTPS | Download update packages |
| support.lenovo.com | 443 | HTTPS | Retrieve firmware catalog information from Lenovo |
Open ports
Ensure that the required ports are open on the network.
Ensure that all required ports involved with communications between the XClarity One portal, hubs and service are open.
When the hub is connected toXClarity One in the cloud, the hub accesses Lenovo cloud services to download hub and firmware updates.
When the hub is connected to XClarity One on premises, the hub does not access Lenovo cloud services. Instead, the on-premises portal connects to the Lenovo cloud services to download hub and firmware updates and then pushes those updates to the hubs. For more information about ports that need to be open on the network for portal management (including Lenvo cloud services), see Portal network.
Figure 1. Hub connected to XClarity One in the cloudFigure 2. Hub connected to XClarity One on premises
Zone Direction Ports Description A (Inbound) Web browser to hub HTTPS – TCP on port 443 This port is used by the web browser to communicate with the hub web server. HTTPS – TCP on port 8443 This port is used to access the dedicated XClarity One Hub Service Support Center web server to collect and download portal service data if the hub becomes unresponsive and cannot be recovered. If blocked, you will need to unblock the port to access the web server and collect the service data if the hub becomes unresponsive. B (Outbound) Hub to the on-premises basic services DNS – UDP on port 53 This port is used to interrogate the DNS server to resolve FQDN. This port must be open only when the hub is configured to use a DNS server. DHCP – UDP on port 68 This port is used to communicate with the DHCP server to retrieve IPv4 addresses. This port must be open when DHCP is used to obtain IP addresses. NTP – UDP on port 123 This port is used to interrogate the NTP server to synchronize the VM time. C (Outbound) Hub to the web proxy HTTP – TCP This port is used to communicate with the XClarity One portal, Lenovo cloud services, and other basic services through a web proxy when direct access to the Internet is not available. This port must be open only when the hub is configured to use an HTTP web proxy. A web proxy is not needed when connected to XClarity One on premises.
D (Outbound) Hub to the XClarity One portal HTTPS – TCP on port 443 This port is used to communicate with the XClarity One web server and to push information in the XClarity One portal for management purposes. E (Outbound) Hub to the Lenovo cloud services HTTPS – TCP on port 443 This port is used to communicate with the Lenovo cloud services to download hub/firmware metadata and updates from the Internet. This port must be open only when the hub is connected to XClarity One in the cloud. If using a web proxy, Lenovo cloud services are accessed through the proxy.
Ensure that all required ports involved with communications between the hub and managed devices are open.
Zone Direction Ports Description Servers A (Inbound) XCCs to the hub HTTPS – TCP on port 443 This port is used by managed servers to communicate with the hub web server and to push information to the hub, including events and metrics. Samba service – TCP on port 445 This port is used to initiate the connection between the managed device and the hub for transferring Windows OS images. If blocked, you cannot deploy the Windows operating system to your devices. SSDP – UDP on ports 32768 - 65535 These ports are used to receive SSDP discovery responses from devices in the same IP subnet as the hub. If blocked, you must manually discover devices through port 443. B (Outbound) Hub to XCCs SFTP – TCP on port 115 This port is used by the hub to push firmware packages to the management controller. If blocked, you cannot update firmware on your managed servers. HTTPS – TCP on port 443 This port is used to exchange data between the managed servers or OSs and the hub, including payloads and status. OS deployment – TCP on port 445 This port is used to transfer Windows OS images to managed servers. If blocked, you cannot deploy an OS to your managed servers. SSDP discovery – UDP on port 1900 These ports are used to automatically discover servers in the same IP subnet as the hub using a multicast channel, where the servers are informing the hub about their presence. If blocked, you must manually discover servers through port 443. Firmware updates – TCP on port 6990 This port is used to apply firmware updates to servers. If blocked, you cannot update firmware on your managed servers. Storage A (Inbound) Devices to the hub HTTPS – TCP on port 443 This port is used by managed storage devices to communicate with the hub web server and to push information to the hub, including events and metrics. B (Outbound) Hub to devices HTTPS – TCP on port 443 This port is used to exchange data between the managed storage devices or OSs and the hub, including payloads and status.
