Systems and methods for provisioning, configuring, diagnosing, and maintaining out-of band management of computing devices
Systems and methods of the present disclosure facilitate provisioning an out-of-band system. In some embodiments, the system includes a server of a first domain, which includes a management engine. The management engine can establish a network tunnel with a device on a second domain, and modify the domain on a DHCP server on the second domain to be the first domain. The device can use a fixed subdomain of the first domain to transmit a provisioning request for an OOB management system to a provisioning engine in the first domain, which can transmit a certificate including the first domain to the device. The device can validate the certificate by comparing the domain in the certificate to the domain from the DHCP server and verify that they match. The management engine can modify the DHCP server to have the original second domain.
1. A method of provisioning an out-of-band system comprising:
establishing, by a management engine of a server of a first domain, a network tunnel with a device on a second domain different from the first domain, the network tunnel comprising at least one of a virtual private network (“VPN”) or a secure socket shell (“SSH”) configured to route one or more communication ports of the device for provisioning;
modifying, by the management engine subsequent to establishing the network tunnel, via a dynamic host configuration protocol (“DHCP”) server on the second domain, the second domain to a modified domain including a fixed subdomain of the first domain, the fixed subdomain corresponding to a provisioning engine of the first domain;
receiving, by the provisioning engine from the device via the network tunnel established by the server of the first domain, responsive to the device obtaining the fixed subdomain of the first domain from the DHCP server, a provisioning request to initiate a provisioning cycle comprising at least one of configuring the device, diagnosing the device, or maintaining the device;
transmitting, by the provisioning engine to the device via the network tunnel established by the server of the first domain, a certificate configured with the first domain, the device configured to validate the certificate based on the certificate matching the modified domain obtained from the DHCP server;
reverting, by the management engine, responsive to completion of the provisioning cycle by the device, the modified domain to the second domain; and
terminating, by the management engine, responsive to reverting the modified domain to the second domain and the completion of the provisioning cycle, the network tunnel comprising the at least one of the VPN or the SSH established by the server of the first domain and used to provision the device.
2. The method of claim 1 , further comprising:
transmitting, by the management engine, a command to a module of the device to establish the network tunnel.
3. The method of claim 1 , further comprising:
providing, to the device, an address of the provisioning engine associated with the fixed subdomain of the first domain.
4. The method of claim 1 , further comprising:
receiving, by the DHCP server from the device, a DHCP request; and
transmitting, by the DHCP server to the device responsive to the DHCP request, the first domain.
5. The method of claim 1 , wherein establishing the network tunnel further comprises:
establishing, by the management engine, an Internet Protocol tunnel.
6. The method of claim 1 , further comprising:
using secure sockets layer (“SSL”) to establish the network tunnel.
7. The method of claim 1 , further comprising:
receiving, by the provisioning engine, the certificate configured with the first domain from a vendor provisioning server on a third domain different from the first domain and the second domain.
8. The method of claim 1 , further comprising:
receiving, by the management engine from the device, a confirmation of provisioning.
9. The method of claim 1 , further comprising:
validating, by the device, the provisioning engine responsive to the matching certificate.
10. A system for provisioning an out-of-band system comprising:
a server of a first domain including a processor and memory;
a management engine of the server that establishes a network tunnel with a device on a second domain different from the first domain, the network tunnel comprising at least one of a virtual private network (“VPN”) or a secure socket shell (“SSH”) configured to route one or more communication ports of the device for provisioning;
the management engine modifies, subsequent to establishing the network tunnel, via a dynamic host configuration protocol (“DHCP”) server on the second domain, the second domain to a modified domain including a fixed subdomain of the first domain, the fixed subdomain corresponding to a provisioning engine of the first domain;
the provisioning engine of the first domain that receives, from the device via the network tunnel established by the server of the first domain, responsive to the device obtaining the fixed subdomain of the first domain from the DHCP server, a provisioning request to initiate a provisioning cycle comprising at least one of configuring the device, diagnosing the device, or maintaining the device;
the provisioning engine transmits, to the device via the network tunnel established by the server of the first domain, a certificate configured with the first domain, the device configured to validate the certificate based on the certificate matching the modified domain obtained from the DHCP server;
the management engine reverts, responsive to completion of a provisioning cycle by the device, the modified domain to the second domain; and
the management engine terminates, responsive to reverting the modified domain to the second domain and the completion of the provisioning cycle, the network tunnel comprising the at least one of the VPN or the SSH established by the server of the first domain and used to provision the device.
11. The system of claim 10 , wherein the server is further configured to:
transmit a command to a module of the device to establish the network tunnel.
12. The system of claim 10 , wherein the server is further configured to:
provide, to the device, an address of the provisioning engine associated with the fixed subdomain of the first domain.
13. The system of claim 10 , wherein the DHCP server is further configured to:
receive, from the device, a DHCP request; and
transmit, to the device responsive to the DHCP request, the first domain.
14. The system of claim 10 , wherein the management engine is further configured to:
establish an Internet Protocol tunnel.
15. The system of claim 10 , wherein the management engine is further configured to:
use secure sockets layer (“SSL”) to establish the network tunnel.
16. The system of claim 10 , wherein the provisioning engine is further configured to:
receive the certificate configured with the first domain from a vendor provisioning server on a third domain different from the first domain and the second domain.
17. The system of claim 10 , wherein the management engine is further configured to:
receive, from the device, a confirmation of provisioning.
18. The system of claim 10 , wherein the device is further configured to:
validate the provisioning engine responsive to the matching certificate.