Intel vPro Expert Center Blog

Follow-up post on CIRA - we have Lift-Off...

tal.elgar@intel.com — Thu, 19 Nov 2009 16:47:34 GMT

If you're reading this blog posting, hopefully you've read my blog post on CIRA last week -

http://communities.intel.com/community/openportit/vproexpert/blog/2009/11/10/cira-and-fast-call-for-help--what-is-it-where-can-i-find-it

Firstly, I wanted to share with you that over the past week we have actually worked through an entire end to end setup with a real-world customer (i.e. not just inside Intel labs) and now we have CIRA and AMT functionality over CIRA working successfully!

If you're wondering which of the management consoles and MPS/vPro Gateways were used - it was LANDesk 8.8 SP3 in this case (remember that LANDesk bundle their own MPS/vPro Gateway offering). If you're looking to get this to work in your environment (CIRA with LANDesk specifically) please do get in touch and I can share some specific current LANDesk pointers with you (that are not mentioned in this blog posting).

Some of the things we came across last week which are good pointers to pay attention to:

There are 4 ports that get configured with the MPS which are fully configurable (i.e. they are not restricted to being a specific port number) - however, you cannot re-use the same port number, you need to have 4 distinct port numbers (sounds trivial, but it happens).
You can use port 16993 as one of the port numbers, even though that is the port that is used for https connections in AMT (there is no conflict)
In the httpd.conf file - instead of havinga deny all and allow specific IP addresses, you might want to change to allow all
CIRA relies on the DHCP option 15 that is allocated where the vPro client is to be different than what it was pre-configured with - that is how the system knows it is outside the corporate environment. If DHCP option 15 happens to be blank where your vPro clients connect from - that is good enough. Blank is considered different and CIRA works fine.
Currently, you should install the LANDesk agent after provisioning is completed
Check through selecting the 'vPro Status' operation on a provisioned vPro client to ensure all the LANDesk NED settings have been deposited properly on the vPro client prior to taking it out of the corporate environment.

Btw, the CIRA connection is established through a user click at the OS-level using the IMSS utility.

So the bottom line is we now have close to 100 systems that are confirmed to be have full AMT functionality working over a CIRA connection in a real live environment - it works! (

The 2nd part of the blog can be considered a more 'advanced topic' and is devoted to what happens if your management console of choice doesn't currently support CIRA...

One Management Console for example that is currently not supporting CIRA is Microsoft SCCM (even with SP2).

The options as I see them, are:

Contact your software vendor and ask them whether they support Intel - Intel works with multiple software vendors on incorporating support for various Intel vPro features (CIRA amongst others) - they can hear it from us, but it is much better if they hear it from you.
Your software vendor might have plans to introduce support for CIRA, however it is further down the line - so it is just a question of time.
Try and engineer something yourself to have CIRA work in the environment you have setup

At least for testing your environment for what CIRA would look like, you could leverage the WebUI tool. You would need to have an MPS installed and configured first of all. Thereafter, all that you need to do is configure the proxy settings in the web-browser you are using to the IP address/FQDN of where you have your MPS installed and also enter the default http proxy port of 8080 - that will be sufficient for getting your WebUI to work over a CIRA connection.

If you use Microsoft Internet Explorer you are limited only to the http proxy portion which will allow several of the AMT operations to work over a CIRA connection, but not SOL/IDER for example.

If you are using Mozilla Fire Fox for example, you can configure a SOCKS proxy as well, which can handle routing SOL/IDER traffic as well.

If we take the example of Microsoft SCCM, what you can do is to use the scripting framework that has been used successfully for something like: providing out of band 802.1x in Microsoft SCCM SP1 (it is natively supported now in SP2) - http://communities.intel.com/message/10877

You can configure the correct settings for the vPro client to be able to contact the MPS Proxy Server and establish a CIRA connection between the MPS Server and the vPro client, however you will still need your management console to integrate and be aware of this CIRA connection to be able to do something useful.

What you could do at this point is to configure a 'transparent proxy' - what that would typically entail is to configure the MPS IP address/FQDN as a proxy routing that will be inserted in the headers of packets that go through the router to which the Server that is hosting the management software. You can use something like Cisco WCCP (Web Cache Control Protocol) to set this up. At this point, Microsoft SCCM will not be aware that the packets it is sending are actually being re-routed through the MPS to the vPro clients (which is aware of the remote vPro client) and that is why this is called a transparent proxy.

A caveat/disclaimer I would add though is that albeit technically feasible you would need to put together the full working solution yourselves and support it yourselves.

CIRA and Fast Call for Help - what is it, where can I find it?

tal.elgar@intel.com — Tue, 10 Nov 2009 08:09:43 GMT

What is it?

When vPro and more specifically AMT was initially designed and engineered it was architected to work on an internal corporate network which allowed for the Server to client communications model. The problem was that many organisations have client PCs that are actually situated outside the corporate environment and were excluded from the reach of the vPro benefits available to systems residing within the corporate network. The reason for this is that client PCs that are not on the corporate environment would be sitting behind a home router and would actually posses a private local IP address that is not publicly addressable - i.e. it is not unique and the Management Console has no way of reaching that remote client. The solution to this situation is what is called CIRA - Client Initiated Remote Access.

The term Fast Call for Helpis what we refer to the use case that is enabled by CIRA (which is a means to an end, but not a use case on its own). It specifically addresses a help desk type scenario where the PC is broken and it is being fixed from remote by an administrator or technician.

How does it work?

It works on the principle that as with any usage of a PC behind a NAT'd router, once the client initiates a request (say for a web page) and the information returned comes back to the router, the router knows locally which PC to forward the information back to. The important distinction from the analogy used is that this connection is created Out of Band and does not rely on the operating system or some local software client agent being available or in a healthy state.

The connection that is initiated by the client arrives at the vPro Enabled Gateway which needs to be 'publicly reachable' - so it would typically reside in a DMZ and by protected by an external firewall which might have some port forwarding.

The management console has a listner for incoming CIRA connections and once such a connection arrives it can perform AMT commands on the remote vPro client.

The high level flow is as follows (with a graphical representation below):

The user of the remote vPro client initiates the connection to a component that acts as a proxy Server and is called the vPro Enabled Gateway (aka MPS - manageability presence server).
The connection can either be initiated manually by a user in an OS level utility or pre-OS level with a key combination
Alternatively, the connection can be scheduled to automatically be initiated according to a pre-determined time frequency
Once the connection reaches the Gateway, a secure encrypted tunnel is established back to the vPro client
At this point the Management Console which is sitting inside the corporate environment is notified of the incoming connection from the vPro client
The administrator/technician which is using the Management Console can now initiate any AMT command to the remote vPro client

What components are required for getting CIRA and Fast Call for Help to work?

vPro systems
Management software that has built in support for Fast Call for Help
vPro Enabled Gateway

In addition, you should also be aware that there are configuration files that need to be edited for the vPro Enabled Gateway, some configurable ports need to be open and that AMT provisioning (with CIRA profiles) are a pre-requisite.

Which vPro Hardware do I need to take advantage of Fast Call for Help?

Any vPro system that has AMT Firmware 4.0 and above supports Fast Call for Help. That means any 4.x, 5.x and now the up and coming 6th generation of vPro which is being released in the 1st quarter of 2010. The new capability which is being introduced in 2010 is that this CIRA connection can be initiated over a wireless network interface as well, whereas today it is limited to being initiated over a wired network connection.

Which manageability software is available today for implementing a utilise CIRA capabilities?

Symantec Management Suite version 7 (formerly Altiris Management Console and aka CMS7) Beta II
LANDesk Management Suite 8.8 SP3
Setup and Configuration Service (SCS) 5.x and above (including the Intel DTK) also support CIRA

Which vPro Enabled Gateway products are available today for setting up a CIRA capable infrastructure?

Checkpoint Secure Gateway (interoperable with the Symantec Management Console, but not with the LANDesk console)
LANDesk Gateway which is embedded inside the LANDesk Management Console (however does require to run specific installer for MPS)

Why am I blogging about this now?

CIRA and Fast Call for Help were actually supported in Intel Firmware from version 4.0 which was released about 1.5 years ago. Unfortunately all the components required to make Fast Call for Help work were either unavailable or had stability issues. However, today the components exist and are validated to work successfully (with a few known issues that are being addressed). Therefore, if this is of interest to you then you are in a position to implement Fast Call for Help in your environment today. We would welcome anyone out there that is interested in trying to implementing this

Is this everything I need to know?

There are more technical details required for a successful implementation, however this should provide a good introduction and starting point. If you have any questions, please don't hesitate to contact me.

Intel vPro: Remote Management with Fast Call for Help

kelsey.e.witherow@intel.com — Wed, 22 Jul 2009 18:14:45 GMT

See Josh Hilliker and Ryan Ettl show a demonstration of Remote Management with Fast Call for Help at a local coffee shop in Folsom. See the video below or at this link on YouTube..

Fast Call for Help - It is alive!

josh.hilliker@intel.com — Mon, 03 Nov 2008 06:45:08 GMT

if your reading this blog you may have heard these words "Fast call for help" in relation to vPro, however without seeing it in action on a live platform it may not make a lot of sense. Therefore this last week I had an opportunity to see my first platform live in action making a call back to the enterprise and then to be managed through a Serial over LAN to go into the BIOS. The Platform was the new Panasonic CF-F8. Nicole already posted out the console view.

http://communities.intel.com/openport/blogs/activation/2008/10/28/fast-call-for-help-feature-in-amt-40-then-utilizing-sol-example-to-see-the-bios

What questions do you have about this feature? Also to note is that I started blogging about this capability called CIRA (see blogs below).

Client Initaitied Remote Access - vPro in 2008 - IDF

Centrino 2 - Digging in deeper into CIRA

My plan is to do a few more platforms over the next week with help from my IT expert (Frank).

Using SOL/IDE-R to Diagnose and Repair vPRO Clients

brad.lund@intel.com — Tue, 29 Jul 2008 20:39:04 GMT

My name is Brad Lund; I work in the Enterprise End User Integration Lab (EIL) as a Senior Systems Engineer. This article is the first in a series of blogs I plan to deliver describing how, with the aid of some very useful tools, we can use IDE Redirection (IDE-R) and Serial over LAN (SOL) to provide the console operator with a more user friendly approach to remotely diagnosing and repairing client systems.

SOL is a great technology that has been around for a number of years. It is generally used in data centers for taking control of a computer in order to make changes to its BIOS. Since output from BIOS is by nature "pure text", SOL, whose interface is based on VT-100 terminal emulation, works fine. But what if the problem requires the console operator to interact with the client in a manner that dictates a graphic interface be present to load and run diagnostic applications?

Since the Enterprise Integration Lab are End User focused, we have had several customers ask us how they could leverage this Usage Scenario to take control of an AMT client while providing the operator with a more intuitive and useful interface. Additionally, every one of the End Users we interact with has a set of tools they use to perform diagnostics and repair. But if the client system is out-of-band, meaning no O/S present, it is NOT a BIOS related issue and the diagnostic tools require the operator to have a graphic view of the client system, how can we deliver on this request?

This series of blogs will attempt to show various ways to address these questions and more. I will start this blog series with the client residing inside the Enterprise using AMT to contact the console operator and utilizing very basic tools - take control. Upcoming blogs will show how to do this for clients residing outside the Enterprise (in the internet cloud) using Client Initiated Remote Access (CIRA) to contact the console via of a Management Presence Server in the DMZ and more robust tools - very cool!

So let's get on with it shall we?

The Tool Set

For this first installment I am using AMT Commander from the AMT DTK to initiate a client connection and perform console redirection (IDE-R). The client platform is Montevina (AMT v4.0). I will also push a Pre-installation Environment (PE) down the wire to boot the client into a graphic environment; either WinPE 2.0 or BartPE can be used. Whichever the choice, the greatest thing about a PE is its ability to be customized. You can build a PE to include not only the necessary drivers to bring a system up, but also all the required software for a technician to truly diagnose and practically correct any problem. A full explanation of PE's is beyond the scope of this blog but easily searchable via your favorite search engine. Lastly, to complete the process I will use UltraVNC, a publicly available application that gives the console operator the ability to view the remote client screen; graphically!

The Scenario

In this setting we have a client system where the O/S fails to boot-up (see Figure 1 - left image). This could happen if the client did something to their system which caused the registry to become unreadable by the O/S. Or perhaps the owner of the system accidentally deleted a critical file(s) required by the O/S to boot properly. In any case, the client calls their support center and is walked thru the required steps to perform BIOS initiated AMT. Once initiated, the console operator can then connect to the client; Figure 1 - right image.

Figure 1: Remote client screen on left - Console operator screen on right

After connecting to the client, the console operator opens the SOL/IDE-R mapping interface and assigns the appropriate .iso images for Floppy and CD-R redirection (see Figure 2 - left image). Note: You must assign both a Floppy and a CD image for SOL/IDE-R to operate properly. Also, while you can use IDE devices physically attached to the console system, working with .iso images are faster and more flexible.

Figure 2: Point device mapping to .iso images, start SOL/IDE-R, take control of client system.

The next step after starting redirection is to take control of the remote client as shown in Figure 2 - right image and indicate which image to boot from. In this case since we have our PE stored as a CD-R .iso image we tell it to "Remote Reboot to Redirected CD" Figure 3.

Figure 3: Remote reboot to CD-R image

At this point the client system has started a reboot and loading the PE image from the console. However, because we are using SOL the console operator can only see the "text" generated information. Notice the screen in the foreground of Figure 3 titled "PuTTY", this is the SOL interface and portrays only the "please wait" line from the boot loader; not very intuitive or useful. As a result the console operator will have to ask the client to inform them when the PE has finished loading on their system (see Figure 4).

Figure 4: Client system completed boot to PE and ready for remote control

Here is where the fun begins. After the PE loads onto the client system, the console operator starts UltraVNC; pointing it to the client, Figure 5 - left image. Part of the PE build includes the necessary network drivers to give this system an IP stack so it can be accessed via UltraVNC Once UltraVNC connects it opens a graphic window where we can actually see and control the client as though we are sitting at their machine, Figure 5 - right image. Again, we are using the SOL interface to show us text information and the TCP/IP protocol to allow UltraVNC to connect an OOB client - pretty cool huh?

Figure 5: UltraVNC to display client screen on console operator system

From here we can invoke a whole series of commands and view the results in real-time. In the example shown in Figure 5 - right image, I am running regedit - OK I realize it is showing the PE registry but with the right tools we can load and analyze the client registry or any other application and/or device.

Remember I said the beauty of PE's lie in their ability to be customized? If your shop use specific diagnostic tools you can include them into the PE at build time and use them here by simply clicking on the orange "GO" button (different PE's have different ways to access applications).

What I have shown here is the ability to use some very rudimentary protocols along with widely available tools to perform very powerful diagnostic and repair functions on a broken client. Keep in mind however this is only one of many ways to achieve this capability. In fact, this particular example can take a fair amount of time to load depending on network traffic and size of .iso image. But it is much better than the down time required to bring the remote system into the support center.

EIL are constantly finding solutions to answer the hard questions for our End Users. In upcoming blogs I plan to show similar capabilities using different techniques to minimize load times while maximizing efficiency. I hope you found this blog useful if you have any questions please feel free to ask. See you soon...

Centrino 2 - Digging in deeper into CIRA

josh.hilliker@intel.com — Fri, 11 Jul 2008 17:07:23 GMT

In prior posts I shared out the CIRA (Client Initiated Remote Access) technology. Since the release is coming closer it's time to start talking about what this means for the IT shop and what the exact touch points are. here is a quick flow that shows the touch points, whic highlights this new MPS (Management Presence Server), which sits in your DMZ and acts like a proxy between the client and the management console. this is that final mile of connecting your notebooks when they are out of your corporate enterprise. I listed out the limitations in my last post that I reference below.

(note: Thanks to Kyle in Brand Promise Validation for this great flow..)

Here are the prior posts on CIRA

Client Initaitied Remote Access - vPro in 2008 - IDF

Here is the Centrino2 one stop shop wiki

Centrino 2 vPro - One Stop Shop Wiki

I'm working on posting a video to showcase CIRA and also will be looking to post who supports this capability in their console.

Montevina, CIRA - vPro 2008 - Platform Users Guide

josh.hilliker@intel.com — Tue, 08 Jul 2008 20:31:32 GMT

Community Members,

I can't tell you how excited I am to share this with you as I have been waiting awhile to showcase more about CIRA & what is coming in Montevina from a vPro stand point. I remember awhile back I was asked by a group of students if this capability would exist like this in the future & finally I can showcase more of the pieces of the puzzle to the world. For the folks out there that asked me about this & I just smiled.. well.. here's more of the puzzle..

Here is the AMT 4.0 (Cira, Montevina) Platform User Guide that explains the MEBx settings in detailed screen views.

Intel(R) Management Engine User Guide (Intel(R) AMT 4.0)

Also here is my first post on CIRA about what it does in picture format.

Client Initaitied Remote Access - vPro in 2008 - IDF

If you have any questions let me know & hopefully soon to follow will be a youtube video to show off these new capabilites of the new mobile platform.

Please watch out for this new platform to hit the news wire in the near future.....

Client Initaitied Remote Access - vPro in 2008 - IDF

josh.hilliker@intel.com — Thu, 10 Apr 2008 18:21:39 GMT

Here's a single picture view from IDF On Code name: "CIRA". There's more info to come.. but check out the latest on vPro.. I'm looking forward to showcasing this technology & putting video's on youtube, etc.. stay tuned for more and start your questions..