What is it?

When vPro and more specifically AMT was initially designed and engineered it was architected to work on an internal corporate network which allowed for the Server to client communications model. The problem was that many organisations have client PCs that are actually situated outside the corporate environment and were excluded from the reach of the vPro benefits available to systems residing within the corporate network. The reason for this is that client PCs that are not on the corporate environment would be sitting behind a home router and would actually posses a private local IP address that is not publicly addressable - i.e. it is not unique and the Management Console has no way of reaching that remote client. The solution to this situation is what is called CIRA - Client Initiated Remote Access.

The term Fast Call for Helpis what we refer to the use case that is enabled by CIRA (which is a means to an end, but not a use case on its own). It specifically addresses a help desk type scenario where the PC is broken and it is being fixed from remote by an administrator or technician.

How does it work?

It works on the principle that as with any usage of a PC behind a NAT'd router, once the client initiates a request (say for a web page) and the information returned comes back to the router, the router knows locally which PC to forward the information back to. The important distinction from the analogy used is that this connection is created Out of Band and does not rely on the operating system or some local software client agent being available or in a healthy state.

The connection that is initiated by the client arrives at the vPro Enabled Gateway which needs to be 'publicly reachable' - so it would typically reside in a DMZ and by protected by an external firewall which might have some port forwarding.

The management console has a listner for incoming CIRA connections and once such a connection arrives it can perform AMT commands on the remote vPro client.

The high level flow is as follows (with a graphical representation below):

1. The user of the remote vPro client initiates the connection to a component that acts as a proxy Server and is called the vPro Enabled Gateway (aka MPS - manageability presence server).
2. The connection can either be initiated manually by a user in an OS level utility or pre-OS level with a key combination
3. Alternatively, the connection can be scheduled to automatically be initiated according to a pre-determined time frequency
4. Once the connection reaches the Gateway, a secure encrypted tunnel is established back to the vPro client
5. At this point the Management Console which is sitting inside the corporate environment is notified of the incoming connection from the vPro client
6. The administrator/technician which is using the Management Console can now initiate any AMT command to the remote vPro client

What components are required for getting CIRA and Fast Call for Help to work?

1. vPro systems
2. Management software that has built in support for Fast Call for Help
3. vPro Enabled Gateway

In addition, you should also be aware that there are configuration files that need to be edited for the vPro Enabled Gateway, some configurable ports need to be open and that AMT provisioning (with CIRA profiles) are a pre-requisite.

Which vPro Hardware do I need to take advantage of Fast Call for Help?

Any vPro system that has AMT Firmware 4.0 and above supports Fast Call for Help. That means any 4.x, 5.x and now the up and coming 6th generation of vPro which is being released in the 1st quarter of 2010. The new capability which is being introduced in 2010 is that this CIRA connection can be initiated over a wireless network interface as well, whereas today it is limited to being initiated over a wired network connection.

Which manageability software is available today for implementing a utilise CIRA capabilities?

1. Symantec Management Suite version 7 (formerly Altiris Management Console and aka CMS7) Beta II
2. LANDesk Management Suite 8.8 SP3
3. Setup and Configuration Service (SCS) 5.x and above (including the Intel DTK) also support CIRA

Which vPro Enabled Gateway products are available today for setting up a CIRA capable infrastructure?

1. Checkpoint Secure Gateway (interoperable with the Symantec Management Console, but not with the LANDesk console)
2. LANDesk Gateway which is embedded inside the LANDesk Management Console (however does require to run specific installer for MPS)

Why am I blogging about this now?

CIRA and Fast Call for Help were actually supported in Intel Firmware from version 4.0 which was released about 1.5 years ago. Unfortunately all the components required to make Fast Call for Help work were either unavailable or had stability issues. However, today the components exist and are validated to work successfully (with a few known issues that are being addressed). Therefore, if this is of interest to you then you are in a position to implement Fast Call for Help in your environment today. We would welcome anyone out there that is interested in trying to implementing this

Is this everything I need to know?

There are more technical details required for a successful implementation, however this should provide a good introduction and starting point. If you have any questions, please don't hesitate to contact me.

Are you a small business looking to use vPro? Are you satisfied with non-TLS management operations? The Local Setup and Configuration Using a USB Flash Drivedocument outlines a process by which Intel Active Management Technology can be setup and configured without a config server, in the fewest steps possible. The trick lies in using the OS to prepare a USB Key for setup and configuration on the fly. Just insert the key, and allow the batch file to auto-run. The system will reboot and prompt to accept the configuration. Choose Y and you're done. Once you've configured, check out Radmin* - Help Desk Tool for Use With Intel vPro Technology for a quick way to gain value in vPro...remotely manage a downed system.

Take a look at the posted document on Radmin (Remote Administrator).  This free tool (Viewer) allows technicians to gain access to AMT basic functions and will work with any provisioned ISV under SMB or Non-TLS Enterprise Mode.  This tool can be provided to IT Techicians who may not have access to the ISV console to perform the basic AMT functions on a provisioned client.

http://communities.intel.com/docs/DOC-4309

Our most recent issue of the Intel vPro Technology Heartbeat was published this morning. This newsletter is a compilation of Intel vPro resources that were collected over the last two weeks. In this issue, check out the article series on Intel Active Management Technology that was published by our partners at the Intel Software Network's Manageability community. We also have a bunch of webinars coming up around Windows 7 and Dynamic Virtual Computing. Registration links are in the newsletter!

Read the newsletter, or subscribe to receive it in your inbox automatically.

Take a look at a recently posted document providing insights on what might cause a rapidly expanding database, key learnings how to minimize the growth and provide good performance, and more.

http://communities.intel.com/docs/DOC-4306

The document may be updated over time, depending on requests, inputs, and so forth

Earlier this year, Lenovo made a small change on their T400 and related platforms.   The Ctrl-P option disappeared when attempting to access the MEBx (Management Engine BIOS Extension screens for Intel Active Management Technology).   If you browse through the Lenovo BIOS update posting, there is a brief mention of this change.

The main reason was to improve boot times.   The difference is a few seconds.   All of the Intel AMT functionality is still present.

To access the MEBx screen, press F12 during the POST process to access the Boot Menu.

The option "Enter ME Configuration Screens" will access the MEBx.

The option "Initiate a Remote Connection" is for the Client Initiated Remote Access (CIRA), more commonly referred to as "Fast Call for Help" - the ability for Intel AMT to make a call home for assistance.

This week's newsletter highlights success stories by Intel IT, BMW, Valerent, Compucom, and Computacenter. In addition, find our latest webinar offerings, known issues, and quick links to useful documents on the Intel vPro Expert Center.

Click here to view the newsletter.

Want to receive this bi-weekly newsletter in your inbox? Click here to subscribe.