ITA advanced use

If you want to make the IT Advisor web client or Tenant Portal available to your colleagues or customers directly from the Internet, make sure you have a proxy configuration in the DMZ. Note: The DMZ setup protecting ITA against direct Internet access is entirely your own responsibility! Here are some recommendations on how to set up the proxy server. This is not a complete guide. You should already have a working knowledge of scripting, web proxy, and DMZ configuration, or find it easy to acquire this knowledge. ITA_proxy_overview_360007721638.png About DMZ proxy and firewall port configuration The ITA server should be on a protected network behind a firewall and not exposed directly on the Internet. The only incoming traffic allowed through the firewall to the ITA server should be on ports 80/443. Note: It is required that you set up a proxy server in the DMZ, only supporting incoming https on port 443 and proxying requests to the ITA server on port 80/443 to the path:  /web/  only. You may want to use Nginx, Apache, AH Proxy, or some other proxy tools. Examples here will be referring to an Nginx setup. You should only use secure https protocols, not e.g. SSL v2. For an Nginx setup, the default protocols: TLSv1, TLS1.1, TLSv1.2 are supported. Configuring a proxy for the Tenant Portal Proxy specific commands are explained in this section. For more information, refer to the complete Nginx configuration guide. Ensure the Nginx server only handles https. If an http request is made, it will be forwarded to https. # Redirect browsers from http to https server {        listen 80;       rewrite ^(.*) https://$host$1 permanent; }   Set up the actual ssl connection pointing to the certificates.  # Set up the proxy to DCO or ITA server {        listen 443 ssl;        server_name $NGINX_ADDRESS;        ssl_certificate     $PATH_TO_CERTIFICATE_FILE;        ssl_certificate_key $PATH_TO_PRIVATE_KEY_FILE; } Proxy to the Tenant Portal # First handle requests to the actual application path /web   location /web/ {     proxy_pass http://$DCO_ADDRESS; } Proxy root requests to the same location. This is an additional option to proxy root requests to the same location, allowing the user to exclude /web in the URL when accessing the Tenant Portal. NOTE: The order matters! The location /web must be specified before location /.  # Handle root requests and forward to /web location / {     proxy_pass http://$DCO_ADDRESS/web/; }  

The Error collecting data message typically occurs if EcoStruxure IT Advisor is unable to receive data from Data Center Expert. There could be several reasons for the server response to be cut off. Start by ruling out the listed scenarios. Why do I see the error? How do I resolve this? Network infrastructure between the two servers. Changes to DCE user credentials or update of the SSL certificate. Ping the servers to ensure they are running and check your network path to rule out general network related issues. Test the ITA/DCE server connection (in ITA select System Setup>External Systems Configuration. Perform the test for both port 80 and 443 (use encryption). Don't change the DCE server ID (IP/hostname) as part of the test because this will result in all device associations being lost. The DCE server may be under too much stress and unable to run the necessary background jobs. The DCE server may be unable to handle requests from the ITA server. Reboot the DCE server to re-initiate the jobs. If the server is stressed because it is monitoring too many devices, consider additional purchases. If the connection was lost or interrupted, ITA will collect any data it missed when the connection has been restored.  

The EcoStruxure IT Advisor Web Service API is a set of web services that provide access to various parts of IT Advisor.  The RESTful web service documentation is available on your EcoStruxure IT Advisor server at https://<server-IP>/api/current/docs/index.html Use the system administration credentials you use when logging into EcoStruxure IT Advisor. Accessing the API documentation on your EcoStruxure IT Advisor server allows you to easily test the endpoints.  

In IT Advisor 9.3.9 and newer, you can connect to the desktop client through a proxy server.   To configure the proxy connection:   Expand the Advanced Settings option on the login screen. Check Use Proxy to Connect. For a standard proxy connection, enter the IP address of the proxy server and the port number. To require authorization, check Proxy Requires Authorization and enter the username and password.   9216750348189_9207957747997.png    

  DCO and ITA servers are installed with a self-assigned SSL certificate. To add your own SSL certificate, see Changing the SSL certificate on the ITA server. To complete that process, you must: Create a certificate signing request (CSR) and a private key for the ITA server Submit the CSR to a certificate authority (CA) to be signed Add the signed certificate and private key to the ITA/DCO server Create a certificate signing request (CSR) and a private key for the ITA server While most IT staffs have tools to create a CSR for a DCO/ITA server, it is possible to manually create the CSR from the DCO/ITA server operating system. Log on to the DCO/ITA server via SSH or from the server’s console. Use sudo to become the root user. Type: sudo /bin/bash Change to root’s login folder, typically /root. Type: cd Create a ssl configuration file. This is a temporary file that will be used to define the “subject alternate name” portion of the CSR request. The subject alternate name section is important, especially if your DCO/ITA server hostname can be resolved as several hostnames. Use a tool like vi to create a file called ssl.conf and paste the following lines into the file. You will not normally need to change any of the below text except for the last line. [ req ] default_bits = 2048 distinguished_name = req_distinguished_name req_extensions = req_ext [ req_distinguished_name ] countryName = Country Name (2 letter code) stateOrProvinceName = State or Province Name (full name) localityName = Locality Name (eg, city) organizationName = Organization Name (eg, company) commonName = Common Name (e.g. server FQDN or YOUR name) [ req_ext ] subjectAltName = @Anonymous user_names [alt_names] DNS.1 = <DNS name 1> Use the bottom line to specify Subject Alternate Name information for the certificate. You can customize the “DNS.x = <DNS name>” entries where the “x” represents the entry number and the “<DNS name>” portion represents other hostnames that this certificate will also satisfy. If your ITA server resolves with multiple hostnames, you create a line for each one. If you have three entries, for example, it might look like this: DNS.1 = itahost1.mydomain.com DNS.2 = itahostprod.mydomain.com DNS.3 = itaprod.mydomain.com Save the changes to the file. Use the “openssl” command to create the CSR and private key files. This command will create two files in your current directory. One will be called myCSR.csr which contains the certificate signing request. The second file will be called myPrivateKey.key which is the private key file for the DCO/ITA server. openssl req -sha256 -out myCSR.csr -new -newkey rsa:2048 -nodes -keyout myPrivateKey.key -config ssl.conf The openssl command will ask you several questions including your country code, state, and other information. This information is included in the CSR request   Submit the CSR to a certificate authority (CA) to be signed Download and forward the myCSR.csr file to your certificate authority so it can be signed. You can also download the myPrivateKey.key file; it will be uploaded later to Webmin along with the signed certificate file. The signed certificate you receive must be in the Apache 2.x/PEM format to upload to DCO/ITA.    Add the signed certificate and private key to the ITA/DCO server You should have a *.crt signed certificate. The myPrivateKey.key file you created earlier is the *.key file you will upload to the DCO/ITA server via Webmin. Follow the instructions in Changing the SSL certificate on the ITA server   Last updated July 30, 2020

EcoStruxure IT Advisor provides a way to manage which users can access IT Advisor from an external network, for example, from a home network. To enable External User Access, there are two things you need to be aware of. Infrastructure setup How to manage user access Infrastructure setup External User Access works on the premise that users will access IT Advisor through different infrastructure components, like a proxy or load-balancer, depending on being on a local or remote network. The proxy or load-balancer used when acccessing IT Advisor from external networks must append a header "ita-external-access" with value "yes" to all network traffic destined for the IT Advisor server. If using ssl-encryption - the traffic must be terminated at the proxy/load-balancer level, to be able to append "ita-external-access"-header to incoming traffic.   Screenshot1_360006854258.png How to manage user access To manage which users are allowed to access IT Advisor from an external network, the user needs to have "Permit access from external network"-permission. This can be done by navigating to web client > Administration > User > Selected User -> Global Permissions > Select... > Enable/Disable -> Permit access from external network. Screenshot2_360006854258.png    

Some rack-mount PDUs reporting power bank information to Data Center Expert report wrong power data to EcoStruxure IT Advisor. Known affected devices: AP8970, AP8888, AP8886, AP8881, AP8870, AP8862, AP8860, AP8853, AP8841, AP8832J, AP8831, AP8653, AP8632, AP8481, AP8441, AP7960, AP7853 ... You will be able to see if your rack-mount PDUs are reporting incorrectly to ITA if you see a significant difference in a rack-mount PDU's total peak and average values per phase in ITA compared with DCE. This can be done by running a power sensor report of the device(s) in DCE for a time period of 30 days. This report will also show the average and peak values in the bottom table. These numbers can then be compared with the power data seen in the device properties in ITA. PowerBanks_360006698697.JPG This patch fixing the issue applies to DCE 7.2.6+. DCE version ITA version Fix Includes 7.2.6 and later 9.x Power (kW), Current (amps)   How do I know if my rack-mount PDUs might be reporting wrong power data to ITA? Click View Device Sensors on your device (rack-mount PDU) in DCE (e.g. AP8841). Look for Power - Bank 1 and Power - Bank 2. If the device has more than one power bank, it could be reporting wrong power data to ITA. How do I apply the patch in DCE?    Make sure to have a recent backup in place of your running systems before applying the patch.  On the DCE server, open this URL:  http://<DCE server ip>/nbc/status/SensorContexts . You must be logged in as an admin user. If you already have a previous version of this patch installed (prior to March 2016), remove the existing file: pduSensorUpdates.xml before proceeding. Download this file "pduSensorUpdatesV2.xml" (attachment at the end of this article) and upload it to the DCE server. The file has now been uploaded to the server and the patch is in place. Tip WARNING: Uploading a malformed or corrupted file can totally mess up the system.  The power values are now correctly transferred. You can erase the false power data history and see the corrected values immediately* by deleting the external system (DCE) in ITA and adding it again. You will need to associate devices again in ITA.  *Once the data has been gathered from DCE. It might take up to 1 day depending of number of devices.   An alternative is waiting. Depending on the configuration in EcoStruxure IT Advisor (30 days by default), all the values will be corrected after the configured time period (30 days by default). In general, power data is stored for a year for report purposes so for reports, the data will take longer for the data to be fully corrected.  

The ITA server is installed with a self-signed security certificate. When you connect to the server from a web browser, you might receive warnings about the security certificate. It is recommended, after the ITA installation is complete, that you purchase and install a security certificate issued by a trusted certificate authority.   To change your SSL certificate on the ITA server, the certificate must be the Apache 2.x/PEM format with two files: *.key, *.crt. See How to manually create a CSR (certificate signing request) from an IT Advisor server It is best practice to disable access to the web clients before you update any certificates to make sure no client is connected with a false certificate. If your setup includes a disaster recovery node that needs a certificate, upload certificates to the DR server the same way as for a standalone server. Preparing a certificate for upload Password A password protected key is not supported. Strip the password from the key before uploading it. Intermediate or certificate bundle If your certificate chain requires an intermediate certificate, append it to the .cert file. When appending, make sure you include everything, including the lines: " -----BEGIN CERTIFICATE----- " & " -----END CERTIFICATE----- " There may be several lines for this intermediate certificate. No users in the system during upload The Apache HTTPD server will be reloaded during this process, so make sure no users are using the system during the upload. Uploading a certificate Open the Webmin web interface by selecting Administration > Webmin in the IT Advisor web client. Alternatively, type the address of your EcoStruxure IT Advisor server in a Web browser followed by :10000,  https://<ITA server IP>:10000  .   Log into Webmin using the user credentials created during the installation. Select EcoStruxure IT Advisor in the left menu. In the submenu, select Certificates. Follow the instructions on the page. Verify that everything is working correctly. Launch a web client and check that there's a green pad lock icon in the address line. webmin_certificates_option_360006707217.JPG