topic Re: Remote AMT Provisioning in Intel® Business Client Software Development

Remote AMT Provisioning

odla0024 — Mon, 16 Nov 2009 18:50:47 GMT

Hello,

I am trying to figure out how to configure a machine over the internet without ever having direct contact with the machine.

The machine will be sent to the location and needs to be provisioned. The BIOS can be set up by the manufacturer and there will be someone on location who can do minimal tasks (ie: insert USB drive or type one word) if need be but the less the better.

I've been trying to accomplish this using SCS 6. The machines will have AMT 5 on them.

Thanks

Re: Remote AMT Provisioning

RBens2 — Mon, 16 Nov 2009 21:26:49 GMT

What info can your OEM pre-load into the system?

Thanks,
Roger

Re: Remote AMT Provisioning

odla0024 — Mon, 16 Nov 2009 21:42:40 GMT

Quoting - rogerb

What info can your OEM pre-load into the system?

Thanks,
Roger

Not exactly sure. It will most likely be a machine ordered from Dell. We should be able to have a decent amount of control over settings.

The goal is to do this completely over the interent which I'm not even sure is possible. I've done a lot of looking and I've only been able to find a few references to people even trying it. Any idea if it is possible when they aren't on the same LAN?

Re: Remote AMT Provisioning

Richard_B_Intel1 — Tue, 17 Nov 2009 00:24:12 GMT

The system needs to be inside the "corporate" network to provision it with SCS. Additionally, to manage the system outside the "corporate" network requires a vPro Enabled Gateway in your DMZ (please see the "Intel AMT Remote Access Overview.pdf" in the SDK)

Re: Remote AMT Provisioning

odla0024 — Tue, 17 Nov 2009 14:58:05 GMT

Quoting - RB (Intel)

Is the same true for using the Intel AMT SCA?

edit: Nevermind. It say that it has to be on the same intranet in that document.

Re: Remote AMT Provisioning

RBens2 — Tue, 17 Nov 2009 17:07:34 GMT

Quoting - odla0024

Is the same true for using the Intel AMT SCA?

edit: Nevermind. It say that it has to be on the same intranet in that document.

Hi odla,

You actually could do internet provisioning of a box, but you would have to be very careful about security. The provisioning process is setup to allow a secure connection between the system and the provisioning server. You would just have to make sure that the AMT system could connect to the IP address of the server running the SCA, and the AMT system couldn't access the SCA through a VPN connection. If you can setup the SCA in a DMZ, and you can put the AMT system on the internet without going through NAT, then the two system should be able to establish a secure connection and complete the configuration process. Again, you would need to be very careful about security and network visibility.

Regards,
Roger

Re: Remote AMT Provisioning

Richard_B_Intel1 — Tue, 17 Nov 2009 18:34:34 GMT

Quoting - rogerb

While this may be technically feasible, Intel does not recommend doing this because of the securityconcerns Roger is calling out.