Intel vPro® Platform
Intel Manageability Forum for Intel® EMA, AMT, SCS & Manageability Commander
2823 Discussions

vnc viewer plus unable to connect to vpro computer from the internet

idata
Employee
2,421 Views

I have a computer setup with Intel Vpro AMT. The Intel AMT has been setup and I can use VNC Viewer Plus on another computer to connect to the VPRO computer and control power and boot to bios features via the local lan. My problem is that I am unable to use VNC Viewer plus to connect to this same computer from the internet or outside of the local lan. I have setup port forwarding on my router to forward port 16992 to the VPRO computer. I am able to use the Intel system defense utility on a remote computer from the internet and it connects to the local Vpro computer just fine. However, I can't get VNC Viewer Plus to connect. When I start VNC viewer plus and click connect, it ask for and I enter the correct Vpro user id and password, and after a few seconds I get the following message "the connection closed unexpectedly". Also, I have disabled all antivirus and firewalls on the computer that I'm using to connect to the Vpro computer. Any help would be greatly appreciated.

0 Kudos
8 Replies
Bruno_Domignues
Employee
1,090 Views

For HW KVM, you should create a rule to forward also Port 5900, 16992 is not enough for KVM.

Best Regards!

-Bruno Domingues

0 Kudos
idata
Employee
1,090 Views

I forwarded port 5900 in the router as you suggested and I am still unable to connect to the vpro computer from the remote computer. Any other suggestions would be appriciated.

0 Kudos
Bruno_Domignues
Employee
1,090 Views

I forgot to mention, 5900 for hardware KVM to Network Interface if you are using plain VNC protocol rather than VNC encapsulated within a re-direction protocol. I have this configuration in my lab and it should work.

Best Regards!

-Bruno Domingues

0 Kudos
idata
Employee
1,090 Views

Actually, you also need to forward 16994 for the KVM to successfully go through your router.

VPro does use ports 16992 - 16995. Since most of the stuff only uses 16992 and 16993, most people, including me , often forget to forward 16994/16995 as well.

I had the same problem and it went away as soon as I forwarde 16994 as well.

Frank

0 Kudos
Frank_Kuypers_Intel
1,090 Views

Actually, you need to forward 16994 as well. vPro uses ports 16992-16995. Though most stuff works by just forwarding 16992, for KVM to work behind a firewall, you need to actually forward 16994 as well (or 16995 if you are using TLS).

I just had the same problem and forwarding 16994 solved it right away.

Regards,

 

Frank
0 Kudos
idata
Employee
1,090 Views

So, do I need to forward port 5900 as well as ports 16992-16995 to allow a connection from outside the LAN?

(Not that I have managed to connect from inside the LAN yet..! Is it possible to use the hardware KVM with host-based AMT configuration, or do I need to configure with a USB key+reboot? I'm using Server 2012 with NIC teaming and have LACP enabled on the switch - is this configuration liekly to conflict with AMT/vPro in any way?)

Thanks for any tips - this is proving much harder than I thought it would be...

Jon.

0 Kudos
idata
Employee
1,090 Views

Hello again.

After lots of experimentation, I have found a few things that might help others in the future. It's all documented in various places, but these are a few stumbling points I came across trying to get this working...

1) I had difficulty using host-based setup, as the tool doesn't allow you to configure a gateway address directly for the AMT IP address. Either choose all the options and then manually edit the networksettings.xml file before applying the configuration, or (much easier if it's possible) use the USB key method, which also allows you to turn user consent off, while host-based config doesn't. This might also have been more difficult than necessary owing to the next point....

2) Unless you know how to make it work (I don't), don't try and team the AMT NIC with any others. I had a switch setup for LACP and the 2 NICs on my DQ77MK teamed under Windows Server 2012 and it really messed up any AMT connections, presumably because the switch only sent half the packets to the right NIC. If anyone knows how to make this work, I'd be glad to hear from them!

3) You only need ports 16992-16995 open on your firewall.

4) If you change the AMT admin username, for some reason Real VNC Viewer Plus will not connect and gives "Internal Error (190)". I had changed the admin username to try and increase security a bit, but this prevented a connection at all. This one probably ought to be fixed, either by Intel or Real VNC.

5) After all that, I couldn't connect from outside my LAN. This turned out to be an ARP firewall issue on my Draytek Router. Resolved by telnetting in and setting it to enable 'illegal Destination ARP addresses': ip arp enable 3 on my particular model 2830n+. Once I'd done that, it all sprang into life.

I couldn't find an FAQ/troubleshooting guide for KVM connection to vPRO. Perhaps someone could start one off and add some of these points to it?

Cheers,

Jon.

0 Kudos
idata
Employee
1,090 Views

In order to connect from the wide area network (WAN), you have to turn on cloud desktop settings in the bios.

There you can set an access point IP and set it to DHCP or STATIC client IP settings. You also have to specify a port there as well and forward it in your router. Then you can connect from the WAN using vnc plus just fine.

0 Kudos
Reply