Lenovo ThinkSystem: configure XClarity Controller (XCC)

The Lenovo XClarity Controller (XCC) is the embedded management processor found in ThinkSystem servers, functioning similarly to Dell's iDRAC or HPE's…

The Lenovo XClarity Controller (XCC) is the embedded management processor found in ThinkSystem servers, functioning similarly to Dell's iDRAC or HPE's iLO. It provides out-of-band management capabilities, allowing administrators to monitor server health, perform remote diagnostics, update firmware, and install operating systems independently of the server's host CPU and OS. Proper initial configuration of the XCC is crucial for efficient server management and troubleshooting.

This article details the initial setup of the XCC, covering network configuration via the server's UEFI interface and essential post-setup steps through the XCC web UI. We will focus on XCC firmware versions 3.x and 4.x, commonly found on ThinkSystem SR and SD series servers, though the principles apply broadly across ThinkSystem platforms.

Initial Network Configuration via UEFI

Before accessing the XCC web interface, its network settings must be configured. This is typically done through the server's Unified Extensible Firmware Interface (UEFI) setup utility during boot. While DHCP is often enabled by default, assigning a static IP address is recommended for production environments to ensure consistent and reliable access.

Access UEFI Setup: Power on the ThinkSystem server. During the Power-On Self-Test (POST), press F1 when prompted (typically "Press F1 to enter Setup"). If you miss the prompt, power cycle the server and try again. For headless servers, ensure a KVM console is attached or use a remote console if XCC is already on a network (though this article assumes initial setup).
Navigate to XCC Settings: In the UEFI menu, navigate to System Settings > BMC Settings. BMC stands for Baseboard Management Controller, which is the underlying technology for XCC.
Network Configuration: Within the BMC Settings, select Network Configuration.
Choose Network Interface: XCC typically offers several network interface options:
- Dedicated NIC Port: Many ThinkSystem servers have a dedicated XCC Ethernet port (often labeled "Mgmt" or with a gear icon). This is the most secure and recommended option.
- Shared NIC Port: XCC can share one of the server's host network adapters. This saves a physical port but introduces potential management traffic contention or security considerations if the host NIC is heavily used or compromised. If sharing, you'll select which host NIC port (e.g., LOM1, LOM2) to use.
Select the desired interface. For dedicated ports, it's usually Dedicated NIC.
IP Addressing:
- DHCP: If you select DHCP for IPv4, the XCC will attempt to obtain an IP address from your network's DHCP server. This is convenient for initial access but less predictable.
- Static IP: To assign a static IP, set DHCP to Disabled. Then manually enter the IP Address, Subnet Mask, and Gateway Address. Ensure these details are correct for your management network segment.
Apply and Save: After configuring the network settings, ensure you navigate through the UEFI menus to save the changes. Typically, this involves pressing F10 (Save and Exit) or selecting an equivalent option. The server will then reboot.

After the server reboots, the XCC will be accessible on the configured IP address. If using a dedicated port, connect an Ethernet cable to it. If using a shared port, ensure the selected host NIC port is connected to the network.

Accessing the XCC Web Interface

Once network configuration is complete, open a web browser and navigate to the XCC's IP address using HTTPS:

https://<xcc-ip-address>

You may encounter a browser warning about an untrusted certificate. This is normal for self-signed certificates; proceed to the website. The default login credentials are often:

Username: USERID (case-sensitive)
Password: PASSW0RD (case-sensitive, with a zero) or found on a pull-out tab on the server chassis.

It is critically important to change the default password immediately after the first successful login.

Essential Post-Setup Configuration

1. Change Default Credentials and User Management

Upon initial login, you'll be prompted or should immediately navigate to change the default password. Go to XCC Configuration > Local Users. Select the USERID account, click Edit, and set a strong, unique password. Consider creating additional user accounts with appropriate roles (e.g., Administrator, Operator, Viewer) for different personnel.

Administrator: Full control over XCC settings and server.
Operator: Can power cycle, view logs, mount virtual media.
Viewer: Read-only access to monitoring data.

2. Network Settings Review (XCC Web UI)

While the initial network setup was via UEFI, the XCC web interface provides a more comprehensive view and additional options. Navigate to XCC Configuration > Network.

IP Settings: Verify IPv4 and IPv6 settings. You can reconfigure static IP, DHCP, or enable/disable IPv6.
DNS Settings: Configure primary and secondary DNS servers for XCC to resolve hostnames (e.g., for NTP, LDAP).
Network Services: Enable or disable specific services like SSH, Telnet (should be disabled for security), HTTP (redirect to HTTPS), SNMP, SFTP, etc. Only enable services you actively use.
Ports: Review which ports are open. Common XCC ports include:
- 80/tcp (HTTP - often redirects to HTTPS)
- 443/tcp (HTTPS - XCC web UI)
- 22/tcp (SSH)
- 23/tcp (Telnet - generally disabled)
- 161/udp (SNMP)
- 623/udp (IPMI over LAN)
- 5900-5902/tcp (Remote Console - VNC-based)

Example: Disabling Telnet and HTTP, configuring SNMPv3

# Assuming SSH access to XCC
# Login: ssh USERID@

# Disable HTTP redirection and Telnet
sysconfig set NETWORK_SETTINGS.HTTPS_REDIRECT_ENABLE "Enabled" # Ensure HTTP redirects
sysconfig set NETWORK_SETTINGS.TELNET_ENABLE "Disabled"

# Configure SNMPv3 (example with User-based Security Model - USM)
sysconfig set SNMP_SETTINGS.SNMP_VERSION "v3"
sysconfig set SNMP_SETTINGS.SNMP_V3_USER_NAME "snmp_admin"
sysconfig set SNMP_SETTINGS.SNMP_V3_AUTH_PROTOCOL "SHA"
sysconfig set SNMP_SETTINGS.SNMP_V3_AUTH_PASSWORD "YourStrongAuthPassphrase"
sysconfig set SNMP_SETTINGS.SNMP_V3_PRIV_PROTOCOL "AES"
sysconfig set SNMP_SETTINGS.SNMP_V3_PRIV_PASSWORD "YourStrongPrivPassphrase"
sysconfig set SNMP_SETTINGS.SNMP_AGENT_ENABLE "Enabled"

# Verify settings
sysconfig show NETWORK_SETTINGS
sysconfig show SNMP_SETTINGS

3. Date and Time (NTP)

Accurate timekeeping is essential for log correlation and certificate validation. Navigate to XCC Configuration > Date and Time. Configure NTP (Network Time Protocol) synchronization. Specify your internal NTP servers or reliable public NTP sources. Ensure the correct time zone is selected.

# Example via XCC CLI (SSH)
sysconfig set DATETIME_SETTINGS.NTP_ENABLE "Enabled"
sysconfig set DATETIME_SETTINGS.NTP_PRIMARY_SERVER "ntp.yourdomain.com"
sysconfig set DATETIME_SETTINGS.NTP_SECONDARY_SERVER "pool.ntp.org"
sysconfig set DATETIME_SETTINGS.TIME_ZONE "America/New_York" # Or your local zone
sysconfig save

4. Alerts and Event Logs

Configure alerts to be notified of critical server events. Go to XCC Configuration > Alerts. Common alert destinations include:

Email: Configure SMTP server details, sender, and recipient email addresses.
SNMP Traps: Specify SNMP trap receivers (e.g., your NMS - Network Management System) and the community string or SNMPv3 user.
Syslog: Configure remote Syslog servers for centralized log management.

Review the Event Logs (under Server Management) periodically and after any significant changes to ensure everything is operating as expected.

5. Firmware Updates

Keeping the XCC firmware up-to-date is crucial for security, stability, and access to new features. Navigate to XCC Configuration > Firmware Update. Download the latest XCC firmware package from the Lenovo Support Website, then use the "Upload File" option to initiate the update. XCC updates can typically be performed without impacting the host OS, but server reboots might be required for some components (e.g., UEFI, device firmware) if bundled with the XCC update.

6. Security Settings

Under XCC Configuration > Security, review and adjust settings like:

Local Certificates: Generate a new self-signed certificate or upload a certificate signed by your internal Certificate Authority (CA) for better trust in your browser.
LDAP/AD Integration: For larger environments, integrate XCC with your existing LDAP or Active Directory for centralized user authentication. This is highly recommended to avoid managing multiple local accounts.
Cipher Suites: Select strong TLS cipher suites and disable weak ones.
Password Policy: Enforce strong password complexity, expiration, and lockout policies.

Common Pitfalls and Troubleshooting

Incorrect IP/Subnet/Gateway: Double-check all static IP settings. A common mistake is a wrong subnet mask or gateway, preventing XCC from reaching other networks. Use ping <xcc-ip> from a machine on the same subnet to verify basic connectivity.
Firewall Blocking Access: Ensure no network firewalls (hardware or software) are blocking access to the XCC's ports (especially 443/TCP for HTTPS).
Dedicated vs. Shared Port Confusion: Verify which physical port you have configured the XCC to use and ensure the Ethernet cable is connected to the correct one. On some ThinkSystem models, the dedicated XCC port is clearly marked and separate from the host NICs.
Browser Certificate Warning: The "Your connection is not private" warning is expected with a self-signed certificate. For production, consider importing the XCC's certificate into your browser's trust store or replacing it with one from your internal CA.
Forgotten Password: If you forget the XCC password and cannot access the web UI or SSH, you may need to perform a physical reset. Consult the server's hardware maintenance manual for instructions, which often involves a jumper on the system board, or contact Lenovo support. This typically resets XCC to factory defaults, requiring re-configuration.
Firmware Update Issues: If an XCC firmware update fails, ensure you have downloaded the correct firmware package for your specific ThinkSystem model. Do not power cycle the server during a firmware update unless explicitly instructed.
"USERID" Case Sensitivity: Remember that the default username USERID is case-sensitive. The default password PASSW0RD (with a zero) is also case-sensitive.