IBM Support

QRadar: Integrated Management Module Connectivity Troubleshooting

Troubleshooting


Problem

Integrated Management Module (IMM) connectivity issues can arise for multiple reasons, including network, firewall configuration, IMM configuration, and hardware issues. Suggestions on common troubleshooting steps to diagnose connectivity issues with IMM are discussed in this article.

Cause

As with all connectivity problems, the issue can be with the QRadar appliance itself, or it can be with the network environment.

Diagnosing The Problem

  1. Configure a laptop with an IP address on the same subnet as the IMM.
  2. Using an Ethernet cable connect the laptop directly to the IMM port.
  3. If you are able to connect to the IMM UI, the problem is most likely in the network and the IMM is configured and operating correctly.

Resolving The Problem

Required Ports for Remote Control and Connectivity over IMM

  • Port 443 is required for HTTPS access.
  • Port 3900 for HTML5 remote control.
  • Both ports 3900 and 5900 are required for Java™ and ActiveX remote control.
  • Refer to Lenovo and xSeries documentation for port information.

Connectivity issues

  1. Check the IMM UI configuration to verify whether the IP address, subnet, and gateway are set correctly by running these asu64 commands to retrieve the IP address.
    • /opt/lenovo/toolscenter/asu/asu64 show IMM.HostIPAddress1 --kcs
    • /opt/lenovo/toolscenter/asu/asu64 show IMM.HostIPSubnet1 --kcs
    • /opt/lenovo/toolscenter/asu/asu64 show IMM.GatewayIPAddress1 --kcs
  2. If the network information is incorrect, see the article QRadar: Changing the IMM network Configuration
  3. If the IMM configuration is correct, try a ping test to the IMM.
  4. If you can ping the IMM but not able to access or open the IMM web UI, you can reboot the IMM:  /opt/lenovo/toolscenter/asu/asu64 rebootimm --kcs
  5. If the ping is unsuccessful, use the following steps to troubleshoot the IMM connectivity:
    1. Ping the IMM IP address. If the deployment has router or firewall logs sent to QRadar, you can use log activity to filter and search between the IMM and the workstation to determine whether there are any firewall denys or drops.
    2. Reboot the IMM: /opt/lenovo/toolscenter/asu/asu64 rebootimm --kcs
    3. Try again to ping or connect to the IMM IP address.
    4. If the issue is still not resolved, connect a laptop physically into IMM port and test connectivity.
      1. Connect an Ethernet cable from the laptop's external Ethernet port directly to the IMM Management Port. You might need a crossover cable if the laptop's external Ethernet port is not a gigabit port and auto-sensing.
      2. Ensure the laptop's network configuration, IP address, and subnet match the subnet for the IMM.
    5. If the laptop is able to connect to the IMM, then the issue might be a network issue.
      1. Verify your network has open consistent connectivity between IMM and workstation.
      2. Check the physical cables, port configuration, network, and firewall settings.
    6. If steps 1 - 5 do not work, reset the IMM settings and reconfigure the IP address. Then, try steps 1 - 5 again: 
      1. /opt/lenovo/toolscenter/asu/asu64 loaddefault all --kcs
      2. Reconfigure the IMM by using this article: https://www.ibm.com/support/pages/qradar-changing-imm-networking-configuration.
    7. If the IMM is still unresponsive:
      1. Power off the server completely.
      2. Unplug power cords for 5 minutes.
        Note: The result is capacitors holding backup power for the IMM discharge, which allows the IMM to do a cold reboot, and reinitialize.
      3. Plug the power cords back in and power the server on.
      4. Cold reboot the IMM.
      5. Confirm the network settings for the laptop and IMM are good. 
      6. Confirm the laptop direct connection test is failing.
    8. If after performing these steps you still cannot ping or access the IMM web UI, the case might need to be sent to Hardware Warranty Support to rule out a potential hardware issue.

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Hardware","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"Version Independent","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
23 March 2020

UID

swg22001488