Hardware Prerequisites

Version 9.0.31 and higher
Intel® AMT communicates with certain type of Intel ethernet and Wifi chipsets that support sideband communication. For Intel ethernet, typically the ethernet chip is labelled with suffix “LM”, for example: i219-LM, i225-LM. Other ethernet such as i210 or ethernet from other vendors are not supported. (For example: Ethernet eno1 => i219LM.)

Download the
meshcmd
executable with the command:
curl https://alt.meshcentral.com/meshagents?meshcmd=6 >meshcmd
Execute the
meshcmd
file with the command:
chmod +x ./meshcmd
Check whether the system has Intel® AMT support or not with the below highlighted
amtinfo
from
meshcmd
. Under ManagementEngine of amtinfo, the first 3 decimals
11.8.71
represents the version and the next value
3630
represents the build number.
sudo ./meshcmd smbios

BIOS Prerequisites

Domain suffix and un-provisioning:
Restart or power on the device.
While the device is booting up, press
Ctrl+P
to reach the Intel® Management Engine BIOS Extension (Intel® MEBX) login screen.
Select '
Intel AMT configuration
'
Select '
Unconfigure Network access
'
Select '
Full unprovision
', and then press '
y
' to continue.
Select '
Remote Setup and Configuration
'
Select '
TLS PKI
'
Select '
PKI DNS Suffix
'
Provide a DNS suffix name as "
vprodemo.com
" and press
enter
.
Press
Esc
three times to reach the main menu.
Select '
MEBX Exit
', and then press '
y
' to confirm the exit.
If it is the first time entering MEBX and the device has not been provisioned previously, the default password is
admin
. It will prompt you to create a new password.
Power policy:
Select '
MEBX Exit
', and then press '
y
' to confirm the exit
Go to the
Intel® MEBX
main menu.
Login with the MEBx password.
Select
Intel® AMT Configuration
.
Select '
Power Control
' under
Intel® Management Engine (Intel® ME) Platform Configuration
, then press
Enter
.
Intel® ME Platform Configuration
screen changes to
Intel® ME Power Control
screen. Select the option as "
Mobile: On in So, MEWake in S3, S4-5 -Power Package 2
".
Save the changes and exit.

Step 1: Go to Deploy > Connect to an Edge Node

Click on
Deploy
in the top menu and select
Connect to an Edge Node
.
In the
Connect to an Edge Node
screen under the
Connection Pending
tab, click on
Add Edge Node
.
You can select the
Enable
or
Disable
options for the IDV feature and
Enable
for the Remote Power Cycle Configurations, and provide the AMT specific inputs.
The IDV feature should be enabled on the Host machine before it can be enabled here on the BareMetal.
AMT Password:
It is used internally by AMT firmware for remote access.
AMT MEBX Password:
It is the password to get into the ME BIOS Extensions menu.
AMT Domain Suffix:
"vprodemo.com" (This is the default suffix and should be provided as input.)
AMT Domain Password:
"P@ssw0rd" (This is the default domain cert password and should be provided as input.)

Click on the
Next
button. You will see a set of instructions to connect an edge node in the note section, and commands for deploying an edge agent, which must be executed on the device that needs to be connected.
The RPC agent will be deployed as part of the deployment process on edge node. On the terminal of the target device at the end of connecting command execution, we can observe that the target device will be provisioned successfully with the deployment of the RPC agent as mentioned in the screenshot below.

After successful connecting, you can see that the edge node was added under the
Connection Complete
tab and the status is
Connected
.
You can view Intel® AMT specific details under the
Remote power cycle
card of the deployed edge node by clicking on the respective Edge Node Name.
1. If the edge node does not have Intel® AMT capability or does not meet the prerequisites, the RPC agent cannot be installed while connecting and exits the installation. Check the troubleshooting steps for RPC agent installation failure.
2. After successful installation of the RPC agent, if AMT Power On/Off actions are not enabled under Edge Node actions, reboot the edge node. Once the system has rebooted, then you can see the actions.
Manage the edge node by clicking on
Power On / Power Off / Restart
from the
Edge Node Actions
drop-down list in the top right corner of the
Edge Node Details
page.
Once the Power Off action is triggered, the target device will go to the power off state and the endpoint state will be disconnected. Power on the edge node again by clicking on
Power On
under
Edge Node Actions
.
Similarly, you can perform a
Restart
operation on that edge node by clicking on the
Restart
button under
Edge Node Actions
.

Troubleshooting Intel® Active Management Technology (Intel® AMT) Issues

CIRA connection closed between AMT device and MPS server

If this issue is observed, check the logs of MPS server using the command below and find out whether the CIRA connection is closed or not.

sudo docker logs esm_mps_1

If this happens, try restarting the MPS server using the command:

sudo docker restart esm_mps_1

Intel® AMT Connecting to MPS Server

After a successful configuration, the Intel® AMT device will occasionally fail to connect to the MPS. There are two ways to prompt Intel® AMT to attempt to re-connect to MPS:

Unplug and re-plug the network cable.
Reboot the Intel® AMT device.

Intel® AMT device fails to re-connect to MPS after MPS is not available for an extended period

If the MPS goes down for more than 2 days, Intel® AMT devices will no longer attempt to connect to MPS. If this happens, there are two ways to prompt Intel® AMT to attempt to re-connect to MPS.

Unplug and re-plug the network cable.
Reboot the Intel® AMT device.

RPC agent Installation/Failure

Device is already in provision state.

Intel® AMT Firmware: version with 9.0.31 and higher and build greater than 3000 (mentioned as prerequisite).

Not an Intel vPro® device. (No support for AMT feature.)

Device activation/provisioning failed. Check the logs of RPS container on build node to identify the issue.

sudo docker logs -f esm_rps_1

Error: If "Timed out due to inactivity" issue is faced, manually re-run the rpc agent command using the commands:

cd /opt/rpc/build/
sudo ./rpc -u wss://<esm-server-ip>:8080 -c "-t activate --profile   <onboard-endpoint-name>".