Accessing the BMC Portal

Overview

The Secure Edge has a dedicated BMC (Baseboard Management Controller) port — a separate management interface, independent of the appliance's operating system, that serves a web portal for remote power control and console access.

This page is for users who want to reach that portal themselves. The only real obstacle is finding the IP address the BMC port received, since it is a different address from the ones your Secure Edge uses to monitor devices.

Three steps: connect the port → find its IP → open the portal.


Step 1 — Connect the BMC port

Connect the port labelled BMC to your network with a standard Ethernet cable.

MarkingWhat it is
BMCDedicated 1GbE management port. This is the one you want.
BMC CONSOLEMini-USB serial console, used only for recovery when the BMC has no IP address.

The BMC requests an address over DHCP, so on a normal network it will have one within a few seconds of link-up. It does not share an address with the two 2.5GbE data ports.

🚧

Anyone who can reach this port has full control of the appliance, including power and remote media. Keep it on a management network or VLAN, and never expose it directly to the internet.


Step 2 — Find the BMC IP address

The BMC has its own MAC address, and it is printed on the label on the bottom of the unit. The label lists all three of the appliance's MAC addresses in a compressed form — a full address followed by the last byte of the other two:

MAC Addresses: 00:00:01:0A:2B:46/47/48

That means 00:00:01:0A:2B:46, 00:00:01:0A:2B:47 and 00:00:01:0A:2B:48.

The label on the bottom of a Secure Edge, showing the MAC Addresses line ending in 46/47/48
📘

The first address in that list is the BMC port on the units we have checked, so start with it — 00:00:01:0A:2B:46 in the example above. The other two belong to the 2.5GbE data ports. This ordering is not guaranteed by the manufacturer, so if the first address does not lead to the portal, repeat the lookup with the second and third and use the check in Option 3 to confirm which one answered.

Option 1 — Ask your DHCP server (recommended)

Look up the active lease for the first MAC address on the label. This puts no traffic on the network at all and is the fastest route on any managed network — Windows Server DHCP under Address Leases, or the client list of your firewall or wireless controller, searching by MAC address.

Option 2 — Listen for that one MAC address

If you cannot query the DHCP server, watch for the BMC directly. This command only listens — it sends nothing and touches no other device on the network, so it is safe on a large production network.

Run it on a computer on the same subnet, replacing the MAC with the first one from your label and the interface with your own:

# macOS
sudo tcpdump -i en0 -n ether host 00:00:01:0A:2B:46

# Ubuntu / Debian   (install with: sudo apt install tcpdump)
sudo tcpdump -i eth0 -n ether host 00:00:01:0A:2B:46

# RHEL / CentOS / Rocky   (install with: sudo dnf install tcpdump)
sudo tcpdump -i ens192 -n ether host 00:00:01:0A:2B:46

Use ip link (Linux) or ifconfig (macOS) if you are unsure of your interface name.

With the capture running, unplug the BMC network cable and plug it back in. The BMC immediately requests an address, and its IP appears in the output — look for the DHCP exchange or the ARP announcement carrying that MAC. Press Ctrl-C to stop.

Option 3 — Check the neighbour table you already have

If your computer has already communicated with the BMC, the address is cached locally. No packets are sent.

# Linux (Ubuntu, Debian, RHEL, CentOS, Rocky) — the table stores the full MAC
ip neigh | grep -i 00:00:01:0A:2B:46

# Linux — same lookup, printing only the IP address
ip neigh | awk -v m=00:00:01:0a:2b:46 'tolower($5)==m {print $1}'

# Windows (PowerShell) — Windows uses dashes
arp -a | Select-String "00-00-01-0a-2b-46"

# macOS — strips leading zeros when printing, so normalise both sides first
MAC=00:00:01:0A:2B:46
NORM=$(awk -F: '{s="";for(i=1;i<=NF;i++){b=tolower($i);sub(/^0+/,"",b);if(b=="")b="0";s=s (i>1?":":"") b}print s}' <<<"$MAC")
arp -an | awk -v m="$NORM" '
function n(x,   a,i,b,s){s="";i=split(tolower(x),a,":");for(k=1;k<=i;k++){b=a[k];sub(/^0+/,"",b);if(b=="")b="0";s=s (k>1?":":"") b}return s}
n($4)==m {gsub(/[()]/,"",$2); print $2}'
📘

The macOS normalisation is not optional. macOS stores the label MAC 00:00:01:0A:2B:46 as 0:0:1:a:2b:46, so searching for the printed form finds nothing at all.

Option 4 — Subnet sweep (small networks only)

🚧

Only on a small or lab network, and with the agreement of whoever runs it. This pings every address on the subnet, which is noisy, can raise intrusion-detection alerts, and is not appropriate on a production network with hundreds or thousands of devices. Prefer Options 1 to 3.

for i in $(seq 1 254); do ping -c1 -W 200 192.168.1.$i >/dev/null 2>&1 & done; wait

Then read the result with the neighbour-table command for your platform in Option 3.

On Linux, arp-scan does both halves in one targeted command. It uses ARP rather than ping, so it is lighter than the sweep above, but it is still active traffic — treat it the same way:

sudo apt install arp-scan          # Debian / Ubuntu
sudo dnf install arp-scan          # RHEL / CentOS / Rocky

sudo arp-scan --interface=eth0 --localnet | grep -i 00:00:01:0A:2B:46 | awk '{print $1}'

Confirm you found the BMC and not a data port

If more than one address is a candidate, this tells you which one is the BMC. It serves a management API:

curl -k https://<candidate_ip>/redfish/v1

The BMC returns a block of JSON. The Secure Edge operating system exposes no open ports, so its data interfaces return nothing.

If nothing is found at all, the BMC is not on this subnet, the cable is in a data port rather than the one marked BMC, or the unit is unpowered.


Step 3 — Open the BMC portal

  1. Browse to https://<bmc_ip>.
  2. The BMC uses a self-signed certificate. The browser warning is expected — accept it and continue.
  3. Sign in with the BMC credentials supplied with your unit. If you do not have them, contact Xyte support.

Overview confirms you are in the right place: it shows the appliance model and serial number, the BMC firmware version, the hostname nanobmc, and — under Network information — the address currently in use.


What the portal gives you

PageWhat it does
Operations → Server power operationsCurrent power state, Reboot (graceful or forced) and Shut down (graceful or forced). Works even if the operating system is unresponsive.
Operations → SOL consoleSerial-over-LAN terminal into the Secure Edge operating system, usable when the appliance is unreachable over the data network.
Operations → Virtual mediaMount an ISO or disk image over the network — how a Secure Edge is re-installed remotely.
Operations → FirmwareView and update BMC firmware. A running image and a backup image are kept.
Operations → Reboot BMCRestarts the management controller only. The Secure Edge itself keeps running.
Settings → NetworkHostname, static IP configuration, DNS and NTP servers.
Hardware status / LogsInventory, sensor readings and the event log.
🚧

Operations → Factory reset resets BMC settings. Do not use it unless Xyte support asks you to.


Optional — give the BMC a fixed address

If you would rather not look the address up again:

  1. Go to Settings → Network and select the eth0 tab.
  2. Under IPv4, turn off DHCP and add a static address, subnet mask and gateway.
  3. Save. The session drops — reconnect on the new address.

A DHCP reservation on your own server achieves the same thing without touching the appliance.


See also: Installation


Did this page help you?