Hello Maria,

I am also working on AMT setup and configuration but I am not using Intel SCS since the system requirements are too high. I am implementing my own using Intel AMT SDK. Based onthe description of the problem, it seems that your configuration server cannot establish a connection with your AMT device. The configuration server was able to receive the "Hello" message (The last 2 lines keep repeating every 2 minutes) but cannot start the configuration process. There arethree possible reasons why this happened. First, a firewall might be running on your server which prevents the SCS to send the configuration data on the specified port (make sure that the port on your server is open). Second, if you don't have a DHCP server the IP address of your AMT device (in this case: 192.168.0.61)might be the same with the IP address of the host PC, which should not be. Third, the preprovioning parameters set on the AMT device might be incorrect or incomplete which prevents the configuration server to establish the TCP/IP connection.

I suggest you install a packet sniffer on your configuration server and make sure that the TCP/IP handshaking is correct. You can download and install Ethereal (http://www.ethereal.com) for free.

Another thing that can happen is your DHCP server can change the IP address in the middle of the process - but based on your error messages, I don't think this is the case. Have you entered your FQDN (Fully Qualified Domain Name?) In the soon-to-be released SCS 3.0, the UUID comes over in the hello packet and then once you finish editing the system's info (by entering in the FQDN) the system can complete the process.(I am not sure about how the SCS 1.2 release does things.) Also, Virtual Walker suggests - check that firewall on your AMT client - if it's up, there will be no provisioning (I have a blog on this as it has bitten me quite a few times!)

Hi Maria,

You mentioned above that:

SCS machine is NOT set to "provisionServer" in my DNS but the SCS IP address is set at the MEBx.

Page 52 of the "Intel AMT SCS Installation and User Manual" states the following:

The DNS must have information for two entities:The SCS Server must be registered in the DNS.A configured, operational Intel AMT device must be registered within DNS.

Intel SCS

Any platform running the SCS Service (the Main Service) must be registered in the DNS as ProvisionServer. This must be done in each DNS Domain. When it sends its Hello message, the Intel AMT device first uses the domain name received from the DHCP server. If there is more than one SCS in the domain, the DNS will alternate between the servers. If there multiple SCS instances or the server platform has a different name, then CNAME records need to be added to the DNS.

Intel AMT Devices

Ensure that the DNS is configured with the Fully Qualified Domain Names (FQDN) of the Intel AMT-enabled machines that are being configured.

Intel AMT devices must be configured to have the same FQDN as the host OS. This stems from the fact the Intel AMT device is not a secure DNS client and it relies on the host OS to maintain the DNS record. For this reason, the Intel AMT device snoops the DHCP requests and responses issued by the host OS. The Intel AMT device then uses the IP provided by the DHCP to the host OS as its own.

Hi Maria,

This may be a simple test, but can you verify that you can ping the device? Try to reboot the client AMT system and let it enter windows. I have noticed that sometimes the Manageament engine is by default configured to be off when the client is off. This means that the AMT firmware is not "alive" when the system is off, usually this setting is updated when the system is provisioned.

Can you maybe specify what model your AMT client is and are you sure that the firmware is the latest available version, it is always worth looking into that as i have found that many "bugs" dissapear on my clients once i update the firmware.

The periodic reappearance of the error (the 2 lines that you mentioned) means that your configuration server has periodically received the "Hello" message from the AMT device but was unable to configure the device. An AMT in setup mode periodically sends a "Hello" message at an increasing interval until such time that the configuration server finishes configuration.

Based on my understanding of the problem, the configuration server has tried to configure your device but was not able to establish TCP/IP connection with your AMT device.
Are you using port 9971 on your server? If you are using port 9971, please verify using ethereal that there is a packet from (server)9971 > (client)16994. If you can see this packet, we can be sure that there is no hardware/software (windows firewall/officescan personal firewall) firewall running on your system. Look for these packets:

(client)16994 > (server)9971 SYN
(server)9971 > (client)16994 ACK

The second line is the acknowledgement packet.

If the SCS and AMT device were able to establish a TCP/IP connection, the next possibility is that the connection was established but the authentication of the PSK has failed. PSK stands for preshared keys which is composed of your AMT username, password, PID and PPS. Make sure that these parameters are stored in you SCS. I believe these are stored in the MS SQL express database.



I hope this helps:)

Hi Maria:

If this is the version of your firmware:

My MEBx panel is integrated with the general BIOS access.
My current firmware version is: 2.0.5-build 1124

Your BIOS Version would then be 5434, dated October 16, 2006. Since then there have been 12 updates.

The current version is: BIOS version 5882, ME firmware build: 2.1.3.1031 production signed, dated April 13, 2007

You might want to keep an eye on the following link:

http://downloadcenter.intel.com/Filter_Results.aspx?strTypes=all&ProductID=2372&OSFullname=OS+Independent&strOSs=38

I don't know if the trouble you are having with Provisioning has anything to do with the age of your firmware, but I think it is time you updated your system (there have been a lot of problems fixed in the last 12 releases)

When you go out to that link to get the most current firmware, there will be directions on how to do it. It is actually very easy.Make sure you look through the Readme and Release files as well.

One thing that I have run into lately is that when I try to do the upgrade it gives me an error concerning privileges - there is actually a command documented where you run the upgrade program from a cmd window and you enter the ME username and password. Let us know if you run into this problem. I'm guessing that if the system is in an unprovisioned/factory state with the default password you may not have to do this.

Gael

Hi Maria,

I have used that command and it does work great. The only reasons why I would think that it might not work are as follows:

1. Are you logged on as "Administrator" or at least as a user with administrator privileges?

2. Your current board revision cannot be flashed with AMT 2.1 firmware. It looked to me like you were still running AMT 2.0. Does your system have at the minimum a C0 processor? If you are still on a B-stepping you will need an upgraded board in order to get to AMT 2.1 functionality.

If your problem is "2", then find the latestFirmware Buildin the archives link that is still 2.0.x - anyFirmware revision that has 2.1.x will apply to AMT 2.1.

Maria,

Here is some more reasons for the "cannot connect back to AMT" error:

• 
  The current password of the security key entered to the MEBx doesnt match the MEBx password (most common reason).


• 
  Duplicate DNS registration (two host names bind the same ip) .


• 
  The SCS profile TLS PSK is configured to be plain text, the AMT machine doesnt support this.

I hope this helps!

That's good to know Maria!

I have not experienced that since my systems are not on any external networks and therefore the first thing I do is disable the virus protection programs and the Firewall!

Thanks for sharing!

A security program on the AMT machine?! I think this is surprising since no software (firewall or antivirus) can block AMT since it is snooping on the ethernet card.

Ooops...i see...I got it wrong. I stand corrected.