Besides full SPP updates with Smart Update Manager, iLO 5 (ProLiant Gen10/Gen10 Plus) and iLO 6 (Gen11) can flash firmware directly from the web interface. iLO also has a built-in iLO Repository where signed components, install sets and the System Recovery Set are kept. This guide shows when to use each and the cautions HPE gives. For a full baseline update, use the SPP and SUM.
Before you start
- An iLO account with the Configure iLO Settings privilege; the Recovery Set privilege as well if you will touch the System Recovery Set.
- A signed firmware component from HPE Support Center (the iLO 6 guide asks for a
.fwpkgcomponent for Update Firmware). - If the server uses drive encryption or other software that stores data in the TPM, suspend it or back it up first.
- A maintenance window: most server firmware needs a reboot or power cycle to take effect.
Check what is installed
Click Firmware & OS Software in the navigation tree. The Installed Firmware page lists firmware for each component. The data is refreshed only when the server is powered on and POST completes, so a component updated from the host may show its new version only after an iLO or host reset.
Step 1 — Get the right file
- Server components: download the component from HPE Support Center. System ROM updates must be a signed image or signed ROMPAQ image.
- iLO itself: download the iLO Online Flash Component for Windows or Linux and extract the
.binimage. On Windows, double-click the file and click Extract. For a Linux RPM, HPE documents:
rpm2cpio <firmware_file_name>.rpm | cpio -idStep 2 — Flash firmware from the web interface
- For Server Platform Services (SPS) firmware only: power off the server and wait 30 seconds (on iLO 5 the same applies to Innovation Engine firmware, and IE must be updated before SPS).
- Click Firmware & OS Software, then Update Firmware. If it is hidden on a narrow window, use the ellipsis icon at the top right.
- Choose Local file and browse to the component, or Remote file and enter its URL on a reachable web server.
- Optionally tick Also store in iLO Repository to keep a copy.
- On servers with a TPM, after suspending encryption software, tick Confirm TPM override.
- Click Flash and confirm with OK.
- After an iLO firmware update, iLO reboots and closes your session; clear the browser cache and log in again. Then confirm the version on Installed Firmware.
On iLO 6, HPE notes that Update Firmware does not work for packages that must be applied by UEFI or a runtime agent. Upload those to the iLO Repository instead; they are picked up for installation during POST.
When the new firmware takes effect
| Firmware type | Action needed (per the HPE iLO user guide) |
|---|---|
| iLO firmware, language pack | Takes effect after an automatic iLO reset. |
| System ROM (BIOS) | Server reboot. |
| System Programmable Logic Device (CPLD) | Server reboot, which iLO converts to an AC power cycle. |
| Power Management Controller, NVMe backplane | No reboot needed. |
| Server Platform Services (SPS) | Power off before installing; active after power on. |
Do not boot or reboot the server during a PLDM firmware update; HPE warns it can put the server in standby for about 20 minutes. iLO also limits each firmware type to 20 flash attempts (successful or failed) per 24 hours.
The iLO Repository
The iLO Repository is 1 GB of non-volatile flash on the system board (the iLO NAND). iLO, the UEFI BIOS and SUM can install the signed components stored there.
- Click Firmware & OS Software, then Upload to iLO Repository.
- Select a local or remote file. If the component is split into several files, tick I have a component signature file and supply the matching
.compsigfile. iLO has a 32 MB transfer limit per file. - Click Upload. A component with the same name replaces the existing one.
To install a stored component, open the iLO Repository tab and click the install icon next to it. You can tick Set schedule window and pick a maintenance window or a time window. The button reads Yes, install now when the queue is empty and iLO can start the update itself; otherwise Yes, add to the end of the queue. A component can be removed from the repository only if it is not in an install set or a queued task.
Install sets and the installation queue
An install set is a group of components applied with one command. SUM creates install sets and copies them to iLO; HPE notes that saving one when you deploy from SUM lets you restore or roll back a component later without the original SPP. To run one, open Firmware & OS Software > Install Sets and click the install icon next to it. An install set can hold up to 35 components.
The Installation Queue tab shows tasks in order. A component task starts only when earlier tasks finish and the software that installs that component type picks it up. A component that the UEFI BIOS installs waits for the next POST, and every task behind it waits too, so reboot the server or remove the blocked task. Tasks not started inside their time window expire and must be edited or recreated.
System Recovery Set
Every server ships with a protected install set, the System Recovery Set. On Intel servers it contains the System ROM, iLO firmware, CPLD, SPS firmware and the SPS Full Recovery Image; on AMD servers the System ROM, iLO firmware and CPLD. Only users with the Recovery Set privilege can change it, and iLO Firmware Verification uses it when set to Log and Repair Automatically.
Warning: Ticking Update Recovery Set during a flash or upload replaces that component in the recovery set even if the recovery set version is newer. If the System Recovery Set is deleted, HPE documents recreating it only through the iLO RESTful API and the RESTful Interface Tool. Only change it with tested firmware, and keep copies of the original components.
Downgrade policy
Under Security > Access Settings, the Update Service category has a Downgrade Policy (shown only when a licence that supports it is installed; the licensing guides list Update Service access settings under iLO Advanced):
- Allow downgrades (default) — any user with Configure iLO Settings can downgrade.
- Downgrade requires Recovery Set privilege — HPE notes that automatic recovery of BIOS, iLO and CPLD then fails and must be done manually by a user with that privilege.
- Permanently disallow downgrades — no user can downgrade.
Warning: "Permanently disallow downgrades" cannot be reversed through any iLO interface or utility, and a factory reset does not clear it. Firmware downgrades themselves can break compatibility: back up first and downgrade only on HPE support advice.
Frequently asked questions
Should I use iLO Update Firmware or the SPP?
Use iLO for a single component or the iLO firmware itself. For a tested baseline across all components, use the SPP with SUM, which handles dependencies and order.
Why is my queued update not starting?
An earlier task may be waiting for the UEFI BIOS to pick it up during POST. Reboot the server, or edit or remove that task on the Installation Queue tab.
Checklist
- Installed firmware versions noted before the update.
- Signed component downloaded; encryption software suspended on TPM servers.
- Firmware flashed and the required reboot or power cycle done.
- Installation queue empty or understood; no blocked tasks.
- System Recovery Set intact; downgrade policy set on purpose.
- IML checked for update errors.
Skyline can supply, configure and maintain Dell, HPE and Huawei servers under an annual maintenance contract (AMC). Contact us.
Comments
0 total · 0 threads