Don't use ipmitool over LAN, try to use local IPMI Device Interface. For that, connect to the computer whose BMC you want to control, load ipmi_devintf and and don't specify any connection parameters, just the command:
# lsmod | grep ipmi
...
ipmi_devintf
...
# ipmiutil sensor list
ipmiutil sensor version 3.13
-- BMC version 1.71, IPMI version 2.0
_ID_ SDR_Type_xx ET Own Typ S_Num Sens_Description Hex & Interp Reading
0004 SDR Full 01 01 20 a 01 snum 01 CPU1 Temp = 36 OK 54.00 degrees C
0047 SDR Full 01 01 20 a 01 snum 02 CPU2 Temp = 00 Absent 0.00 na
008a SDR Full 01 01 20 a 01 snum 0a PCH Temp = 2d OK 45.00 degrees C
00cd SDR Full 01 01 20 a 01 snum 0b System Temp = 23 OK 35.00 degrees C
0110 SDR Full 01 01 20 a 01 snum 0c Peripheral Temp = 28 OK 40.00 degrees C
0153 SDR Full 01 01 20 a 01 snum 0d MB_10G Temp = 00 Absent 0.00 na
0196 SDR Full 01 01 20 a 01 snum 10 VRMCpu1 Temp = 29 OK 41.00 degrees C
01d9 SDR Full 01 01 20 a 01 snum 11 VRMCpu2 Temp = 00 Absent 0.00 na
021c SDR Full 01 01 20 a 01 snum 12 VRMP1ABC Temp = 23 OK 35.00 degrees C
...
I've demonstrated ipmiutil here since ipmitool wasn't installed in this (supermicro) server and I was too lazy to install ipmitool (and because ipmiutil is way better when it comes to analyzing event logs, which ipmitool parses completely wrong way), but ipmitool will work this way too.
You can also perform different things, like resetting the BMC from a host (warm or cold), configuring its network parameters, configuring users and passwords and so on. All without powering down the server and without prior knowledge of BMC configuration and passwords, only root access to the OS is needed! This uses a special private interface between the computer and BMC. Also it's standard protocol, it works on supermicro, hpe, dell, intel, lenovo, asus motherboards (those I've tried myself), probably many others would work too.
