Removing additional routes from PAM

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

There is a need to remove an additional route in our production cluster. This was added in the past for a cluster site that is now decommissioned. PAM does not allow to make changes to the network configuration while the cluster is turned on. The only way is to take one node at a time out of the cluster, make the network change, and then put it back in. For a cluster with over 20 nodes this would be a very tedious procedure with complicated user management as you have to get users off each node before you can take it out of the cluster. Is there any workaround available, e.g. using SSH access by Support, that is transparent to PAM users and doesn't require nodes to be taken out of the cluster?

Cause

Network configuration changes are blocked by PAM on cluster nodes while the cluster is turned on to prevent the cluster from going out of sync when a mistake is made in the process.

Resolution

If your environment allows access to the PAM servers using SSH Remote Debugging Services, open a case with PAM Support to see if they can help you remove the obsolete route w/o impacting current PAM users.