Unable To Join PAM AWS Clusters With On-Premise Cluster

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Over the weekend, I tried to join PAM clusters deployed in AWS (Oregon, Frankfurt & Sydney) with the On-Premise cluster. Only the Oregon cluster was successfully joined. The other 2 had this error message below:

 

Error: PAM-CMN-5083: Unable to turn on the cluster because one or more cluster members failed cluster start checks.

PAM-CMN-5128: 10.10.10.10: NTP not properly configured.

 

 

For the Oregon cluster, I didn't have to define any NTP details. I'll need to know why this is coming up on the other 2. I'll also checked the Security groups defined in AWS to established connection with PAM and it looks in order.

 

 

Environment

Release : Any

Cause

NTP was failing for different reasons from each region. One region could not access the NTP service through their firewall and another was simply not resolving the FQDN defined for the NTP service.

Resolution

At this time it does appear that NTP is available internally in AWS through Amazon Time Sync Service 169.254.169.123 or time.aws.com (See Amazons link for the latest information on this service https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html  )

 

Setting the NTP service to Amazons internal service worked.