PAM-CMN-5142 and PAM-CMN-5135 error when adding a cluster site

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

An attempt to add a cluster site following instructions on documentation page Add Sites to Your Cluster fails with the following error:

PAM-CMN-5142: Save to cluster failed for following reasons: PAM-CMN-5135: <new node address> SAVING FAILED - Access Denied to Appliance - Please check your Synchronization settings and try again..

Environment

PAM cluster, any release as of May 2024.

Cause

The members of the new site already were members of an active cluster. They had been running as an independent cluster in a DR site and that DR cluster was not turned off before adding the new site containing the DR nodes to the production cluster.

Resolution

When adding a new site make sure that the PAM nodes you are configuring in that site currently run as standalone PAM appliances and are not members of a different active cluster.

If you have the problem already, delete the new site from the Configuration > Clustering > Global Settings page while logged on to the primary site leader. Then turn the DR cluster off. Verify that you have the same shared key configured under Local Settings. Now you can add the new site again.

We recommend to add the site with just one node in it to keep the process as simple as possible. Once that completes successfully, you can log on to the remaining nodes one at a time and follow procedure Add a Member to a Site While the Cluster is Up to add them to the cluster. Make sure each addition completes and the node shows in sync on its own Configuration > Clustering > Status page as well as on the same page on one of the primary site nodes, which show the status of all cluster members, before moving on to the next node. There may be a lag between the actual status and what is shown on the Status page. Use the "Refresh Replication Status" button to refresh the status. If it does not turn green for an extended period of time, contact PAM Support. In Clusters with a very large database it can take an hour or so before a node is available and in sync.