Cannot upgrade to PAM Utility 2.0 appliances

Products

• CA Privileged Access Manager (PAM)
• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

We currently have  several Utility Appliance (UA) 1.0  configured and running after the upgrade to 4.2.0. While they are currently functional we cannot remove any of them from the 1.0 Utility Group in order to start upgrading one at a time while using the same IP for the new UA 2.0 .

 

PAM-UTL-0105: Failed to create/update Utility Group cluster. Please see the logs for more details.

 

PAM-UTL-0018: Appliance in Utility Group UTA_Group with id 33001 were not changed as requested because of results of rebalancing.  Attempted devices were pamsc-uta2, pamsc-uta1, pamsc-uta3. Actual devices are pamsc-uta2, pamsc-uta1.Upgrading to PAM Utility 2.0

Cause

PAM 4.2.0 and higher provides full support for the UA 2.0 but only limited support for UA 1.0 servers. UA 1.0 nodes cannot be added or removed from Utility Groups. Due to limitations in this procedure the UA 1.0 group will first need to be deleted in order to allow the UA 1.0 devices to be properly deleted. After both the UA 1.0 groups and devices are deleted, the IP's can then be reused for the new UA 2.0 devices.

Resolution

After deleting the UA1.0 group you will not be able to recreate UA 1.0 groups in PAM 4.2.0 and higher so the upgrade should be done as one step.

 

Steps to upgrade from UA 1.0 to UA 2.0

1. Delete the UA 1.0 group

2. Delete the UA 1.0 devices

3. Add the new UA 2.0 devices 

4. Create a new UA 2.0 device group

5. Add UA 2.0 devices to the UA 2.0 group

6. Enable services for the UA 2.0 group

 

After completion, the existing endpoint will be able to connect to the new utility appliances 2.0 in the same fashion as the old 1.0 appliances.

Additional Information

For more information on adding Utility Appliances see

Configure PAM to Communicate with Utility Appliances  Configure Utility Appliances