Privileged Access Manager, all versions
The PAM Client introduces additional checks to make sure the IP address and FQDN both match each other. If it detects any mismatch, the error documented in this KB may be obtained. Such is the case if, for instance, a cluster is configured with no external load balancer, but the FQDN of the cluster and the primary node name share the same IP in the DNS and the cluster VIP is not routable or it does not exist (in general this will not be allowed for a more than 1:1 cluster model, as the VIP is required for communication with the primary site from other sites when the primary site has more than one node). If such a condition is met, the PAM client will be able to perform updates, connect to the remote PAM to check versions, etc, but it will never be able to log in as it will always get a mismatch between the node name, its ip and the cluster name.
It is therefore recommended to make sure that always the cluster VIP is routable and matches the cluster name and there is a correct entry in the DNS servers that resolve vip to cluster FQDN and conversely. If a change is implemented to meet this need, it may be necessary for the cache to be cleared in order to get the right name resolution.