Prepare for a Privileged Access Manager upgrade (legacy method)

Products

• CA Privileged Access Manager (PAM)
• CA Privileged Access Manager - Server Control (PAMSC)
• CA Privileged Identity Management Endpoint (PIM)
• CA Threat Analytics for PAM

Issue/Introduction

It is required to routinely upgrade Privileged Access Manager in order to add the newest features and fixes. Use this KB article to download the upgrade patch and prepare for a PAM upgrade.

Environment

Privileged Access Manager (PAM) appliances up to version 4.3.0

Resolution

Upgrade Preparation Steps:

1. Download the Upgrade Patch: The upgrade patch and any additional hotfixes for the target version can be found on the Privileged Access Manager Solutions & Patches page. Refer to the Privileged Access Manager Hotfixes documentation for a list of all published hotfixes for a given version along with a description of what defects are fixed.
2. Review Prerequisites: Before starting, review the Upgrade Prerequisites for the specific target version to ensure the environment meets all requirements.
3. Determine Upgrade Path: Use the Upgrading documentation page to map the current version to the target version. In some scenarios, intermediate upgrades may be required.
4. Review Release Information: Review the Release Information documentation page for any functional changes between versions which may impact the environment.  
5. Perform Backups:
   • Database: Backup and download the database using the Configuration and Database Backups instructions.
   • Appliances: It is recommended to take a snapshot of all appliances in the environment, but at minimum one appliance should have a snapshot prior to upgrading. For VMware, take a snapshot using guidance from Cluster Maintenance. For AWS, refer to AWS AMI Backup and Recovery.
6. Diagnostic Preparation: Use the Applying the PAM SSH debug patch and enabling SSH debug services KB article to check that the latest SSH debug patch is installed and SSH Debug services are enabled. If the patch is older than 6 months, contact Broadcom Support to obtain the newest version. This is critical for support troubleshooting if issues arise during the upgrade.
7. Enable Maintenance Mode: It is suggested to enable maintenance mode on each appliance to prevent new user logins from occurring during the upgrade. Refer to Configure System Diagnostics, Maintenance, and Cluster Tuning Options for instructions.
8. Increase the Login Timeout: Since uploading the upgrade patch may take longer than the currently configured login timeout value, it is suggested to set the value to 0 using the instructions in Configure Global Settings. Remember to set it back to the original value once the upgrade is complete.
9. Upgrade Execution: Follow the appropriate documentation depending on the specific environment (Single Appliance page, Cluster page, or Multi-Site Cluster page).
10. Upgrade Utility Appliance (Optional): If Utility Appliances are configured in the environment, refer to Upgrade PAM SC Utility Appliances in the documentation for upgrade instructions.
11. Upgrade External Agent (Optional): If using external agents such as A2A, SFA, or Windows Proxy, it is considered best practice to upgrade them to match the version. Refer to the A2A Client and Socket Filter Agent documentation pages for upgrade instructions. For Windows Proxy, use the Uninstall a Windows Proxy and Install a Windows Proxy documentation pages.

Additional Information

For information about preparing for an upgrade to version 4.3.1 higher, refer to KB457033- Prepare for a Privileged Access Manager live upgrade