Prepare for a Privileged Access Manager live upgrade
search cancel

Prepare for a Privileged Access Manager live upgrade

book

Article ID: 457033

calendar_today

Updated On:

Products

CA Privileged Access Manager (PAM) CA Privileged Access Manager - Server Control (PAMSC) CA Privileged Identity Management Endpoint (PIM) CA Threat Analytics for PAM

Issue/Introduction

Introduced in 4.3.0, the PAM Upgrade Utility allows for live upgrades without stopping the cluster. This KB article explains how to prepare the PAM environment for an upgrade using the Upgrade Utility.

Environment

Privileged Access Manager (PAM) versions 4.3.1 and above

Resolution

Upgrade Preparation Steps:

  1. Download the Upgrade Patch: The upgrade patch and any additional hotfixes for the target version can be found on the Privileged Access Manager Solutions & Patches page. Refer to the Privileged Access Manager Hotfixes documentation for a list of all published hotfixes for a given version along with a description of what defects are fixed.
  2. Review Prerequisites: Before starting, review the Upgrade Prerequisites for the specific target version to ensure the environment meets all requirements.
  3. Determine Upgrade Path: Use the Upgrading documentation page to map the upgrade path from the current version to the target version. If the current version is below 4.3.0, an intermediate upgrade to 4.3.0 is required.
  4. Review Release Information: Review the Release Information documentation page for any functional changes between versions which may impact the environment.  
  5. Perform Backups:
  6. Increase the Login Timeout: Since uploading the upgrade patch may take longer than the currently configured login timeout value, it is suggested to set the value to 0 using the instructions in Configure Global Settings. Remember to set it back to the original value once the upgrade is complete.
  7. Verify the Config User Password: The Upgrade Utility uses the config user for the interface, verify that the config password is known and up to date. Reset the Config user password if the password is unknown.
  8. Upgrade Execution: Review the Use the PAM Upgrade Utility documentation to learn the workflow of the Upgrade Utility.
  9. Upgrade Utility Appliance (Optional): If Utility Appliances are configured in the environment, refer to Upgrade PAM SC Utility Appliances in the documentation for upgrade instructions.
  10. Upgrade External Agent (Optional): If using external agents such as A2A, SFA, or Windows Proxy, it is considered best practice to upgrade them to match the version. Refer to the A2A Client and Socket Filter Agent documentation pages for upgrade instructions. For Windows Proxy, use the Uninstall a Windows Proxy and Install a Windows Proxy documentation pages.

Optional Preparation Steps:

  1. Diagnostic Preparation: The Upgrade Utility generates an SSH debug patch which can be downloaded from the appliance for PAM during the duration of the upgrade. It is no longer a requirement to apply the SSH debug patch and enable remote debugging services prior to an upgrade, but may still be beneficial to do. Use the Applying the PAM SSH debug patch and enabling SSH debug services KB article to check that the latest SSH debug patch is installed and SSH Debug services are enabled. If the patch is older than 6 months, contact Broadcom Support to obtain the newest version. This is critical for support troubleshooting if issues arise during the upgrade.
  2. Enable Maintenance Mode: It is no longer suggested to enable maintenance mode during an upgrade since there is minimal downtime with the Upgrade Utility, but if it is still desired to prevent user logins during the upgrade, refer to Configure System Diagnostics Options for instructions.

Additional Information

For information about preparing for an upgrade to version 4.3.0 or below, refer to KB367349- Prepare for a Privileged Access Manager upgrade (legacy method)

Powered by Wolken Software