Chat now with support
Chat mit Support

One Identity Safeguard for Privileged Sessions 7.2 - Installation Guide

Limitations

The following limitations apply to SPS when you deploy it from the Microsoft Azure Marketplace.

Caution:

Do not export or import configuration between a physical SPS deployment and a virtual one. Because of the differences and limitations between physical and virtual appliances, configure the virtual appliance from scratch to ensure proper functionality. When you migrate a virtual SPS to another one, you can export and import the configuration.

  • Root login is not available on the console.

  • SSH access is only available after you have completed the Welcome Wizard.

  • Currently, the data that is entered during the provisioning phase (for example, the username and the IP address) of creating the virtual machine in Azure is not transferred to SPS. Therefore, only the data entered in the Welcome Wizard will be used.

  • By default, you can only use Physical interface 1 (eth0) of SPS, with a single IP address. Aside from changing the IP address of SPS, do not modify other interface-related settings (additional logical interfaces, IP forwarding, and so on) on the Basic Settings > Network page of SPS.

    The number of interfaces you can use depends on the size of your Azure VM. If your VM allows you to use multiple interfaces, you can configure multiple interfaces in SPS. For details, see VM with multiple NICs.

  • The Seal the box functionality is not available.

  • The High Availability support of SPS was designed to work between two physical SPS appliances. This feature is not available in Azure environments. For further details, see the High Availability and redundancy in Microsoft Azure.

  • Due to Azure requirements, an additional 5-minute delay has been added to the boot process. This ensures that the root device appears in the system.

  • The size of the virtual disk in Azure is 100 GB, which you can increase. To increase the size of the virtual disk, see "Modifying the disk size of a SPS virtual appliance" in the Installation Guide.

  • SPS currently cannot receive its IP address using DHCP. Make sure that:

    • The IP address you have configured in Azure and the IP address that you configure for SPS for the Physical interface 1 on the Networking settings part of the Welcome Wizard are the same. Otherwise, you will not be able to access SPS.

    • You set the internal IP static on the Network Interfaces tab of the Virtual Machine.

    • Do not assign a public IP address to SPS, use SPS as a component of your internal infrastructure. If you absolutely must configure Welcome Wizard from a publicly accessible IP address, note that SPS will be publicly accessible. If you assign a public IP to the web management interface, consider the following:

  • Upgrading SPS in Azure is the same as upgrading a physical appliance: you have to upload the firmware on the SPS web interface. For detailed instructions, see Upgrade Guide.

Azure deployment

The following describes how to have a One Identity Safeguard for Privileged Sessions running in Microsoft Azure.

To have a One Identity Safeguard for Privileged Sessions running in Microsoft Azure

  1. Deploy One Identity Safeguard for Privileged Sessions from the Microsoft Azure Marketplace

    Create and configure a One Identity Safeguard for Privileged Sessions virtual machine (VM) in the Azure portal. For details, see the Microsoft Azure documentation, here we just describe the SPS-specific settings.

    1. Login to the Azure portal, select One Identity Safeguard for Privileged Sessions from the Azure Marketplace, then click Create.

    2. Fill the required fields of the Basics blade. Note that you must fill the User name and Authentication Password/SSH public key fields, but SPS will not actually use these settings (SPS will use the parameters you configure in the SPS Welcome Wizard).

    3. Choose a size for the VM. If you want to use this machine in production and need help about sizing or architecture design, contact your One Identity sales representative.

      The number of interfaces you can use depends on the size of your Azure VM. If your VM allows you to use multiple interfaces, you can configure multiple interfaces in SPS. For details, see VM with multiple NICs.

    4. On the Settings blade, disable monitoring.

    5. When the deployment is finished, navigate to the network settings of the new VM in the Azure portal. Change the IP address of the SPS network interface to Static, and note down the IP address and the hostname (you will need it in the SPS Welcome Wizard).

    6. If you want to backup or archive data from SPS into Azure, create an Azure File Share. Note down the following information of the file share, because you will need it to configure SPS backups and archiving: URL, Username, Password.

      Caution:

      If you have multiple SPS VMs, make sure to use a separate file share for each SPS.

  2. Complete the SPS Welcome Wizard

    Complete the SPS Welcome Wizard (for details, see "Configuring One Identity Safeguard for Privileged Sessions (SPS) with the Welcome Wizard" in the Administration Guide). Note the following points specific for Azure deployments. When configuring the network settings of SPS note the following points.

    Caution:

    Do not export or import configuration between a physical SPS deployment and a virtual one. Because of the differences and limitations between physical and virtual appliances, configure the virtual appliance from scratch to ensure proper functionality. When you migrate a virtual SPS to another one, you can export and import the configuration.

    1. Into the Physical interface EXT or 1 — IP address field, enter the static IP address of the SPS VM that you set on the Azure portal.

    2. Default GW: The default gateway is usually the first address in a subnet (for example, if your subnet is 10.7.0.0/24, then the gateway will be 10.7.0.1).

    3. Hostname: Use the hostname you have configured for the SPS VM on the Azure portal.

    4. DNS server: You can use any DNS server that the SPS VM can access, even public ones.

  3. Configure SPS

    Login to SPS and configure it.

    1. Configure backups for SPS. For backup and archiving purposes One Identity recommends the built-in file shares of Azure. For details on configuring backups, see "Data and configuration backups" in the Administration Guide.

    2. Configure archiving for SPS. For backup and archiving purposes One Identity recommends the built-in file shares of Azure. For details on configuring backups, see "Archiving" in the Administration Guide. Configuring Archiving policy is highly recommended: because if the disk of the VM fills up, SPS stops working.

    3. Configure a server: set up a host that is on the same subnet as SPS, and enable Remote Desktop (RDP) or Secure Shell (SSH) access to it.

    4. Configure a connection on SPS to forward the incoming RDP or Secure Shell (SSH) connection to the host and establish a connection to the host. See "Logging in to One Identity Safeguard for Privileged Sessions (SPS) and configuring the first connection" in the Administration Guide for details.

    5. Replay your session in the browser. See "Replaying audit trails in your browser" in the Administration Guide for details.

      In case you have questions about SPS, or need assistance, contact your One Identity representative.

High Availability and redundancy in Microsoft Azure

In a Microsoft Azure deployment, the high-availability and redundancy of the SPS appliance is provided by the Microsoft Azure infrastructure, according to the Azure Storage SLA.

Redundancy

The data in your Microsoft Azure storage account is always replicated to ensure durability and high availability, meeting the Azure Storage SLA. The exact type of replication depends on your storage account settings, but every disk is stored in 3 copies.

For details, see Locally redundant storage in the Azure Storage replication document, and Service Healing - Auto-recovery of Virtual Machines.

Verwandte Dokumente

The document was helpful.

Bewertung auswählen

I easily found the information I needed.

Bewertung auswählen