Prior to the Appliance Administrator enrolling cluster members into a SPP cluster, review the enrollment considerations that follow.

Considerations to enroll cluster members

  • If there is an appliance in Offline Workflow Mode, resume online operations before adding another replica. For more information, see About Offline Workflow Mode.
  • Update all appliances to the same appliance build (patch) prior to building your cluster. During the cluster patch operation, access request workflow is available so authorized users can request password and SSH key releases and session access.
  • To enroll an appliance into a cluster, the appliance must communicate over port 655 UDP and port 443 TCP, and must have IPv4 or IPv6 network addresses (not mixed). If both IPv4 and IPv6 are available for the connection then IPv6 will be used.For more information, see Safeguard ports.
  • You can only enroll replica appliances to a cluster when logged in to the primary appliance (using an account with Appliance Administrator permissions).
  • You can only add one appliance at a time. The maintenance operation must be complete before adding additional replicas.
  • Enrolling a replica can take as little as five minutes or as long as 24 hours depending on the amount of data to be replicated and your network.

  • During an enroll replica operation, the replica appliance goes into Maintenance mode. The existing members of the cluster can still process access requests as long as the member has quorum. On the primary appliance, you will see an enrolling notice in the status bar of the cluster view, indicating that a cluster-wide operation is in progress. This cluster lock prevents you from doing additional maintenance activities.

    Once the maintenance operation (enroll replica operation) is complete, the diagram in the cluster view (left pane) shows the link latency on the connector. The appliances in the cluster are unlocked and users can once again use the features available in SPP.

    TIP: The Activity Center contains events for the start and the completion of the enrollment process.

  • The primary appliance's objects and security policy configuration are replicated to all replica appliances in the cluster. Any objects (such as users, assets, and so on) or security policy configuration defined on the replica will be removed during enroll. Existing configuration data from the primary will be replicated to the replica during the enroll. Future configuration changes on the primary are replicated to all replicas.

To enroll a replica

  1. It is recommended that you make a backup of your primary appliance before enrolling replicas to a cluster.
  2. Log in to the primary appliance as an Appliance Administrator.
  3. Go to Cluster Management:
    • web client: Navigate to Cluster > Cluster Management.
  4. Click  Add Replica to join a SPP Appliance to a cluster. 
  5. In the Add Replica dialog, enter a network DNS name or the IP address of the replica appliance into the Network Address field, and click Connect.

  6. Your web browser redirects to the login page of the replica. Log in as normal, including any two-factor authentication. After successful log in, your web browser is redirected back to the web client.

    1. Enter a valid account with Appliance Administrator permissions.

    2. In the Add Replica confirmation dialog, enter the words Add Replica and click OK to proceed with the operation.

    SPP displays (synchronizing icon) and (lock icon) next to the appliance it is enrolling and puts the replica appliance in Maintenance mode while it is enrolling into the cluster.

    On all of the appliances in the cluster, you will see an "enrolling" banner at the top of the cluster view, indicating that a cluster-wide operation is in progress and all appliances in the cluster are locked down.

  7. View the link latency: Once the maintenance operation (enroll replica operation) is complete, click on an appliance to see the link latency. The appliances in the cluster are unlocked and users can once again make access requests.

  8. Log in to the replica appliance as the Appliance Administrator.
    Notice that the appliance has a state of Replica (meaning it is in a Read-Only mode) and contains the objects and security policy configuration defined on the primary appliance.