PAM appliance boot up dependency

[Sandeep Sharma]

Hi community members,

 

I have a query pertaining to recovery of PAM (v3.2.4) virtual appliance (VM snapshot) in the DR environment.

In the DR environment, when I boot up a VM snapshot of PAM soft appliance (standalone instance, snapshot was taken after cluster was broken in Production environment), the following is observed:-

1. It takes longer time than usual for the appliance to boot up i.e. for the console with PAM menu options to appear.
2. After the appliance has booted up, as per item 1, loading the login or legacy configuration page takes extremely long time i.e. >10 mins. Even after the page loads, I am unable to proceed with recovery i.e. upload the DB backup* to restore the appliance due to slow response from PAM. In a way the system seems to be unresponsive.

 

Note: The DB backup was taken from one of the PAM cluster node's in the Production environment.  

 

It is to be noted that, when the same VM image of soft appliance is booted up in the Production environment, there is no slowness in boot up and in loading the PAM web UI. Restoration using DB backup is also successful.

 

As per tests done by the network team (ping, telnet, traceroute etc.), there is nothing blocking the traffic between the laptop (PAM web UI) and the PAM appliance in DR environment.

 

It is suspected that the cause of "slowness" could be that the PAM appliance is trying to connect to 3^rd party/ external infrastructure which is configured in PAM e.g. AD, SMTP, 2FA/ SML solution, syslog server, NTP etc. If it cannot find one or more of these during and after boot up, it keeps trying to connect unsuccessfully which causes this unusual slowness. Is this the expected behavior?

 

Please share if anyone has encountered similar issue and resolution for the same. Thanks

 

Thanks

Sandeep

[Andreas Mueller]

Hello Sandeep,

The scenario as described basically is not valid - a snapshot backup of a PAM appliance can only be restored into the very same environment from which it was taken, fully replacing the source system.

It must not be used as a clone source to deploy additional instances of PAM into the same or other environments.

Else, legally there is a license breach, and technically unforeseen issues might appear.

As you noticed such clone is trying to establish connections to peer cluster nodes and 3rd party components.

If you have the need to clone a PAM VM, this has to be done before the very first boot of the appliance, right after deploying the OVA and configuration of the VM.

Best Regards,
Andreas

[Sandeep Sharma]

Hi Andreas,

Thanks for your response.

"As you noticed such clone is trying to establish connections to peer cluster nodes and 3rd party components."

Since the node was already removed from cluster before snapshot was taken, it should not try to connect to any peer anymore.

Also, need your help to confirm if indeed PAM appliance tries to connect to any infra e.g. SMTP, AD etc. at the time of boot up and after booting up. If it does try but is unsuccessful, would this lead to the "slowness" which is being encountered in accessing the PAM web UI?

Regards

[Ralf Prigl]

Hi Sandeep, If you experience slowness after PAM reboot, i.e. it takes a long time before the PAM UI is available again, then the boot process would play a role. If you are talking about ongoing slow PAM UI response, then the boot process is out of the picture. There can be many reasons for slow performance: Inadequate resources for the PAM VM, excessive CPU usage on the PAM appliance (you would see that on the PAM dashboard), incorrect network configuration, unresponsive DNS servers, unresponsive session recording shares. If authentication is slow it could be that the first domain controller is unresponsive and connections time out before a successful connection is made to a responsive domain controller. Also, using a web browser like IE to connect to PAM can have very poor performance while the PAM client works much better. There is no magic single answer for a performance issue. If you can't identify the cause, you can open a support case for detailed investigation.