1. Vault Cluster Installation

At this point we’ve created 2 disks, one for our Shared Storage (safes and metadata) and the second one for Quorum. After that, we have connected those two disk to our Vault_1 host.

In this post we’ll review the installation of the Cyberark Vault in Vault_1 node.

1. Prepare your node according with Cyberark PreInstallation tasks and start de Cyberark Vault Installer as usual. When promted for Vault Installation mode, choose Cluster-node Vault Installation

2. When prompted to choose the Safe location path, specify a path that is located on the shared storage of the cluster environment.

   

3. When promted for Master and administrator password, go to dbparm.ini and create a new Firewall rule pointing to our storage Private IP [ADCore]. This will override hardening for iSCSI connection

1

AllowNonStandardFWAddresses=[10.200.10.10],Yes,3260:outbound/tcp,3260:inbound/tcp

4. Set a Master and a Administrator password

5. Finish the installation Wizard but do not restart the machine yet

6. Configure the Cluster Storage by running PrivateArk\Server\ClusterVault\StorageManager.exe. Do this from an elevated command prompt

   

   Configuring Storage Manager

   Before running StorageManager.exe, make sure Quorum disk is online using the Windows Disk Management utility.

   Specify the following parameters as input in UPPERCASE:

   –q<DRIVE_LETTER> – Defines the Quorum drive letter.

   –s<DRIVE_LETTER> – Defines the Shared Storage drive letter.

7. Let’s configure the Network Cluster Vault. Open the ClusterVault.ini file in the PrivateArk\Server\ClusterVault\Conf\ folder :

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

[Environment Name]
ClusterLogicalName=Cluster.Blubank
LocalNodeLogicalName=Vault1
PeerNodeLogicalName=Vault2
[Networking]
NetworkCardName=CyberarkEcosystem #Name of the PublicNetwork Network Interface
VirtualIP=10.200.0.13
PeerNodePrivateIP=10.200.10.12
PeerNodePublicIP= 10.200.0.12
LocalNodePublicIP=10.200.0.11
LocalNodePrivateIP=10.200.10.11 
[Storage]
StorageIdentifier = {2D952099-EFB6-4817-A099-E150E50E6194}
QuorumDiskIdentifier = {8D75ED62-C0AD-44F7-95B5-63C26DB7BCF3}
[Advanced Settings]
PeerNodePort=18581
HealthCheckInterval=10
RetryCountOnFailure=1
ResourceControlTimeout=60
QuorumChallengeDuration=10
SharedConfigurationDirectory=E:\PrivateArk\ClusterVault

8. Now we can Start the Vault Services by click play button at Cluster Vault Management. Everything should look like this:

   

9. Check the ClusterVault console log , the following message will appear in the ClusterVaultConsole.log:

   

10. Now is time to harden the Vault. Make sure to provide arguments for the hardening script:

    

11. Reboot system, check Logs and check Cluster Vault Management Panel.

2. Conclusions

Network configuration is paramount at this point of the deployment. Having a well planned network configuration and storage configuration from the beggining will make the Cyberark HAVault cluster deployment easier.

In the next post we’ll be installing Vault_2