BeyondTrust Appliance B Series Installation Prerequisites

This guide walks through the initial setup and configuration of your BeyondTrust Appliance B Series. Should you need any assistance, please log into the Customer Portal to chat with Support.

Requirements

Until the B Series Appliance's prerequisites are met, you will not be able to directly reach your B Series Appliance by its IP address or hostname, nor will you be able to check for updates or use it to provide privileged access.

To complete setup, the B Series Appliance requires the following at minimum:

  • Two available power outlets
  • A high-speed network connection
  • A network router or switch
  • A unique, static IP address for the B Series Appliance
  • A private DNS A-record resolving to the static IP of your B Series Appliance
    • A public A-record and public IP are also required if external clients require access to the B Series Appliance.
  • An SSL web server certificate, intermediate SSL certificate, and SSL root certificate, or 1 Self-Signed certificate. Additional information can be found in the SSL Certificate Requirements section.
  • The BeyondTrust software licensing package

More advanced configurations could require additional items, such as:

  • An SSL root and intermediate SSL certificate(s) for BeyondTrust mobile clients
  • A public DNS A-record to allow public network access
  • Multiple web server certificates and/or SAN or wildcard certificate(s) to allow access from multiple DNS A-records
  • Multiple static IP addresses to isolate client traffic from multiple networks requires
  • Outbound access to the public internet over TCP port 443 to configure automatic updating and advanced BeyondTrust technical support

 

No client software (e.g., consoles, Jump Clients, Jumpoints, etc.) can be downloaded, installed, or used until BeyondTrust Technical Support builds a software licensing package for your B Series Appliance and you install it per the instructions provided by Support. Because this license package is encoded with the DNS A-record of the B Series Appliance as well as its SSL certificate, these must be in place before the license package can be completed.

Initial Setup

Ensure the following steps are completed before the BeyondTrust hardware is delivered and installed:

  1. Allocate the necessary rack space for the B Series Appliance. Ensure the space has the necessary power and network access.
  2. Reserve a static IP address for the B Series Appliance on the network, described in The BeyondTrust Appliance B Series in the Network.
  3. Configure a DNS A-record for the fully qualified domain name (FQDN) of your new site (e.g., appliance.example.com).

A private DNS A-record resolving to the static IP address of the B Series Appliance is always necessary. A public A-record and public IP are also required if clients on public, external networks require access to the B Series Appliance.

Typical Network Setup

Network Location Considerations

Although your B Series Appliance can function anywhere in your network with internet access, you must decide where in your network you plan to install the B Series Appliance prior to this step. If you are going to access systems outside of your network, BeyondTrust recommends placing your B Series Appliance in a DMZ or outside of your internal firewall. See the location considerations table below for more details. For assistance with your firewall configuration, please contact the manufacturer of your firewall software.

The B Series Appliance must be powered down before it is unplugged it from its power source (for example, to move the appliance to connect it to the internet). If you can log into the /appliance administrative interface, go to the Status > Basics page and click Shut Down This Appliance. Manual shut down is possible if you press and release the power button one time. Wait 60 seconds for the B Series Appliance to power down before unplugging the B Series Appliance from the power source. When you reconnect the B Series Appliance at the new location, you must power up again.

Network Location Considerations for B Series Appliances
Network Location Advantages/Disadvantages

Outside your firewall

Does not require that ports 80 and 443 be open inbound for TCP traffic on your firewall. Simplifies the setup process significantly because both the representative and customer clients are built to resolve to a specific DNS; if your registered DNS resolves to a public IP address directly assigned to your B Series Appliance, no additional setup is required by you to initiate a session.

DMZ

Might require additional setup depending on your router or routers.

Inside your firewall

Requires port forwarding on your firewall and possibly additional setup of your NAT routing and internal DNS.