BeyondTrust Hardware Prerequisites

This guide walks you through the initial setup and configuration of your BeyondTrust Appliance B Series. Should you need any assistance, please contact www.beyondtrust.com/support.

Prerequisites

Before starting, it is important to know that until the B Series Appliance's prerequisites have been met, you will neither be able to reach your B Series Appliance directly by its IP address or hostname nor be able to check for updates. The BeyondTrust Appliance B Series requires the following at a minimum:

  • One or two available power outlets, depending on your B Series Appliance (one for the B200, two for the B300 or B400)
  • A high-speed network connection
  • A network router or switch
  • A unique, static IP address for the B Series Appliance
  • A private DNS A-record resolving to the static IP of your B Series Appliance. A public A-record and public IP will also be required if external clients will need access to the B Series Appliance.
  • An SSL web server certificate + intermediate SSL certificate(s), and SSL root. OR, 1 Self-Signed certificate.
  • The BeyondTrust software licensing package

While these meet the minimum requirements, more advanced configurations may require additional items. For example:

  • BeyondTrust click-to-chat and mobile clients require an SSL root and intermediate SSL certificate(s).
  • Access from external public networks require a public DNS A-record.
  • Access from multiple DNS A-records require either multiple web server certificates and/or SAN or wildcard certificate(s).
  • Isolating client traffic from multiple networks requires multiple static IP addresses.
  • Automatic updating and advanced BeyondTrust technical support require outbound access to the public internet from the B Series Appliance over TCP port 443.

 

No client software (e.g., consoles, clients, Jump Clients, Jumpoints, etc.) can be downloaded, installed, or used until BeyondTrust Technical Support builds a software licensing package for your B Series Appliance and you install it per the instructions provided by Support. Because this license package is encoded with the DNS A-record of the B Series Appliance as well as its SSL certificate, these must be in place before the license package can be completed.

Getting Started

Several steps should be taken before the BeyondTrust hardware is delivered and installed:

  1. Allocate the necessary rack space for the B Series Appliance. Ensure the space has the necessary power and network access.
  2. Reserve a static IP address for the B Series Appliance on the network. Refer to the following guides in order to reserve the correct IP address(es):
  3. Configure a DNS A-record for the fully qualified domain name (FQDN) of your new site (e.g., support.example.com).

    A private DNS A-record resolving to the static IP address of the B Series Appliance will always be necessary. A public A-record and public IP will also be required if clients on public, external networks will need access to the B Series Appliance.

Typical Network Setup

Although your B Series Appliance can function anywhere in your network as long as the appropriate users and machines can reach it, you will need to decide where in your network you plan to install the B Series Appliance prior to this step. If you are going to access systems outside of your network, BeyondTrust recommends placing your B Series Appliance in a DMZ or outside of your internal firewall. See the table below for more details. For assistance with your firewall configuration, please contact the manufacturer of your firewall software.

 

If you must move the B Series Appliance to another location to connect it to the internet, you will need to power down before you unplug it from its power source. If you can log in to the /appliance administrative interface, go to the Status > Basics page and click Shut Down This Appliance. Manual shut down is possible if you press and release the power button one time. Wait 60 seconds for the B Series Appliance to power down before unplugging the B Series Appliance from the power source. When you reconnect the B Series Appliance at the new location, you will need to power up again.

Network Location Considerations for B Series Appliances
Network Location Advantages/Disadvantages

Outside your firewall

Does not require that ports 80 and 443 be open inbound for TCP traffic on your firewall. Simplifies the setup process significantly because both consoles and clients are built to resolve to a specific DNS; if your registered DNS resolves to a public IP address directly assigned to your B Series Appliance, no additional setup is required by you to initiate a session.

DMZ

May require additional setup depending on your router or routers.

Inside your firewall

Requires port forwarding on your firewall and possibly additional setup of your NAT routing and internal DNS.