BeyondTrust Hardware Prerequisites
This guide walks you through the initial setup and configuration of your Secure Remote Access Appliance. Should you need any assistance, please contact BeyondTrust Technical Support at https://www.BeyondTrust.com/support.
Before starting, it is important to know that until the Secure Remote Access Appliance's prerequisites have been met, you will neither be able to reach your appliance directly by its IP address or hostname nor be able to check for updates
- One or two available power outlets, depending on your appliance (one for the B200, two for the B300 or B400)
- A high-speed network connection
- A network router or switch
- A unique, static IP address for the Secure Remote Access Appliance
- A private DNS A-record resolving to the static IP of your appliance. A public A-record and public IP will also be required if external clients will need access to the appliance.
- An SSL web server certificate + intermediate SSL certificate(s), and SSL root. OR, 1 Self-Signed certificate.
(See the SSL Certificates and BeyondTrust Guide.)
- The BeyondTrust software licensing package
While these meet the minimum requirements, more advanced configurations may require additional items. For example:
- BeyondTrust click-to-chat and mobile clients require an SSL root and intermediate SSL certificate(s).
- Access from external public networks require a public DNS A-record.
- Access from multiple DNS A-records require either multiple web server certificates and/or SAN or wildcard certificate(s).
- Isolating client traffic from multiple networks requires multiple static IP addresses.
- Automatic updating and advanced BeyondTrust technical support require outbound access to the public internet from the Secure Remote Access Appliance over TCP port 443.
No client software (e.g., representative console
Several steps should be taken before the BeyondTrust hardware is delivered and installed:
- Allocate the necessary rack space for the appliance. Ensure the space has the necessary power and network access.
- Reserve a static IP address for the appliance on the network. Refer to the following guides in order to reserve the correct IP address(es):
- Configure a DNS A-record for the fully qualified domain name (FQDN) of your new site (e.g., support.example.com).
A private DNS A-record resolving to the static IP address of the appliance will always be necessary. A public A-record and public IP will also be required if clients on public, external networks will need access to the appliance.
Although your appliance can function anywhere in your network as long as the appropriate users and machines can reach it, you will need to decide where in your network you plan to install the appliance prior to this step. If you are going to access systems outside of your network, BeyondTrust recommends placing your appliance in a DMZ or outside of your internal firewall. See the table below for more details. For assistance with your firewall configuration, please contact the manufacturer of your firewall software.
If you must move the appliance to another location to connect it to the internet, you will need to power down before you unplug it from its power source. If you can log into the /appliance administrative interface, go to the Status > Basics page and click Shut Down This Appliance. Manual shut down is possible if you press and release the power button one time. Wait 60 seconds for the appliance to power down before unplugging the Secure Remote Access Appliance from the power source. When you reconnect the appliance at the new location, you will need to power up again.
Outside your firewall
Does not require that ports 80 and 443 be open inbound for TCP traffic on your firewall. Simplifies the setup process significantly because both
May require additional setup depending on your router or routers.
Inside your firewall
Requires port forwarding on your firewall and possibly additional setup of your NAT routing and internal DNS.