Symantec Access Management

Hello

I want to know as part of upgrade perspective (Creating New Parallel Environment) - For Example: We have 2 Policy Servers in DNS model and want to add 2 more new Policy Servers (Impact : New hostnames and New IP Addresses get in effect),

Will the functionality still works ? What will be the Implication ?

Thanks

Kapil

the explanation is lagging.

think about what is ties to IP and host: the ability to  connect to the ps from the wa.

In a simpler terms If we change the hostname and IP on Policy server itself (leaving WA right now, that we know the implication), Will the functionality works after changing the hostname and IP ..

barka, your name appears like a pmf key. are you CA? if so,, i dont understand why you have not taken CA training.

you still have only given an oddly phrased explanation that i'm going to ignore because i can't understand.

again i ask you

How does the SiteMinder  Web Agent communicate to the Policy Server?

-josh

I understand the implications from WebAgent standpoint. It won't be able to connect to Policy Server after the Policy Server host Name has been change. And I am okay with that...

For now, I am only trying to find out if changing IP Address and Host Name of a Policy Server has any implication on functionality of Policy Server itself. OR in other words, will Policy Server function as expected after the host name and ip address has been changed....

thank you for expanding.

Start up on Policy Servers has changed over the years. If you are CA you have better access to start up steps for your version than others on this forum such as myself.

Are you CA? (i ask because it means you have more options than if you are  not)

what is the version you are using?

what have you tried for determining this?

have you thought about how the entropy and generation of things such as encryption key work on your version and os?

again, the details provided are lacking at best.

in college i was told something that i think applies here "requests for assistance are a type of question. same rules apply. go read this" and a link to a very early (0.x) version of "how to ask questions the smart way"

here's the url: How To Ask Questions The Smart Way

please note i AM trying to help. the issue is that the phrasing you gave is, as the link states, inherently flawed. you asked for an answer without showing much thought. i'm trying to get you to think  and show us that.

Yes am CA and the version is R12.52 SP1 on Windows 2008 R2 for Policy server after upgrade, we are trying to plan for an upgrade from R12.0 SP3 to R12.52 as thinking in perspective in complex Environment where are couple of Policy server machines are being used and keeping in mind from upgrade perspective, the functionality won't hamper after we change the host name of policy server machine and IP Address from functionality perspective. Yes I know how handle the encryption keys and entropy stuff.. So I hope you got some understanding now..

From changing the hostname and IP address perspective, Yes we need to modify SMHost.conf , HCO and Re-Register Admin UI in order to get it work.. I know if they are using hostnames everywhere in their enviornment (FQDNs), DNS controller will resolve the IP address for all the other machines in domain controller and it will gonna work. To be very precise these machines are in AD domain as a part of domain members..

Thank you for the added information. You should double check with engineering...

I recall that it was  either HostName or IP that  the policy server used on install that is one of the factors that makes cloning a server and then modifying those cause issues.

Afterthought

So as to avoid disrupting Engineering, i would first reach  out to support if i were you. starting with Jim Burns and  Steve McQuiggan if they are still there.

Thanks Josh. Sure I will, yeah they are still there :-)

Hi there,

I see that your question is still unanswered completely.

The SiteMinder policy server functioning itself has no dependency on the policy server hardware box's IP address/hostname  (for e.g the encryption key or policy

server configuration , policy store loading etc are not dependent on the IP address/hostname of the policy server).

As you have rightly pointed out only thing that is dependent on it is the Policy server and Web Agent trusted communication for which you will basically need to do two things :

-Update Policy server IP/hostname in SmHost.conf

-Update Policy server IP/hostnmae in HostConfig object.

There is also a technote on this :

http://www.ca.com/us/support/ca-support-online/product-content/knowledgebase-articles/tec532450.aspx

Hope this helps.

Cheers,

Ujwol