Install PSM in a Load-Balancing Environment

Installing multiple PSMs in an load balancing configuration offers you enhanced availability, improved performance and better utilization of hardware resources compared to an active-passive cluster.

The load balancing architecture relies on an external tool that reflects multiple PSM servers as a single IP or DNS address. PSM load balancing supports off-the-shelf load balancers.

PSM provides a service to determine the PSM service availability (health) and reports it, upon request, to the load balancer.

This section describes how to configure the PSM servers in a load-balanced environment.

Load balancing recommendations

The following recommendations are for big or small implementations, whether deployed on cloud or on premise.

To learn more, see Example of how to configure a load balancer



Application load balancing

We recommend using an application-aware load balancing platform, deployed as a reverse proxy, for both big and small implementations.

Deploy either a hardware or a virtual appliance that best addresses capacity, feature set and support options. Hardware options usually offer the greatest scalability, while virtual appliances offer added deployment flexibility.

Health monitoring

Configure the load balancer to combine RDS and PSM application-level monitoring.

For PSM, configure HTTP health check by integrating with the PSM Health Check web service, and configure TCP monitoring for RDS service health check, as recommended by Microsoft, to achieve complete active application-level monitoring.

SSL configuration

Enable SSL passthrough, to protect the communication line between the load balancer and the PSM nodes. For limited cases where the security of the communication line is not a concern, you can use SSL acceleration/termination.

Routing algorithm

Set load balancing method to least connections so the load, on average, is balanced equally between the nodes within the PSM pool.

Load balancer high availability

We recommend to setup high availability of the load balancer itself.

DNS load balancing

We recommend using DNS load balancing for both big and small implementations.


Live monitoring of other sessions is required to be routed to specific PSM hosts where the target live session resides, bypassing the normal routing algorithm.

Configure PSM to work with load balancing

This section describes how to configure PSM to work with load balancing.


  • The same version of PSM must be installed on all PSM servers in an environment with load balanced PSMs.

  • The RemoteApp feature requires a connection broker and a session collection to be associated with it. This is required, whether the connection broker is used for load balancing or not. If these prerequisites are not set up, the PSM installation will not be able to install the RemoteApp feature. If this happens, repair the installation and add the RemoteApp feature at a later stage, after setting up the the prerequisites.

  • After installing the first PSM server, before installing additional PSM servers, make sure the user who will perform installation is not a direct owner in the PSMUnmanagedSessionAccounts Safe.

PSM in a load balancing environment

This section describes how to configure CyberArk components to support PSM deployment in a load balanced environment.

A pre-requisite for this step is that PSM servers must have a virtual IP/DNS address.