Deploy Secure Tunnel

This topic describes how to set up and configure Secure Tunnel in order to securely connect to your SIEM servers and your remote access PSM servers.

For details, see Connect to SIEM and Configure the PSMs through the Secure Tunnel wizard.

To install and configure the Secure Tunnel:

1. From the Privilege Cloud software package that you downloaded in Deploy the Privilege Cloud Connector, copy the Secure Tunnel zip file and unzip the package.
2. On the Select Installation Folder page, enter the location of the installation folder, and click Install.

3. On the Ready to Install page, click Finish.

   When the installation is complete the configuration tool is launched.

   If you do not want to configure the Secure Tunnel at this time, you can close the wizard and launch the configuration tool later. When you close the installation wizard, a shortcut to the configuration tool is created on the desktop. You can open the configuration tool either from the desktop shortcut or from the installation folder at any time.

4. On the Authenticate to Privilege Cloud page, enter the Customer ID provided to you in the Welcome to CyberArk Identity Security Platform email and the installeruser name (installeruser@<suffix>) and password that you set before you started the installation process (see Before you begin).

5. On the Configure on-premise components page, add the components that you want to connect through the secure tunnel, and click Configure Components.

   Enter the following information:

   Field	Description
   Component Type	Select one of the following components: SIEM: Up to five Syslog servers can be connected to Privilege Cloud at one time. PSM-RDP: No limit to how many servers can be connected to Privilege Cloud at one time.
   Host Address	The hostname or IP address of component server. PSM for remote access uses TLS communication and must include a hostname. The following domains cannot be used as host names for Secure Tunnel configuration: *.aws.com *.amazonaws.com *.amazon.com *.cyberark.com *.cyberark.cloud
   Destination Port	The port used for connecting the Secure Tunnel server to the component server. Click Advanced to display this column. Typically, the ports used for these components are: SIEM - 1468 If you are using different ports, edit this field for the relevant component.
   Remote Port	The port used by the CyberArk to interface with your Secure Tunnel. Click Advanced to display this column. The Remote Port is provided to you by CyberArk support. Each interface has a default port. For multiple instances the ports are numbered sequentially. Typically, the ports used for these components are: SIEM - 1468 (first SIEM instance), 1469, etc.
   Access through Secure Tunnels	You can configure which Secure Tunnels your servers will access through, even if these Secure Tunnels are running on a different machine.

   

The following table includes the number of component connections, per component type, that the Secure Tunnel supports.