Configuring Imprivata Sites

Imprivata allows you to manage multiple sites, each of which may contain multiple appliances. You must set up sites when you add appliances to your enterprise.

Before You Begin

You can find useful information on your sites and enterprise in the following areas:

  • The Enterprise page of the Imprivata Appliance Console lists the appliances in your enterprise.

  • There is a link to the Imprivata Appliance Console for each appliance in your enterprise in the Appliances section of the Imprivata Admin Console Home page.

  • To review the details of a site, click on the site name in the Sites page of the Imprivata Admin Console (gear icon > Sites) to open the Imprivata site record. The contents of an Imprivata site record are detailed in Information in a Site Record.

NOTE:

For each Administrator that will manage sites, go to the gear icon > Administrator roles, and confirm they are configured to edit sites. Administrator roles are detailed in Administrator Roles (Delegated Administration).

The Sites page in the Imprivata Admin Console (gear icon > Sites option) lists the sites and some information about the appliances in the sites.

The information on the Sites page includes:

  • Name — The name of the site. The † character next to a site name on the Sites page shows which (if any) of the appliances you are currently logged into.

  • Replication Status — The current database replication status of this site:

    • Up — All G4 (fourth generation) database appliances, in this site are replicating correctly.

    • Unreachable — At least one G4 database appliance in the site is not reporting its replication status, possibly due to a network issue.

    • Warning — At least one G4 database appliance in this site is experiencing an identified problem.

    • Not applicable — A G4 site has one or more G4 service appliances but no G4 database appliances, so no database replication occurs at the site

  • If the site status is either Unreachable or Warning, then click more details... to get more information about the database replication status of each appliance at this site. See Site Appliances .

  • Computers Belonging to Site — Computers with IP addresses that fall within the IP address subnet range for this site belong to this site. Laptops with temporary IP addresses within the subnet range belong to this site as long as their IP addresses fit within the range and their Imprivata agents connect to any appliance within the site.

  • Appliances in Site — The number of appliances configured in this site.

  • Last Modified — The last time there was a change to this site.

Site Appliances

Site appliance details, including database replication status details, include:

  • If an appliance is experiencing difficulties, the Appliance Host and IP Address help you to be certain of the appliance identity.

  • If the site status is Warning, view the Connected and Replication Status columns to see if the appliance is connected and replicating. If a G4 database appliance does not show a green OK, click the appliance host name, which displays the database replication status window.

    • For G4 database appliances, the database replication status window displays a simpler status of database replication between this database appliance and the other database appliance in the G4 enterprise, plus any lag time in that replication. The replication status is normally a green OK with a 0m zero minutes lag time. If a significant lag time is shown, Warning appears in the Status column. To investigate the problem, access the Imprivata Appliance Console for this appliance, click the Operations tab, and view the Replication Status field. For more information, see that field description in System Operations.

    • For G4 service appliances, the database replication status window displays “Not applicable because it has no database” across the Connected and Replication Status columns.

  • If the site status is Unreachable, view the Connected column to see if any G4 database appliance does not show a green Yes. If any does not show a green Yes:

    • Check network connectivity to the appliance to see if there is an easily resolvable network issue.

    • Try to connect to the Imprivata Appliance Console directly at https://<IP address:81> to see if the Imprivata service is running.

    • Try to restart the appliance.

    • If the network is sound and the appliance does not respond to restarting, contact Imprivata Customer Support.

Click on the name of a site to open the site record. An Imprivata site record includes details relevant to that site and its appliances. An Imprivata site record includes:

  • A list of all Imprivata appliances that belong to this site and the number of computers that receive Imprivata service from this site:

    • Name — Shows the name of the site. You cannot change the name of the site from here; it must be changed from the Enterprise page of the Imprivata Appliance Console.

    • Appliances — The IP addresses of all appliances at this site. The † character shows which, if any, of the appliances you are currently logged into.

    • Computers Belonging to This Site— Computers with IP addresses that fall within the IP subnet range for this site belong to this site. This shows the total number of computers belonging to this site, and the number with each type of Imprivata agent.

    • Active User Sessions — If you are logged into an appliance in this site, then this shows the number of Imprivata agents currently connected.

  • Settings for the IP address subnet range for computers to be serviced in this site, failover preferences for computers in this site, and an option to configure the site to serve as a hot standby only; see IP Addresses and Failover.
  • External Servers include the user directory server. To confirm your connections to the external servers, see External Servers.

Use the IP Addresses and Failover section of the site record to configure an Active Site or a Hot Standby Site.

Failover settings let you control how and whether Imprivata agents fail over to another site if necessary. For performance reasons, Imprivata agents always fail over to other appliances within their own site first.

Configuring an Active Site

An active site handles the day-to-day Imprivata service for all computers with IP addresses in a range you set here.

To configure an active site:

  1. In the Imprivata Admin Console, go to the gear icon > Sites option.

  2. Click on the site name to open the site record.

  3. In the section IP Addresses and Failover, click Active Site.

  4. To enter an IP address range for the computers that connect to this site, click Add Another Range. You can enter multiple ranges.

    For G4 (fourth generation) enterprises, you may need to assign larger and/or more IP address ranges than for G3 (third generation) enterprises. This is because you typically use fewer sites (a maximum of two) for G4 enterprises compared to G3 enterprises.

  5. Continue with failover and other settings in this record as needed, then click Save. For information on failover settings, see Configuring Imprivata Sites for Agent Failover Across Sites below.

Configuring a Hot Standby Site

NOTE:

For G4 enterprises, hot standby sites are not needed and are not optimal, as explained in Imprivata Sites for G4 Enterprises.

A hot standby site receives an exact copy of the enterprise database, but it handles no traffic until it is needed. No computers belong to a hot standby site. Hot standby sites are typically used as disaster-recovery protection.

To configure a hot standby site:

  1. In the Imprivata Admin Console, go to the gear icon > Sites option.

  2. Click on the site name to open the site record.

  3. In the section IP Addresses and Failover, click Hot standby.

  4. Click Save.

Configuring Imprivata Sites for Agent Failover Across Sites

When you configure your Imprivata sites for agent failover across sites, users will not go offline during appliance upgrades. If your sites are not configured as follows, then Imprivata agents can fail over only to other appliances in the same site.

To configure Imprivata sites to enable agent failover to appliances in other sites:

  1. In the Imprivata Admin Console, go to the gear icon menu > Sites.
  2. Select a site from the list.
  3. In the IP Addresses and Failover section, select Allow computers belonging to this site to failover to other sites?

  4. Select primary and secondary failover sites. Select failover sites with sufficient capacity to support both failed-over and regular users.

    For G4 (fourth generation) enterprises, secondary failover sites are not needed, because Imprivata recommends having at most two sites in a G4 enterprise. For details see Imprivata Sites for G4 Enterprises.

  5. Click Save.

  6. Repeat steps 2-5 for each site in the enterprise.

For more information on agent failover, see Imprivata Agent Failover.

The External Servers section of the site record provides information about the user directory and token system servers that this site connects to. External servers can reduce network traffic and speed up authentication transactions.

In the Imprivata Admin Console, go to the gear icon > Sites and click on a site name. Use the External Servers section for:

You can override server connections for specific sites if the sites are distant from the servers and you can reduce network traffic by connecting to a more local server.

Overriding an ID Token Server Connection

Before You Begin

Configure Imprivata as a trusted RADIUS client in your external ID token system administration console. The settings on the RADIUS Connections tab are enterprise-wide, but you can override them locally in this section.

To override a connection to an external ID token server:

  1. In the Imprivata Admin Console, go to the gear icon > Sites and click on a site name.
  2. On the Edit Site page, in the External Servers section, click Add.
  3. Enter the token server connection information in the fields that are displayed.
  4. At the bottom of the page, click Save to save the connection parameters.

This procedure configures local network access for ID tokens. To configure remote network access with ID tokens, see Legacy Remote Access Experience in the Imprivata Enterprise Access Management online help.

Overriding a User Directory Server Connection

You can review connections to user directories that you set up in Adding a Network Domain. You can also override a connection, instructing a site to use a different, more local user directory server. You might do this to reduce network traffic if the user directory server is distant from the site.

Each site can communicate with any external server reachable on the network, but sites usually connect to local directory servers (domain controllers). The user account information from each user directory is replicated across all database appliances in the site and across the enterprise for a G4 (fourth generation) enterprise, so there is no need to connect to user directories that are local to other Imprivata sites.

To confirm a connection to a user directory:

  1. In the Imprivata Admin Console, go to the gear icon > Sites and click on a site name.

  2. On the Edit Site page, in the External Servers section, select the user directory to test.

  3. In the field that is displayed, enter the host name of the domain controller.

  4. Click Test Connection to test the connection.

The procedures for adding new user directories are in Adding a Network Domain and in Creating Accounts for Non-Domain Users.