PAM-SEN: CyberArk Sentry PAMDemo

By CyberArk · Question Mode

QuestionQ25

Installation & Configuration

After installing the Vault, you must permit Firewall Access for the Windows Time service to synchronize with NTP servers 10.1.1.1 and 10.2.2.2.

What should you do?

  • A Edit DBParm.ini to add: AllowNonStandardFWAddresses=[10.1.1.1,10.2.2.2],Yes,123:outbound/udp.
  • B Edit DBParm.ini to add: NTPServer=[10.1.1.1:123/UDP,10.2.2.2:123/UDP].
  • C Edit DBParm.ini to add: AllowNonStandardFWAddresses=[10.1.1.1,10.2.2.2],Yes,123:outbound/udp,123:inbound/udp.
  • D Edit the Windows Firewall configuration to add a rule for Port 123/udp outbound to 10.1.1.1 and 10.2.2.2.
Explanation

Windows Time synchronizes as an NTP client, requiring outbound UDP communication to each NTP server on port 123. The Vault firewall exception must therefore allow the listed non-standard addresses with an outbound UDP 123 rule; a separate inbound UDP 123 listener rule is unnecessary.

Community Discussion

No comments yet. Be the first to start the discussion!