PRA Atlas Deployment

We are currently configuring and validating a BeyondTrust Privileged Remote Access (PRA) ATLAS cluster running version 26.2.3 the new installation, and we would appreciate your assistance in clarifying some questions regarding Traffic Node selection and connectivity.

Environment Overview

Our environment consists of three ATLAS appliances:

• Primary: atlasprimary.xx.xx – 10.10.1.10

• Traffic Node 1: atlasnode1.xx.xx – 10.10.2.10

• Traffic Node 2: atlasnode2.xx.xx – 10.10.4.10

The public access hostname is acessoremoto.xx.xx, which resolves to the Primary appliance. The cluster is configured and synchronized, the hostnames are configured, and the wildcard SSL certificate for *.xx.xxhas been installed. The Traffic Node selection method is currently set to Random.

Issues and Questions

1. When accessing https://acessoremoto.xx.xx/console, the Web Access Console displays a “Connect to” selector with the Primary and both Traffic Nodes available. Is this the expected behavior in PRA 26.2.3? Is there a supported configuration option to hide this selector and allow users to access the console through the Primary hostname only?

2. When selecting the Primary, authentication works successfully. However, when selecting either Traffic Node directly, the console returns the error “Error connecting to server (2L)”. Is this expected when accessing a Traffic Node directly, or does it indicate a cluster configuration or connectivity issue?

3. According to the ATLAS architecture, the Primary should coordinate session initiation and select the appropriate Traffic Node. Should end users always authenticate through the Primary, with Traffic Node selection handled automatically by the cluster?

4. We have verified DNS resolution for all three appliances and confirmed TCP connectivity to port 443 on both Traffic Nodes. Direct HTTPS requests to both Traffic Nodes also return HTTP 302 redirects to their respective /console paths, while the public hostname returns HTTP 200 OK for /console. Are there any additional connectivity, certificate, or cluster health checks you recommend to troubleshoot the error?

5. Could you please confirm whether the Random selection method is the recommended configuration for this scenario, and whether any additional settings are required to ensure that users access the console through the Primary while Traffic Node assignment is handled transparently?