Install a Windows Jumpoint

Setup of a Jumpoint on a remote network is a multi-step process that includes configuring from the /login administrative interface, downloading the installer, and running the installation wizard.

Understand clustered Jumpoints

Before configuring a Jumpoint, it is important to understand the difference between clustered Jumpoints and stand-alone Jumpoints, because they have different feature sets and because a clustered Jumpoint cannot be converted to stand-alone, nor a stand-alone Jumpoint converted to clustered. A clustered Jumpoint allows you to install up to ten redundant nodes of the same Jumpoint on different host systems in the same local network.

A clustered Jumpoint is available as long as at least one of the installed nodes is online. This provides redundancy, preventing the failure of all Jump Items associated with the failure of a single, stand-alone Jumpoint, and improves load balancing across the system.

All configuration of clustered Jumpoints is done in /login, with no local configuration available on the local host either during or after the installation. This means that if you install a clustered Jumpoint, selecting the BeyondTrust Jumpoint Configuration item on the start menu of the Jumpoint host does not result in a configuration window, and only an About box is shown. Editing a clustered Jumpoint in /login loads the same configuration page that was used to create the Jumpoint.

Configure

1. From the /login administrative interface, go to Jump > Jumpoint.
2. Click Add.
3. Create a unique name to help identify this Jumpoint. This name should help users locate this Jumpoint when they need to start a session with a computer on the same network.
4. Set a code name for integration purposes. If you do not set a code name, PRA creates one automatically.
5. If you have a Password Safe integration, and the Jumpoint for External Jump Item Sessions selection is set to Automatically Selected by External Jump Item Network ID, on the /login Security page, enter the External Jump Item Network ID. This value is equivalent to the Workgroup attribute for managed systems in Password Safe. It is matched against the Network ID property of external Jump Items returned by the Endpoint Credential Manager to determine which Jumpoint handles the session.
6. Add comments to help identify this Jumpoint.
7. Select Windows for the Jumpoint Platform. Once the Jumpoint has been created, this option cannot be changed.
8. Leave the Disabled box unchecked.
9. Check the Clustered box, if appropriate. Once the Jumpoint has been created, this option cannot be changed.

ℹ️

Note

A clustered Jumpoint allows you to install up to ten redundant nodes of the same Jumpoint on different host systems on the same local network. If this option is selected, the Jumpoint will be available as long as at least one of the installed nodes is online. This provides redundancy, preventing the failure of all Jump Items associated with the failure of a single, stand-alone Jumpoint, and improves load balancing across the system. All configuration of clustered Jumpoints is done in /login, with no local configuration available during the install. Once created, a clustered Jumpoint cannot be converted to stand-alone, nor a stand-alone Jumpoint converted to clustered.

⚠️

Important

Jumpoint cluster nodes must be installed on hosts residing in the same local area network.

10. If you want users to be able to connect to SSH-enabled and Telnet-enabled network devices through this Jumpoint, check the Enable Shell Jump Method option.
11. If the Enable Protocol Tunnel Jump Method option is checked, users may make connections from their systems to remote endpoints through these types of Jumpoint.If Network Tunnel Jump is enabled on your system, then when Enable Protocol Tunnel Jump Method is checked, there is an option to enter Managed IP Addresses for Protocol Tunnel Jump. You can enter multiple IP address ranges. This allows using the Network Tunnel feature on networks without DHCP.
12. Under RDP Service Account, select the vault account to be used by the Jumpoint to run a user-initiated client on the RDP server. This allows you to collect additional event information from an RDP session started with this Jumpoint. This account in used only if the Remote RDP Jump Item is configured to enable the Session Forensics functionality. This option is not available for Linux Jumpoints.

ℹ️

Note

The RDP Service Account setting must not use a local admin account, and must use a domain account with sufficient privileges on the endpoint to remotely connect to the endpoint's ADMIN$ share, remotely create and start services on the endpoint machine, and access remote file systems.

13. If you check Enable Jump Zone Proxy, you can set up this Jumpoint to function as a proxy server, allowing it to proxy connections for Jump Items on the network that do not have a native internet connection, such as POS systems. Using a Jumpoint as a proxy routes traffic only to the B Series Appliance.

You can enable Jump Zone Proxy on either a standalone Jumpoint or a Jumpoint cluster. If you set up a Jumpoint cluster as a Jump Zone Proxy, then if an endpoint is connected to one Jump Zone Proxy and that system goes down, the endpoint can connect to another Jump Zone Proxy in the cluster.

1. Optionally, under Proxy Host, you can enter the hostname of the machine on which this Jumpoint will be installed. Do not start the hostname with http://_or _https://. IP addresses are not recommended as they might change. The Jumpoint will automatically detect the hostname if one is not provided. If this is a clustered Jumpoint, this field does not appear, and the Jumpoint will automatically detect the hostname on install. If the hostname changes, you may have to redeploy any Jump Items that use this Jumpoint as a proxy.

   ℹ️

   Note

   The proxy host and port should be set carefully since any Jump Item deployed using this Jumpoint as a proxy server uses the settings available to it at the time of deployment and are not updated should the host or port change. If the host or port is changed, the Jump Item must be redeployed.

   In order for a Jumpoint to function as a Jump Zone Proxy, its host system cannot reside behind a proxy. The Jumpoint must be able to access the internet without having to supply proxy information for its own connection.

2. Under Proxy Port, enter the port through which Jump Items will connect to this Jumpoint. If the port changes, you may have to redeploy any Jump Items that use this Jumpoint as a proxy.

   ℹ️

   Note

   It is a best practice to make an exception in the Windows firewall for the port on which the proxy server listens for the process to accept connections.

3. Check Allow HTTP GET to enable HTTP connections to proxy to the B Series Appliance. This is needed only if you want to use a browser to access /login or /console from behind the proxy.

4. Under Restriction Type, select No access restrictions to allow Jump Item connections from any IP address. You can limit allowed connections by selecting Deny access only for the following IP addresses or Allow access only from the following IP addresses, then entering network address prefixes, one per line. Netmasks are optional, and they can be given in either dotted-decimal or integer bitmask format. Entries that omit a netmask are assumed to be single IP addresses.

5. Under Allowed Users, you may authorize users to start sessions through this Jumpoint. After you have created the Jumpoint, you can also grant access to groups of users from Users & Security > Group Policies.

6. Save the configuration. Your new Jumpoint should now appear in the list of configured Jumpoints.

ℹ️

Note

Once you have installed the Jumpoint and started it at least once, PRA populates the table with the hostname of the system it is installed on, as well as with that system's public and private IP addresses. This information can help you locate the Jumpoint's host system in case you need to change the Jumpoint's configuration.

Download

Now that your Jumpoint is configured, you must install the Jumpoint on a single system in the remote network you wish to access. This system serves as the gateway for Jump sessions with other computers on the remote network. You can either install the Jumpoint directly on the host or email the installer to a user at the remote system. If this is to be a clustered Jumpoint, you can add nodes later.

1. From the table, find the appropriate Jumpoint and click the link to download the installer file.
2. If you have access to the system you want to use as the Jumpoint host, you can run the installation file immediately.
3. Otherwise, save the file and then email it to the remote user to deploy on the system that will serve as the Jumpoint host.

ℹ️

Note

If you need to change the Jumpoint's host system, click Redeploy. This uninstalls the Jumpoint from its current location and sets the download links as available. You can then install the Jumpoint on a new host. The new Jumpoint replaces the old one for any existing Jump Items that are associated with it. The new Jumpoint does not copy over the configuration from the old Jumpoint and must be reconfigured during installation.

ℹ️

Note

The Jumpoint EXE installer can be deployed through a command line interface or a systems management utility, such as Microsoft Intune. When deploying an EXE installer, the /S option can be specified for a silent installation, without any user interaction on the target system. When the /S option is used, the Jumpoint installer uses the default installation options.

bomgar-jpt-24cf209c6aab939fc418813b9723995ev.exe /S

ℹ️

Note

The Jumpoint installer expires 7 days after the time of download.

Install

1. From the system that will host the Jumpoint, run the installation package. When the installation wizard appears, click Next.
2. Read and accept the waiver agreement. You must accept the agreement to be able to proceed with the installation.
3. Read and agree to the disclaimer.
4. Choose where you would like the Jumpoint to install. The default location is C:\Program Files\Bomgar\Jumpoint\your-site or C:\Program Files (x86)\Bomgar\Jumpoint\your-site. Click Install.
5. If you are installing a single Jumpoint, the Jumpoint Configuration application opens to allow you to configure proxy settings. The proxy configuration steps are documented in the section below. If you are installing a clustered Jumpoint node, the installation finishes.
6. After installing the Jumpoint, you receive a confirmation message. Click Finish.

Once the Jumpoint is installed, the configuration options can be modified using the Jumpoint Configuration application, which you can access from the Windows Start menu.

Clustered Jumpoint setup: add nodes

The steps for creating a clustered Jumpoint in /login are the same as for a standalone, except that once you have created the clustered Jumpoint, you can add nodes to it. At least one node needs to be installed for the Jumpoint to be online.

Click the Add Node link to download the installer file.

If you have access to the system you want to use as the Jumpoint host, you can run the installation file immediately.

Otherwise, save the file and then email it to the remote user to deploy on the system that will serve as the Jumpoint host.

Follow the prompts and install the node. Note that there are no configuration screens. Once installed, the clustered Jumpoint shows the new node as installed, associated information, such as the public and private IP addresses, and whether a node is online or offline, as well as the number of nodes installed.

Nodes can be deleted but cannot be individually edited. In the access console, none of the nodes are visible; only the Jumpoint under which they are installed is visible. Nodes function as redundant connection points. When a user needs to use the Jumpoint, Privileged Remote Access selects one of the nodes at random. At least one node must be online for the Jumpoint to work.

ℹ️

Note

A clustered Jumpoint allows you to install up to ten redundant nodes of the same Jumpoint on different host systems on the same local network. If this option is selected, the Jumpoint will be available as long as at least one of the installed nodes is online. This provides redundancy, preventing the failure of all Jump Items associated with the failure of a single, stand-alone Jumpoint, and improves load balancing across the system. All configuration of clustered Jumpoints is done in /login, with no local configuration available during the install. Once created, a clustered Jumpoint cannot be converted to stand-alone, nor a stand-alone Jumpoint converted to clustered.

Deploy behind proxy

ℹ️

Note

In the case of clustered Jumpoints, there is no customization at the local level. As a result, you will not see the configuration window that allows for proxy settings. If you are installing a clustered Jumpoint, you can skip the following steps and go directly to Clustered Jumpoint setup: add nodes.

For a Jumpoint to be deployed on a remote network that is behind a proxy, appropriate proxy information may be necessary for the Jumpoint to connect back to the BeyondTrust Appliance B Series.

1. From the dropdown on the Proxy tab in the Jumpoint Configuration application, select Basic or NTLM to configure proxy settings.
2. Enter the Proxy Host, Proxy Port, Username and Password, and then click OK. The Jumpoint supplies the proxy information whenever Jumping to another system on the remote network, providing the credentials necessary to download and run the endpoint client on the target system.

Jumpoint through a Jumpoint deployed as a proxy server

You can configure a Jumpoint to go through another Jumpoint deployed as a proxy server. This allows secure access to isolated, non-routable, OT networks without being constrained to only Jump Clients. Follow these steps:

1. On System 1, install a Jumpoint configured as a Jump Zone Proxy server.
2. On System 2, which can be non-routable and on a network isolated from the internet, install a Jumpoint.
3. On System 2, configure the Jumpoint's basic proxy configuration to point to the Jump Zone Proxy on System 1.
4. You can now create new Jump Items using the Jumpoint on System 2, for endpoints in the same isolated network as System 2, and start sessions with them through the Jump Zone Proxy on System 1.

ℹ️

Note

The Jump Zone Proxy, whether standalone or clustered, must be deployed to the target network before installing the Jump Client or Jumpoint used to create Jump Items. This enables automated discovery of the broadcasting proxy.

Automated discovery works only if the installing Jumpoint or Jump Client is on the same subnet as the Jump Zone Proxy or if you have configured mDNS broadcasts to route across networks.

ℹ️

Note

You currently can’t daisy chain Jump Zone Proxies, so System 2 can’t also have Jump Zone Proxy enabled and connect out through the System 1 Jump Zone Proxy. Thus, Jump Client Jumps likely will not work since they would need to connect directly to System 1’s Jump Zone Proxy. However, remote push works. Other Jump types get their proxy configuration from the Jumpoint’s bomgar.ini file, so if the Jumpoint itself is able to connect then other Jump types should also be able to connect.