SailPoint VA Privileged Cluster – VA Stuck in Draft State After Re-Pairing

Identity Security Cloud (ISC) ISC Discussion and Questions
, , ,
1

Hello everyone,

We’re encountering an issue while deploying a SailPoint VA (Virtual Appliance) in a privileged cluster setup and are seeking advice or suggestions from anyone who has faced a similar situation.

Background:

  • We created a privileged cluster and downloaded the VA image from the UI.
  • The VA was deployed using this image, and everything initially worked fine — the cluster was live and healthy.
  • However, after about 24 hours, we lost connectivity with the VA.
  • There were no helpful details in the logs, and the VA appeared unresponsive.

Recovery Steps Taken:

We decided to reset and re-pair the VA by performing the following steps in order:

  1. va-bootstrap reset
  2. Deleted the old VA from the UI and created a new one
  3. va-bootstrap set-passphrase
  4. va-bootstrap pair

We received a “successful pairing” message in the UI, which instructed us to wait up to 30 minutes for provisioning.

Screenshot 2025-07-17 093321
Screenshot 2025-07-17 0933211692×1281 118 KB

Current Issue:

  • It’s now been over 4 hours, but the VA is still stuck in the “Draft” state.

Screenshot 2025-07-17 133609
Screenshot 2025-07-17 1336091686×575 20.3 KB

  • There’s no progress or clear errors, and we’re not sure what the next steps should be.

Has anyone experienced something similar with:

  • VA stuck in Draft state after re-pairing?
  • Unexpected loss of connectivity after initial successful deployment?

Any insights, troubleshooting tips, or guidance on what might be going wrong (or how to proceed) would be highly appreciated.

Thanks in advance!

2

I suggest please start building from scratch. If your using any cloud delete existing bucket and re import va image in a newly created bucket and start build image as per sailpoint documentaion. Then it will work

3

I had a very similar type of problem , I can’t keep on creating new VA evertime , raised the ticket with sailpoint and they fixed it from backend.

4

Thanks @HussainshaSyed001 : We will keep it as a last option.

5

Thank you @vishal_kejriwal1 , did they explain what was the reason it did not pair.?

6

most of the times i see we have not to much exposer to what is going behind the scene unlike iiq.

7

We had a support case for this issues. We could get our network team and sailpoint support in joint troubleshooting session.

The reason we found for VAs being corrupted is after VA is installed, it tries to upgrade to latest image. Due to Firewall issues it could not connect to aws to fetch latest image. Even though we had all fireall openings performed as per Sailpoint documentation, the support team informed us that for some customers wildcard firewall settings does not work. Our firewall setup appeared to be one of those.

After we received specific URLs and firewalls opened for them we could get VA upgraded and connected.