000011986 - Silent discard of authentication requests in RSA Authentication Manager 8.0 and 8.1; Authentication fails without log entry

Document created by RSA Customer Support Employee on Jun 14, 2016•Last modified by RSA Customer Support on Aug 3, 2018
Version 3Show Document
  • Comment • 0
  • View in full screen mode

Article Content

Article Number000011986
Applies ToRSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.0.x, 8.1.0
 
IssueWith RADIUS authentication requests, the Real Time Authentication Monitor may show no entry for several reasons, so check the RADIUS Client statistics to look for rejects in Authentication Manager 7.1, 8.0 and 8.1.

Authentication requests are silently discarded, or dropped, with nothing displayed in the Real Time Authentication Monitor or Authentication Activity Report.

Running tcpdump, Wireshark or sniffer network packet capture shows authentication requests set from the agent on 5500 UDP,  but there are no replies coming back out of the Authentication Manager server. 



See article 000016395 - Using tcpdump to troubleshoot authentication issues with RSA Authentication Manager 8.x  for instructions using the tcp dump command.

Following the steps in the article, run the command ./tcpdump -i eth0 -s 1514 -Z root  port 5500.  



In addition, proof of a silent discards will be seen in the /opt/rsa/am/server/logs/imsTrace.log   



If logging is set to verbose, (see 000018205 - How to turn on/off verbose offline authentication logging), the source IP address of the unknown agent will be listed as an error.  For example,
 




2014-03-07 09:55:21,121, [[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'], (AgentAccessSQL.java:130), 
trace.com.rsa.authmgr.internal.admin.common.dal.sql.DataObjectAccessSql, 
ERROR, PACEC81.credito.bcp.com.pe,,,,Unable to lookup class 
com.rsa.authmgr.internal.admin.agentmgt.dal.Agentwith ip address: 192.168.1.5
CauseA silent discard is a dropped authentication request without a corresponding entry in the Real Time Authentication Monitor or Authentication Activity Report. 

In Authentication Manager 8.0 and the base version of 8.1, auth requests from unknown authentication agents were silently discarded.  

Silent discards can also occur when the Authentication Manager 8.x server does a reverse name lookup (for example, nslookup <IP_address>) of the agent's IP address and a name that is different from the configured agent name (including no name) is returned from DNS or /etc/hosts.  This should be fixed in Authentication Manager 8.0 patch 8.
 
ResolutionIf no authentication agent exists, one can be created in the Security Console (Access > Authentication Agents > Add New).

If the agent exists but you still get silent discards, verify that:
  1. The IP address is correct.
  2. The agent is not disabled
  3. The gent name is spelled correctly.  Compare with reverse DNS lookup of the IP address.  If nslookup <IP_address> returns a name different then what is listed for the agent, either fix name resolution or change the name in the Security Console.
  4. You may need to delete and re-create the agent.
  5. If this is a RADIUS client, you may need to regenerate the node secret for the RADIUS server entry, or the RADIUS client's associated agent.  RADIUS silent discards can be seen in RADIUS client statistics.
Legacy Article IDa64464

Attachments

    Outcomes