Each identity router contains two active network interfaces: proxy and management.
The proxy interface is used for all interaction between users and protected applications. The management interface is used for interaction between the identity router and the on-premise network components that are part of the RSA SecurID Access deployment.
RSA recommends that the proxy and management interfaces are located on separate subnets for security reasons. The identity router does not bridge traffic between the two interfaces.