• RADIUS authentication is successful when the associated RSA agent is enabled for group restriction. This is not expected.  It is expected to see the following message in the Authentication Activity Monitor:

• The Authentication Activity Monitor reports the RSA Authentication Manager's IP address rather than the RADIUS client's IP address in the Agent and Client IPv4 columns.

...
...
...
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
; SecurID General options
[Configuration]
Enable = 1
CheckUserAllowedByClient = 0
;DefaultProfile = DEFAULT
;AllowSystemPins = 0

...
...
...

1. Log in to the command line of the RSA Authentication Manager instance with the operating system account. This can be rsaadmin or another account configured during Quick Setup.
2. Enter the command awk '!/;/ && /CheckUserAllowedByClient/{$NF="1"} 1' /opt/rsa/am/radius/securid.ini > /tmp/securid.ini.new

rsaadmin@am84p:~> awk '!/;/ && /CheckUserAllowedByClient/{$NF="1"} 1' /opt/rsa/am/radius/securid.ini > /tmp/securid.ini.new

3. Check the value of CheckUserAllowedByClient in /tmp/securid.ini.new with the command cat /tmp/securid.ini.new | grep CheckUserAllowedByClient. For example:

rsaadmin@am84p:~> cat /tmp/securid.ini.new | grep CheckUserAllowedByClient
CheckUserAllowedByClient = 1

4. Check the differences between the original securid.ini file and the changed securid.ini.new file. Only the CheckUserAllowedByClient should have a changed value. For example, where only CheckUserAllowedByClient has changed:

rsaadmin@am84p:~> diff /tmp/securid.ini.new /opt/rsa/am/radius/securid.ini
33c33
< CheckUserAllowedByClient = 1
---
> CheckUserAllowedByClient = 0

5. Overwrite the RSA RADIUS server securid.ini file with the changed securid.ini.new file. For example:

rsaadmin@am84p:~> cp /tmp/securid.ini.new /opt/rsa/am/radius/securid.ini

6. Check the CheckUserAllowedByClient in /opt/rsa/am/radius/securid.ini is set with a value of 1. For example:

rsaadmin@am84p:~> cat /opt/rsa/am/radius/securid.ini | grep CheckUserAllowedByClient
CheckUserAllowedByClient = 1

7. Restart the RSA RADIUS server at the command line for the change to take effect:

rsaadmin@am84p:~> /opt/rsa/am/server/rsaserv restart radius
Stopping RSA RADIUS Server: ***
RSA RADIUS Server                                          [SHUTDOWN]
Starting RSA Administration Server with Operations Console: *
Starting RSA Database Server: *
RSA Administration Server with Operations Console          [RUNNING]
Starting RSA RADIUS Server Operations Console: - RSA Database Server                                        [RUNNING]             *
RSA RADIUS Server Operations Console                       [RUNNING]
Starting RSA Runtime Server: *
RSA Runtime Server                                         [RUNNING]
Starting RSA RADIUS Server: **
RSA RADIUS Server                                          [RUNNING]

8. Open real-time authentication activity monitor.
9. From the Security Console, select Reporting > Real-time Activity Monitors > Authentication Activity Monitor.
10. Click Start Monitor. 
11. Perform a RADIUS authentication, and check the authentication events.

The steps that are provided in this knowledge article avoid having to use the vi editor.

Should you have Linux and vi editor experience, an alternative would be:

1. Make a copy of the /opt/rsa/am/radius/securid.ini file.
2. Update the CheckUserAllowedByClient parameter.
3. Save the change.
4. Restart the RSA RADIUS Server.