Duplicate authorization request for RADIUS on Authentication manager 8.x
3 years ago
Article Number
000068022
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: RSA Authentication Manager
RSA Version/Condition: 8.x
RADIUS Client: Cisco ASA
Issue
Under certain conditions, when a RADIUS Cisco ISE client sends an authentication request to the Authentication Manager, a duplicate request gets sent at the same time stamp as shown in the below figure:
image

The Packet capture of this behavior shows that the requests are sent at the same time stamp as shown below
image.png
 
Cause
Troubleshooting this issue is tricky as there could be multiple causes for it, however in this particular use case the Root cause is that the RADIUS client from Cisco side is sending an Authentication request, which gets accepted, and a duplicate Authorization request which is not compliant with the format of requests that the authentication manager can accept, hence the error "Authentication method failed. Passcode format error".

In order to troubleshoot this further and verify that it is indeed a duplicate authorization request:
  1. Open the Operations Console of the Primary instance
  2. Go to Deployment Configuration > RADIUS Servers
  3. Under the Server that receives the requests, click on Manage Server Files
  4. Click edit on the radius.ini file
  5. Change the value of debug and trace value to 2 (For more info, refer to the following article https://community.rsa.com/t5/securid-knowledge-base/enable-radius-debug-verbose-logs-with-all-versions-of-rsa/ta-p/3816)
  6. Now that the debug trace is enabled, try to authenticate one more time, then return the radius log values back to 0
  7. Open a winSCP session on the instance in question
  8. Login to the instance facing the issue as rsaadmin and enter the operating system password.
  9. Navigate to the following directory: /opt/rsa/am/radius
  10. Open the date.log file corresponding to the day the packet was captured (For example: if today is 28th of November 2022 then the name of the file should be 20221128.log)
  11. Navigate through the file to the timestamp corresponding to when the packet was sent in debug mode
  12. You should be able to identify both requests as the given error belowimage.png
Resolution
  1. If this is the case, then the customer should be able to disable their authorization duplicate request by going to the Cisco ASA management console > Open the AAA server group > edit IPsec Remote Access Connection profile > set the profile for the server group to none to disable authorization as shown in the below screenshot
 image.png
​​​​​​​

Related Articles

Trending Articles

Don't see what you're looking for?