Identity Router Update Fails without being Distressed
2 years ago
Article Number
000067940
Applies To
RSA Product Set: SecurID Access
RSA Product/Service Type: Identity Router
RSA Version/Condition: all
Issue
After attempting to update the Identity Router from the Cloud Admin Console, the update fails without being distressed afterwards.

The Network Diagnostics page on the management console of the Identity Router shows a network connection issue to the repo URL.

 
Cause
The repo URL is not resolvable by the DNS Server currently used by the Identity Router. 

To check the Network Diagnostics page, open a browser and go to https://<IDR Management Portal IP>/login.jsp >> Diagnostics >> View Network Diagnostics
image.png

To check whether the repo URL is resolvable by the DNS server or not, SSH into the IDR and execute the below command: 
wget --no-check-certificate -S https://public-apprepo-pwcampbell.access.securid.com
from the output seen below, the repo URL is not resolvable, hence the error in the Diagnostics page: 
Resolving public-apprepo-pwcampbell.access.securid.com (public-apprepo-pwcampbell.access.securid.com)... failed: Name or service not known.

wget: unable to resolve host address ‘public-apprepo-pwcampbell.access.securid.com’
​​​​​​
​
Resolution
The DNS server used by the IDR needs to be replaced by another DNS server that can resolve the repo URL. To do so: 
  1. Open a browser and go to https://<IDR Management Portal IP>/login.jsp 
  2. Click on 'Network Settings' at the top of the page. 
  3. Under 'DNS Configuration', change the IP address of the DNS server to one that can resolve the repo URL, such as Google's DNS public server 8.8.8.8 for example. (This DNS server could be an internal server or a public server, but it needs to be able to resolve the repo URL)
  4. Click on 'Update IDR Setup Configuration'
  5. Update the Identity Router from the Cloud Admin Console. 
To check whether the repo URL is resolvable by the new DNS server or not, SSH into the IDR and execute the below command: 
wget --no-check-certificate -S https://public-apprepo-pwcampbell.access.securid.com/
from the output seen below, the repo URL is resolvable:  
Resolving public-apprepo-pwcampbell.access.securid.com (public-apprepo-pwcampbell.access.securid.com)... 52.188.41.46

Connecting to public-apprepo-pwcampbell.access.securid.com (public-apprepo-pwcampbell.access.securid.com)|52.188.41.46|:443... connected.

 
Don't see what you're looking for?