RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.0.x, 8.1.0
With RADIUS authentication requests, the Real Time Authentication Monitor may show no entry for several reasons, so check the RADIUS Client statistics to look for rejects in Authentication Manager 7.1, 8.0 and 8.1.
Authentication requests are silently discarded, or dropped, with nothing displayed in the Real Time Authentication Monitor or Authentication Activity Report.
Running tcpdump, Wireshark or sniffer network packet capture shows authentication requests set from the agent on 5500 UDP, but there are no replies coming back out of the Authentication Manager server.
See article000049426 - Using tcpdump to troubleshoot authentication issues with RSA Authentication Manager 8.x for instructions using the tcp dump command.
Following the steps in the article, run the command ./tcpdump -i eth0 -s 1514 -Z root port 5500.
In addition, proof of a silent discards will be seen in the /opt/rsa/am/server/logs/imsTrace.log
If logging is set to verbose, (see 000053729 - How to turn on/off verbose offline authentication logging), the source IP address of the unknown agent will be listed as an error. For example,
2014-03-07 09:55:21,121, [[ACTIVE] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'], (AgentAccessSQL.java:130),
trace.com.rsa.authmgr.internal.admin.common.dal.sql.DataObjectAccessSql,
ERROR, PACEC81.credito.bcp.com.pe,,,,Unable to lookup class
com.rsa.authmgr.internal.admin.agentmgt.dal.Agentwith ip address: 192.168.1.5
In Authentication Manager 8.0 and the base version of 8.1, auth requests from unknown authentication agents were silently discarded.
Silent discards can also occur when the Authentication Manager 8.x server does a reverse name lookup (for example, nslookup <IP_address>) of the agent's IP address and a name that is different from the configured agent name (including no name) is returned from DNS or /etc/hosts. This should be fixed in Authentication Manager 8.0 patch 8.
If the agent exists but you still get silent discards, verify that:
- The IP address is correct.
- The agent is not disabled
- The gent name is spelled correctly. Compare with reverse DNS lookup of the IP address. If nslookup <IP_address> returns a name different then what is listed for the agent, either fix name resolution or change the name in the Security Console.
- You may need to delete and re-create the agent.
- If this is a RADIUS client, you may need to regenerate the node secret for the RADIUS server entry, or the RADIUS client's associated agent. RADIUS silent discards can be seen in RADIUS client statistics.
Related Articles
Remote Management Module (RMM or RMM4) card keeps disconnecting 159Number of Views Workflow for Provisioning Requests 17Number of Views Can the KCA OneStep SSL certificate private key be kept on a HSM? 11Number of Views Devices Deleted From Manage Monitored Devices Keep Coming Back 35Number of Views Windows agentless account keeps locking out. 16Number of Views
Trending Articles
How to manipulate imported RSA SecurID Software Token(s) on an iPhone or iPad device Manual synchronization introduced in RSA Authentication Manager 8.2 Service Pack 1 patch 6 Quick Setup Guide - Passwordless Authentication in Windows MFA Agent for Active Directory How to verify NTP server synchronization is not working in RSA Authentication Manager 8.x RSA Governance & Lifecycle 8.0.0 Installation Guide