Test Access to Cloud Access Service
20 hours ago

Test Access to Cloud Access Service

RSA maintains two Cloud Access Service (CAS) environments. When one environment becomes unavailable for any reason, your deployment automatically switches to the other environment. RSA recommends that you test access to both environments before it is needed to ensure a smooth transition during unexpected downtime.

You need to use your tenant-specific authentication and access domain names when performing connectivity tests. Each tenant-specific domain resolves to a service IP address within your assigned region. Although your tenant will typically resolve to a consistent IP address, the service may use any IP address allocated to that region. If you enforce outbound firewall rules by using IP allowlisting, you need to allow all published IP addresses for your deployment region, not only the IP address currently returned by DNS.

Note:  Additional IP addresses may be introduced as the service expands. You need to ensure your firewall policies are updated accordingly.

After your deployment is switched to another environment, the following events occur:

  • Authentication services and the Cloud Administration Console are restored as quickly as possible.

  • Domain Name Services (DNS) redirects the Cloud Administration Console and your identity routers to the new URLs for your deployment (for example, US). Make sure to whitelist the base authentication and access domain names if you are using DNS firewall rules so that identity routers can connect to the Cloud using the region-specific domain names.

  • A message is posted to the RSA SecurID Access status page with details about the event.

Before you begin

  • If your company uses URL filtering, be sure that both IP addresses for your deployment are whitelisted.

Procedure 

  1. To test access for your identity routers, on an identity router, do the following:

    1. Enable SSH on an identity router. For instructions, see Access SSH for Identity Router Troubleshooting.

    2. To test connectivity for both auth and access domains, you can use the following example with your tenant name:

      openssl s_client -connect tenantName.auth.securid.com

      openssl s_client -connect tenantName.access.securid.com

    3. To test the connectivity with region-specific domain names, you can use the following example authentication domain name:

      openssl s_client -connect tenantName-idr-useast.auth.securid.com:443

      This domain name is for the useast region of the US deployment. Enter the domain name for your deployment.

      Note:  You can obtain the tenantName from the Cloud Administration Console.

      You receive information back about the certificate chain and other details. If you are unable to reach the environment, the command eventually times out and you see SSL-related error messages.

    4. Repeat this for one identity router in each data center (or different firewall settings) in your deployment.

  2. To test access for your internal users, on an internal machine, do the following:

    1. Enter the following URL in your browser: https://tenantName.auth.securid.com.

      The domain tenantName.auth.securid.com is the US deployment domain dedicated to your tenant. Replace tenantName with the actual tenant name for your deployment.

    2. View details about the connection and confirm that *auth.securid.com is included in the certification path.

      For example, on Google Chrome, click the Not secure warning in the address bar. Then click the certificate and confirm that it is issued to *auth.securid.com.

    3. Repeat this for one internal machine in each data center (or different firewall settings) in your deployment.

  3. If you are unable to access one of the environments, confirm that you have the correct firewall and whitelist settings. For more information, see the "Connectivity Requirements" section in your Quick Setup Guide. To download a Quick Setup Guide that is appropriate for your deployment, see Cloud Access Service Planning and Configuration.

Don't see what you're looking for?