User authentication during identity router update

[JohnMcKellep]

If i have only 1 identity router in my cluster, when i do an update on it, will users still be able to authenticate using the app or will that function cease until the update is complete? We originally starting using the app to protect access to Office365 for users when they were off our corporate network. Now we use it more for 2 factor into our VPN which is protected by RSA Authentication Managers that now can use the RSA Authenticate App as a token. So does the authentication manager speak directly to the cloud for authentication or would it still go through the identity router?

[TedBarbour]

John McKellep‌ - please see Identity Router Update Process. 

Users will not be able authenticate during the update. Your on-premise Identity Router brokers cloud service to LDAP and AM traffic.

Having more than one Identity Router is recommended for HA.

Hope that helps,

Ted

[JohnMcKellep]

Is it best to have multiple identity routers in one cluster or to have multiple clusters?

[TedBarbour]

Without an analysis of your network topology and requirements it is difficult to say for sure but recommend you read about Clusters. If you are only using a single IDR now the next logical step would be a single cluster of three IDRs to provide better resiliency to any single IDR outage. 

Note that details about your network should not be discussed here in a public forum.

[TedBarbour]

I should add if you are just using AM->Cloud with Authenticate App tokencodes or the PIN+Approve feature for your VPN then users would still be able to authenticate while the IDR is being updated. The IDR is not involved in either of those authentication use cases.