The IDR is correctly configured and can communicate with the Access Console. However, it does take a while for the initial setup sequence to complete between the IDR and the Access Console. The time this will take to complete is dependent on the amount of data that must be transferred between the two devices and network latency.
There is a configuration issue that is preventing the IDR from successfully connecting to the Access Console.
There is a network issue preventing the IDR and the Access Console from communicating
If the IDR is still Inactivein the Access Console, the IDR and the console may just need more time to complete their initial setup sequence.
If the IDR cannot communicate with the Access Console, the network diagnostics will indicate an issue. For example:
Secure Connection (tun0)
Connection State: Not connected. Cannot connect to the hosted service.
To troubleshoot configuration, systematically check each item as follows:
If you have not done so already, download and complete the current version of either the RSA SecurID Access SSO Agent Solution Architecture Workbook - US Region or the RSA SecurID Access SSO Agent Solution Architecture Workbook - EMEA Regionfor the region where RSA hosts the Cloud component of your deployment (currently either US or EMEA). Workbooks are available from RSA SecurID Access Downloads page (maintenance contract required). The region for your deployment can be determined from the URL you use to login to the Access Console:
When completing the workbook, use the spreadsheet tab that best describes the architecture of your deployment (that is, one IDR, IDR with standby, HA, HA with Single Standby, etc.).
Enter your deployment-specific data only into the pale yellow cells.
The items that must be configured for RSA SecurID Access will be automatically generated in the bottom half of the spreadsheet page, under the heading Your Summary, based on the data you enter into the yellow cells. It is therefore vital that you ensure the data you enter into the yellow cells is 100% correct.
Step through the tasks given in the Setup Checklist for the SSO Agent and Identity Assurance, starting at Task 1 and completing all tasks, up to and including, the task to "install and configure the identity router." Compare what you have configured to the values specified under Your Summary in the RSA SecurID Access SSO Agent Solution Architecture Workbook that you completed.
If the above does not resolve the issue, some additional steps that can be taken. These are:
Check the IDR's Network Diagnostics again to see if there has been any change. If the status is now Connected or Connecting you may just need to wait a while longer for the IDR to show as Active in the Access Console.
Contact your network administrators and your ISP to discuss any issues that may be preventing connectivity. Check gateway, firewall (that all ports listed in the Workbook under Your Summary are open), NAT, DNS (configured as specified in Workbook Your Summary), etc .
RSA strongly recommends that you Follow the RSA SecurID Suite Service Notifications page and check the Inbox option, to be emailed automatically by RSA about upgrades, planned maintenance, outages and anything else that may affect the service.
When registration of a new IDR is failing, there is no benefit when you have problems to delete the IDR object from the Access Console. You can, if you need to, delete the IDR's VM image from your VMWare server and create a new one, and you can go back into the Access Console and generate a new registration code to try again with the new VM image. Deleting an IDR from the Access Console should not be done unless you have been advised to do so by RSA Support.