RSA ACE/Server Test Directly Fails for Soft Tokens on Mobile

[KhwajaZiaulHasa]

Hello,

For RSA Authentication Agent of IIS 8.0, when we install the agent and perform the test using RSA ACE/Server Test Directly it fails.

I only have software authenticators. I need to test before configuring the Exchange Server for OWA.

When we click on test it shows that it is for keyfobs, and I am testing it for software tokens.

I want to know that whether this testing utility on the agent works for Software Authenticators?

When testing through Activity Monitor I am getting error "Authentication Method Failed".

I want to know that is there any method to test Soft Authenticators for that particular agent before configuring the production Exchange.

Thanking You

Zia

[_EricaChalfin · Accepted solution]

Zia,

I see that when you are testing the RSA Authentication Agent for Web for IIS, you are seeing the error message "authentication method failed" in the authentication activity log.

When an authentication agent runs on a server that has multiple network interface cards and therefore, multiple IP addresses, you must manually specify an IP address for encrypted communications between the agent and Authentication Manager server.

The RSA agent software uses the device's IP address both for encryption and for routing packets.  When you created the agent in the Security Console, you provided an IP address for the web server, let's say 1.1.1.1.  If the agent has multiple IP addresses, and the traffic is sent out on 2.2.2.2, the Authentication Manager server does not recognize that address and will display the authentication method failed error.

Agents typically attempt to discover their own IP addresses. Left to itself, an agent with multiple addresses might select the correct IP and authentication will succeed, but if it chooses one that is unknown to Authentication Manager server, communication between the agent and server will be impossible, as in your authentication method failed error.

To avoid this, you must manually specify an IP address override on the Advanced tab of the RSA Authentication Agent Control Panel. The IP override address that you enter should exactly match the network address specified for the agent host in the server database.

For more information on how to set this up, please review the RSA Authentication Agent 8.0 for Web for IIS Installation and Configuration Guide that is in the agent software download.

Regards,
Erica

[KhwajaZiaulHasa]

Hello Erica,

Thanks for your reply. Actually it was not working, so I changed the protocol to be tcp instead of default udp and it worked.

Thanks

Zia