Question:
What case "Agent IP" and "Client IP" become Authentication Manger own IP address when authenticate with RADIUS client?
Background:
A customer recorded that "Agent IP" and "Client IP" were Authentication Manger own IP address in Authentication log.
The end-user, when this case was occurred, had any error nothing like authentication failuer. So, the customer would like to know what case this is occurred.
The customer use RADIUS client,CISCO ASA , to authenticate with AM.
The log is that:
| Log Level | Date and Time | Action ID | Activity Key | Description | Action Result Key | Result Key | Result | User ID | User First Name | User Last Name | User Security Domain | User Identity Source | Agent Type | Agent Name | Agent IP | Agent Security Domain | Authentication Method | Policy Expression | Argument 1 | Argument 2 | Argument 3 | Argument 4 | Argument 5 | Argument 6 | Argument 7 | Argument 8 | Token Serial Number | Argument 10 | Instance Name | Client IPv4 | Client IPv6 | Server Node IP | More Arguments | Actor GUID | Session ID |
| ERROR | 2020/xx/xx 09:44:30.000 | 13002 | Principal authentication | User “xx07343” attempted to authenticate using authenticator “OnDemand”. The user belongs to security domain “SystemDomain” | Failure | AUTHN_METHOD_FAILED | Authentication method failed | xx07343 | xxxx@test.local | xx | SystemDomain | Internal Database | 7 | am-pri.test.local | 192.168.11.11 | SystemDomain | OnDemand | | AUTHN_LOGIN_EVENT | 6 | 3 | | | | | 22360c2a0b31bd855954a6f55a032ab5 | xxxx@test.local | | am-pri.test.local | 192.168.11.11 | | 192.168.11.11 | | b2751e520b31bd8571c5b198f736a14c | c1128e5e0b31bd8516fe58c2ecf55b47-lrGOTdQNoSLH |
| ERROR | 2020/xx/xx 11:27:29.000 | 13002 | Principal authentication | User “xx80026” attempted to authenticate using authenticator “SecurID_Native”. The user belongs to security domain “SystemDomain” | Failure | AUTHN_METHOD_FAILED_SYNTAX_ERROR | Authentication method failed, passcode format error | xx980026 | xx980026 | xx | SystemDomain | Internal Database | 7 | am-pri.test.local | 192.168.11.11 | SystemDomain | SecurID_Native | | AUTHN_LOGIN_EVENT | 6 | 3 | | | | | | | | am-pri.test.local | 192.168.11.11 | | 192.168.11.11 | | 0f4c7f8c0b31bd851f676e7988876ccd | 8e73e07f0b31bd8567e69c18f8ec7902-Ne2STZNsnNdl |
| ERROR | 2020/xx/xx 13:50:51.000 | 13002 | Principal authentication | User “xx91536” attempted to authenticate using authenticator “SecurID_Native”. The user belongs to security domain “SystemDomain” | Failure | AUTHN_METHOD_FAILED_SYNTAX_ERROR | Authentication method failed, passcode format error | xx991536 | xx991536 | xx | SystemDomain | Internal Database | 7 | am-pri.test.local | 192.168.11.11 | SystemDomain | SecurID_Native | | AUTHN_LOGIN_EVENT | 6 | 3 | | | | | | | | am-pri.test.local | 192.168.11.11 | | 192.168.11.11 | | 0efd5a390b31bd855792980523443b21 | e33da23c0b31bd856fc75f2bb1df97b4-+sKMcC8Fs9rk |
| ERROR | 2020/xx/xx 08:06:13.000 | 13002 | Principal authentication | User “xx07322” attempted to authenticate using authenticator “OnDemand”. The user belongs to security domain “SystemDomain” | Failure | AUTHN_METHOD_FAILED | Authentication method failed | xx07322 | xxxx@test.local | xxxx | SystemDomain | Internal Database | 7 | am-pri.test.local | 192.168.11.11 | SystemDomain | OnDemand | | AUTHN_LOGIN_EVENT | 6 | 3 | | | | | 9e65a5320b31bd853607a68f36c02375 | xxxx@test.local | | am-pri.test.local | 192.168.11.11 | | 192.168.11.11 | | 9de1b0b10b31bd8512c067105bf20672 | 056e6f2e0b31bd85568b22899c6450ba-884RKO5K/JPX |
| ERROR | 2020/xx/xx 15:25:11.000 | 13002 | Principal authentication | User “xx04154” attempted to authenticate using authenticator “OnDemand”. The user belongs to security domain “SystemDomain” | Failure | AUTHN_METHOD_FAILED | Authentication method failed | xx04154 | xxxx@test.local | xxxx | SystemDomain | Internal Database | 7 | am-pri.test.local | 192.168.11.11 | SystemDomain | OnDemand | | AUTHN_LOGIN_EVENT | 6 | 3 | | | | | 928a7e610b31bd857f37aaf8cd3a1b88 | xxxx@test.local | | am-pri.test.local | 192.168.11.11 | | 192.168.11.11 | | e163c8aa0b31bd857a16f80012521da6 | 4c43f8540b31bd857b2eeaf92c39b86a-GyDfHjKL7veO |
Then, this was recorded in radius log on that time.
| /opt/rsa/am/server/logs/RADIUS/YYYYMMDD.log |
|---|
xx/xx/2020 15:25:11 Unable to find user xx04154 with matching password
xx/xx/2020 15:25:11 Sent reject response |
I understand that this error will be occurred when a user mistake to enter Passcode or invalid Secret key on RADIUS Client which is CISCO ASA in this case. But the user did not have any error. In addition, I think that "Agent IP" and "Client IP" ar does not become Authentication Manger own IP even though those case are occurred.
Ref:
000028896 - Troubleshooting RSA Authentication ... | RSA Link
https://community.rsa.com/docs/DOC-46250
