How to configure a load balancer for RSA Identity Routers

[#1]

Article Number

000036718

Applies To

RSA Product Set: SecurID Access
RSA Product/Service Type: Identity Router

Issue

• Configuring the RSA Cloud Authentication Service for high availability means using more than one RSA Identity Router (IDR).  A load balancer is used to distribute authentication sessions between the IDRs.
• Any such high availability configuration must meet the IDRs' Load Balancer Requirements, such as session persistence.
• The steps for configuring a load balancer will differ between load balancer vendors, models and versions. 
• This article provides our best effort guidance on configuration of common load balancers, based on RSA's testing, in some cases, and feedback from our customers in others.

Task

Configurations for some common load balancers are given in the Resolution section below.  These are configurations that RSA, and/or our customers, have found to work well in the past.

If you require further assistance, or your load balancer is not on the list below:

• Please contact your load balancer support team or vendor, for help configuring the device to meet the RSA Identity Routers' Load Balancer Requirements.
• Refer the article 000035216 - Single sign-on with RSA SecurID Access is failing intermittently.
• RSA Customer Support can provide best effort advice only for detailed load balancer configuration.  If need be, Support can work with you and your load balancer support team or vendor to answer questions about IDR requirements, or to assist with troubleshooting any issues that arise.

Resolution

Kemp

To configure session persistence in a Kemp load balancer:

• Set the Persistence Mode to Active Cookie.
• Do not enter a cookie name.

Citrix Netscaler

• Refer to Netscaler Loadbalancing Configuration for RSA Via Access IDR Cluster.