View Identity Router Status in the Cloud Administration ConsoleView Identity Router Status in the Cloud Administration Console
You can view status and monitoring information for the identity routers in your deployment using the Cloud Administration Console. Use this information to help troubleshoot configuration and authentication issues.
When status changes occur, additional diagnostic information is provided in the System Event Monitor (Platform > System Event Monitor) and identity router audit logs. See System Event Monitor Messages for the Cloud Authentication Service and Identity Router Audit Log Messages .
Procedure
- Sign into the Cloud Administration Console.
-
Click Platform > Identity Routers.
The console displays the following basic status information for each identity router in your deployment:
-
Name
-
Description
-
Virtualization environment
-
Current status of the identity router
The following table describes the identity router status indicators:
Identity Router Status Description Active The identity router is connected to the Cloud Authentication Service and operating normally. Inactive The identity router is not connected to the Cloud Authentication Service. Debug The identity router is connected to the Cloud Authentication Service and debug-level logging is enabled. Distressed There is a problem with the identity router. Contact RSA Customer Support for troubleshooting assistance. Starting When a registered identity router is connected to the Cloud Administration Console, the status reads Starting until the identity router is Active.
Note: If the status does not change to Active after 10 minutes, see Troubleshooting Identity Router Issues.
Update Available The identity router is not using the latest software version. See Update Identity Router Software to install the latest software. Update Unavailable Identity router not running on SLES 12. The identity router should be replaced or redeployed. See the Identity Router 12.12.x Migration Guide.
-
- To display advanced status information for a specific identity router, click the arrow next to the identity router name.
Name of the cluster to which the identity router belongs
Date and time of the last status check between the Cloud Authentication Service and the identity router
Date and time of the last authentication service check
Hostname of the identity router
Eth0 IP address
Identity Router Platform Eth0 Address VMware/Hyper-V Management interface IP address Amazon Web Services IP address of the only network interface Authentication Manager Authentication Manager IP address Eth1 IP address
This is the portal interface IP address for VMware/Hyper-V identity routers. This information is not available for Amazon Web Services identity routers or the identity routers embedded in Authentication Manager.
Identity router software version number
Date and status of the last identity router software update
Date and status of the last identity router adapter update
Operating system
Status of RADIUS and IDR SSO Agent services on the identity router
Service Status Description RUNNING The service is enabled and operating normally. STOPPED The service is enabled but is not working. To troubleshoot, run a simple test to confirm that the service is stopped, view the identity router system log for errors, or restart the identity router to try to restart the service. DISABLED The service is not enabled. The last reported status is displayed for the following items. Status indicators are green for healthy, yellow for partially healthy, or red for unhealthy. Yellow status for DNS and and AD/LDAP connections indicates that some configured servers are healthy while others are not. Click the arrow next to a status indicator to view IP addresses or domain names for configured servers.
Primary Region and Alternate Region to which the identity router connects.
AD/LDAP. If no identity sources are configured, click the icon, then click Not Configured to open a new tab and configure an identity source. Every two minutes, the identity router checks connectivity to the identity source servers by connecting to each server and attempting to look up a random user.
DNS. Updated every minute. Displays a configuration icon if DNS is not configured.
Platform DNS Configuration VMware, Hyper-V, Amazon Web Services Identity Router Setup Console Authentication Manager Authentication Manager Operations Console.
Click Administration > Network > Appliance Network Settings.NTP. Updated every minute. Displays a configuration icon if NTP is not configured.
Platform NTP Configuration VMware, Hyper-V, Amazon Web Services Identity Router Setup Console Authentication Manager NTP is not displayed because the identity router uses the NTP server that is configured for Authentication Manager. Authentication Manager. Updated every two minutes. If you want users with SecurID OTP Credentials that were assigned in Authentication Manager to access resources protected by the Cloud Authentication Service, click the icon, then click Not Configured to open a new tab and configure an Authentication Manager connection. For instructions, see Enable SecurID Token Users to Access Resources Protected by the Cloud Authentication Service.
Software Update Service. Displays the connectivity status of an identity router to the software update service and shows the statuses based on the new region-based DNS names, which can be viewed by clicking the drop-down arrow. Updated every 5 minutes. Required for the identity router to perform software updates.
Adapter Update Service. Displays the connectivity status of an identity router to the adapter update service and shows the statuses based on the new region-based DNS names, which can be viewed by clicking the drop-down arrow. Updated every 5 minutes. Required for the identity router to perform updates.
Heartbeat Service. Sends identity router information to the Cloud Authentication Service periodically. If the identity router stops responding, check the date and time of the last heartbeat to help determine when the connection was lost.
Cloud Time Synchronization. Indicates whether identity router time is within 60 seconds of the time reported by the Cloud Authentication Service as required for successful authentication.
Cluster. Updated every 60 seconds. For information on cluster quorums, see Clusters.
Status Description Green Healthy. Cluster is in quorum. More than 50% of identity routers can communicate with each other. Users can authenticate through the cluster. Red Unhealthy. All configured identity routers are offline. Yellow Partially healthy. Cluster is not in quorum and is in read-only mode, but at least one configured identity router is online. Cluster status is not provided for identity routers that are embedded in Authentication Manager.
Memory Usage.
Status Description Green Healthy. More than 25% of free memory is available. Red Unhealthy. Less than 25% of free memory is available. For the identity router that is embedded in Authentication Manager, the maximum and free memory is displayed for the identity router. The maximum host memory is the total memory of the Authentication Manager host.
CPU Usage.
Status Description Green Healthy. Average CPU idle percent is above 20% since the last run of this indicator, which runs every minute. Red Unhealthy. Average CPU idle percent is less than 20% since the last run of this indicator, which runs every minute. For the identity router that is embedded in Authentication Manager, the CPU Usage data applies to the Authentication Manager host, instead of the identity router itself.
Cloud Authentication Service Connections. Tracks the status of each IP address and the overall connection status:
- Current is the Cloud Authentication Service IP address currently being used.
- Alternate is Cloud Authentication Service IP address(es) that are reachable but not in use.
New DNS Name based Status section displays the connection status of the primary and alternate regions using the new DNS names.
Status Description Green Green indicates that the Cloud Authentication Service can reach an IP address (healthy).
If the current IP address and every alternate IP address is healthy, the overall Cloud Authentication Service Connections status is reported as healthy.
Red Red indicates that the identity router cannot reach an IP address (unhealthy).
If the current IP address or at least one alternate IP address is unhealthy, the overall Cloud Authentication Service Connections status is reported as unhealthy.
Note: A yellow warning icon may appear if the identity router cannot connect to the Software Update Service, Adapter Update Service, or the Cloud Authentication Service Connections. Check the connectivity status of these services using the region-specific domain names by clicking the drop-down arrow next to them.
To connect the identity router to any of these services using the new DNS names, you need to whitelist the new region-based domain names in your firewall rules. For more information, see Deployment Planning Checklist.
