RSA Security 6.1 Troubleshooting Guide

RSA® Authentication Manager 6.1 to 8.1 Migration Guide Revision 1

10 PrefaceRSA Authentication Manager 6.1 to 8.1 Migration Guide7.1 to 8.1 Migration Guide: Migrating to a New Hardware Appliance or Virtual Appliance

100 A: Migration Data ConversionRSA Authentication Manager 6.1 to 8.1 Migration GuideMigration ReportWhen the migration completes, it generates a migr

A: Migration Data Conversion 101RSA Authentication Manager 6.1 to 8.1 Migration GuideIn version 8.1, there are default user attributes (such as User I

102 A: Migration Data ConversionRSA Authentication Manager 6.1 to 8.1 Migration GuideReview the migration report to verify how the user extension data

A: Migration Data Conversion 103RSA Authentication Manager 6.1 to 8.1 Migration GuideActivations on Restricted Agents When LDAP Synchronization Jobs D

104 A: Migration Data ConversionRSA Authentication Manager 6.1 to 8.1 Migration GuideView RSA Authentication Manager 6.1 Offline Emergency SettingsAft

B: Reverting RSA Authentication Manager 8.1 to Version 6.1 105RSA Authentication Manager 6.1 to 8.1 Migration GuideB Reverting RSA Authentication Mana

106 B: Reverting RSA Authentication Manager 8.1 to Version 6.1RSA Authentication Manager 6.1 to 8.1 Migration GuideRevert a Migration Using a Differen

B: Reverting RSA Authentication Manager 8.1 to Version 6.1 107RSA Authentication Manager 6.1 to 8.1 Migration GuideRevert a Migration Using the Same H

C: Glossary 109RSA Authentication Manager 6.1 to 8.1 Migration GuideC GlossaryActive DirectoryThe directory service that is included with Microsoft Wi

Preface 11RSA Authentication Manager 6.1 to 8.1 Migration GuideSupport and ServiceRSA SecurCare Online offers a knowledgebase that contains answers t

110 C: GlossaryRSA Authentication Manager 6.1 to 8.1 Migration Guideaudit informationData found in the audit log representing a history of system even

C: Glossary 111RSA Authentication Manager 6.1 to 8.1 Migration Guidecore attributesThe fixed set of attributes commonly used by all RSA products to cr

112 C: GlossaryRSA Authentication Manager 6.1 to 8.1 Migration Guidedynamic seed provisioningThe automation of all the steps required to provide a tok

C: Glossary 113RSA Authentication Manager 6.1 to 8.1 Migration GuideinstanceAn installation of RSA Authentication Manager that can be set up as a prim

114 C: GlossaryRSA Authentication Manager 6.1 to 8.1 Migration Guideprimary instanceThe installed deployment where authentication and all administrati

C: Glossary 115RSA Authentication Manager 6.1 to 8.1 Migration GuiderequestsAllows users to enroll, as well as request tokens, the on-demand tokencode

116 C: GlossaryRSA Authentication Manager 6.1 to 8.1 Migration GuideSelf-Service ConsoleA user interface through which the user can update user profil

C: Glossary 117RSA Authentication Manager 6.1 to 8.1 Migration Guidetop-level security domainThe top-level security domain is the first security domai

Index 119RSA Authentication Manager 6.1 to 8.1 Migration GuideIndexAaccess restrictionsgroup, 95post-migration, 25time restrictions for users, 14activ

120 IndexRSA Authentication Manager 6.1 to 8.1 Migration GuideLLDAPexporting certificates, 66integration, 17mapping jobs to identity sources, 45replic

Index 121RSA Authentication Manager 6.1 to 8.1 Migration GuideRSA Authentication Managergenerate configuration file, 91runtime changes, 28Ssdconf.rec,

1: Important RSA Authentication Manager 8.1 Changes 13RSA Authentication Manager 6.1 to 8.1 Migration Guide1 Important RSA Authentication Manager 8.1

14 1: Important RSA Authentication Manager 8.1 ChangesRSA Authentication Manager 6.1 to 8.1 Migration GuideRealm Deployment In version 8.1, a deployme

1: Important RSA Authentication Manager 8.1 Changes 15RSA Authentication Manager 6.1 to 8.1 Migration GuideAgent Agent In version 8.1, you do not need

16 1: Important RSA Authentication Manager 8.1 ChangesRSA Authentication Manager 6.1 to 8.1 Migration GuideAuthentication Manager 8.1 EnhancementsThe

1: Important RSA Authentication Manager 8.1 Changes 17RSA Authentication Manager 6.1 to 8.1 Migration GuidePreinstalled Authentication Manager Version

18 1: Important RSA Authentication Manager 8.1 ChangesRSA Authentication Manager 6.1 to 8.1 Migration GuideAuthentication Manager 8.1 License TypesEac

1: Important RSA Authentication Manager 8.1 Changes 19RSA Authentication Manager 6.1 to 8.1 Migration GuideIt is important to know:• You can install m

Copyright © 1994-2014 EMC Corporation. All Rights ReservedDecember 2013Revised: December 2014Contact InformationGo to the RSA corporate website for re

20 1: Important RSA Authentication Manager 8.1 ChangesRSA Authentication Manager 6.1 to 8.1 Migration GuideRisk-Based AuthenticationRisk-based authent

1: Important RSA Authentication Manager 8.1 Changes 21RSA Authentication Manager 6.1 to 8.1 Migration GuideArchitectural Changes in Authentication Man

22 1: Important RSA Authentication Manager 8.1 ChangesRSA Authentication Manager 6.1 to 8.1 Migration GuideThe following figure shows the hierarchy of

1: Important RSA Authentication Manager 8.1 Changes 23RSA Authentication Manager 6.1 to 8.1 Migration GuideChanges to SitesSecurity domains in version

24 1: Important RSA Authentication Manager 8.1 ChangesRSA Authentication Manager 6.1 to 8.1 Migration GuidePolicies and Security DomainsSecurity domai

1: Important RSA Authentication Manager 8.1 Changes 25RSA Authentication Manager 6.1 to 8.1 Migration GuideYou can create user groups through the Secu

26 1: Important RSA Authentication Manager 8.1 ChangesRSA Authentication Manager 6.1 to 8.1 Migration GuideThe following table describes the effect th

1: Important RSA Authentication Manager 8.1 Changes 27RSA Authentication Manager 6.1 to 8.1 Migration GuideThe following table shows how groups contai

28 1: Important RSA Authentication Manager 8.1 ChangesRSA Authentication Manager 6.1 to 8.1 Migration GuideThe Replication ModelThe replication model

1: Important RSA Authentication Manager 8.1 Changes 29RSA Authentication Manager 6.1 to 8.1 Migration GuideLog data on a replica instance is not repli

Contents 3RSA Authentication Manager 6.1 to 8.1 Migration GuideContentsRevision History...

30 1: Important RSA Authentication Manager 8.1 ChangesRSA Authentication Manager 6.1 to 8.1 Migration GuideIncreased Administrative ScopingThe version

1: Important RSA Authentication Manager 8.1 Changes 31RSA Authentication Manager 6.1 to 8.1 Migration GuidePredefined Administrative RolesIn version 6

32 1: Important RSA Authentication Manager 8.1 ChangesRSA Authentication Manager 6.1 to 8.1 Migration Guide• Token DistributorThis role grants adminis

1: Important RSA Authentication Manager 8.1 Changes 33RSA Authentication Manager 6.1 to 8.1 Migration GuideGroup AdministratorsIn version 8.1, it is n

34 1: Important RSA Authentication Manager 8.1 ChangesRSA Authentication Manager 6.1 to 8.1 Migration GuideReport TemplatesYou can use the predefined

1: Important RSA Authentication Manager 8.1 Changes 35RSA Authentication Manager 6.1 to 8.1 Migration GuideComparison of Cross-Realm Relationships and

36 1: Important RSA Authentication Manager 8.1 ChangesRSA Authentication Manager 6.1 to 8.1 Migration GuideOne-Way Or Two-Way Trusted RealmsWhile cros

1: Important RSA Authentication Manager 8.1 Changes 37RSA Authentication Manager 6.1 to 8.1 Migration GuideThe following table describes the three typ

2: Planning For Migration 39RSA Authentication Manager 6.1 to 8.1 Migration Guide2 Planning For MigrationMigration Planning ChecklistBefore you start

4 ContentsRSA Authentication Manager 6.1 to 8.1 Migration GuideCustomized Agents Created Using the Authentication API...

40 2: Planning For MigrationRSA Authentication Manager 6.1 to 8.1 Migration Guide Determine how LDAP synchronization jobs map to identity sources. D

2: Planning For Migration 41RSA Authentication Manager 6.1 to 8.1 Migration GuideChoosing a Migration PathOne of the most important steps in migration

42 2: Planning For MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideIf you find it necessary to revert to RSA Authentication Manager 6.1

2: Planning For Migration 43RSA Authentication Manager 6.1 to 8.1 Migration GuideCustomized Agents Created Using the Authentication APIAny custom auth

44 2: Planning For MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideData Migration OptionsYou must choose one of three modes for data mig

2: Planning For Migration 45RSA Authentication Manager 6.1 to 8.1 Migration GuideTest MigrationCustom Mode allows you to perform a test migration. A t

46 2: Planning For MigrationRSA Authentication Manager 6.1 to 8.1 Migration Guide• A scopeThe scope of the job specifies the number of levels below th

2: Planning For Migration 47RSA Authentication Manager 6.1 to 8.1 Migration GuideData Migration to a Specific Security DomainIn Custom Mode, you can c

48 2: Planning For MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideSNMP ReportingIn order to use the SNMP functionality included in RSA

3: RADIUS Migration 49RSA Authentication Manager 6.1 to 8.1 Migration Guide3 RADIUS MigrationMigrating RADIUS Data to the Primary InstanceMigrating th

Contents 5RSA Authentication Manager 6.1 to 8.1 Migration GuideChapter 6: Performing Post-Migration Tasks ...

50 3: RADIUS MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideProcedure1. Open a new command shell, and change directories to the directo

3: RADIUS Migration 51RSA Authentication Manager 6.1 to 8.1 Migration GuideCopy the RADIUS Migration Package File to an Import LocationIf you are migr

52 3: RADIUS MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideAdd Custom RADIUS Dictionary Attributes to Version 8.1If the version 6.1 de

3: RADIUS Migration 53RSA Authentication Manager 6.1 to 8.1 Migration Guide5. On the Manage Server Files page, do one of the following:• Click the Con

54 3: RADIUS MigrationRSA Authentication Manager 6.1 to 8.1 Migration Guide10. Add an entry for the dictionary in the vendor.ini file.a. In the Manage

3: RADIUS Migration 55RSA Authentication Manager 6.1 to 8.1 Migration Guide4. Specify the location of the RADIUS server migration package. Under Serve

4: Primary Server Migration 57RSA Authentication Manager 6.1 to 8.1 Migration Guide4 Primary Server MigrationMigrating the Primary ServerPerform these

58 4: Primary Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideRSA Authentication Manager 6.1 Database DumpYou must manually colle

4: Primary Server Migration 59RSA Authentication Manager 6.1 to 8.1 Migration GuideThe following table lists the files required for migration, their l

60 4: Primary Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideStop RSA Authentication Manager 6.1 Services on a Non-Appliance Ser

4: Primary Server Migration 61RSA Authentication Manager 6.1 to 8.1 Migration Guide7. On the Appliance, click Start > Programs > RSA Security &g

62 4: Primary Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideNext StepsManually copy the migration files to one of the following

4: Primary Server Migration 63RSA Authentication Manager 6.1 to 8.1 Migration Guide5. In Internet Explorer, scroll down to display the Start button fo

64 4: Primary Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideIf you plan to migrate these files from an NFS or Windows Shared fo

4: Primary Server Migration 65RSA Authentication Manager 6.1 to 8.1 Migration Guide8. Click Save. When the download is complete, all of the dialog box

66 4: Primary Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideExport the LDAP Directory CertificatesThe LDAP directory certificat

4: Primary Server Migration 67RSA Authentication Manager 6.1 to 8.1 Migration GuideBefore You Begin• You must be a Super Admin. • See Data Migration O

68 4: Primary Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration Guide• Select NFS (Network File System) Shared Folder to locate the migr

4: Primary Server Migration 69RSA Authentication Manager 6.1 to 8.1 Migration Guide11. Click the links at the bottom of the Migration Results page to

Revision History 7RSA Authentication Manager 6.1 to 8.1 Migration GuideRevision HistoryRevision NumberDate Revision1 December 2014 Updated for RSA Au

70 4: Primary Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration Guide• Dump the Version 6.1 data. See RSA Authentication Manager 6.1 Dat

4: Primary Server Migration 71RSA Authentication Manager 6.1 to 8.1 Migration Guide5. Review the Scan Results screen to verify that the data found in

72 4: Primary Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration Guide12. Select the identity source into which you want to migrate users

4: Primary Server Migration 73RSA Authentication Manager 6.1 to 8.1 Migration Guide14. Select Merge duplicate user extensions attributes in a case ins

74 4: Primary Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration Guide• If a the identity source you want has not yet been defined and th

4: Primary Server Migration 75RSA Authentication Manager 6.1 to 8.1 Migration GuideThe installation process creates the sdserv.dmp file in the /opt/rs

76 4: Primary Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideBefore You Begin• Dump the version 6.1 log file. For more informati

4: Primary Server Migration 77RSA Authentication Manager 6.1 to 8.1 Migration Guide6. Click Start Log Migration.The Log Migration Status page displays

78 4: Primary Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration Guide• Unassigned replacement token • Unassigned as replacement token •

4: Primary Server Migration 79RSA Authentication Manager 6.1 to 8.1 Migration GuideAfter you migrate the log files, administrative events from your ve

80 4: Primary Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideSynchronized token Sync TokenEnabled emergency code punct Token mar

5: Replica Server Migration 81RSA Authentication Manager 6.1 to 8.1 Migration Guide5 Replica Server MigrationMigrating a Replica ServerAfter you have

82 5: Replica Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration GuideProcedure1. On the version 6.1 machine, click Start > Programs &

5: Replica Server Migration 83RSA Authentication Manager 6.1 to 8.1 Migration GuideMigrate Replica Delta Records to the 8.1 Primary InstanceDatabase c

84 5: Replica Server MigrationRSA Authentication Manager 6.1 to 8.1 Migration Guide• Select Windows Shared Folder to locate the migration server files

5: Replica Server Migration 85RSA Authentication Manager 6.1 to 8.1 Migration GuideRebalance Contact ListsIf the appliance has a new hostname and IP a

6: Performing Post-Migration Tasks 87RSA Authentication Manager 6.1 to 8.1 Migration Guide6 Performing Post-Migration TasksPost-Migration TasksAfter c

88 6: Performing Post-Migration TasksRSA Authentication Manager 6.1 to 8.1 Migration GuideChange the instance IP addressThe initial IP address on the

6: Performing Post-Migration Tasks 89RSA Authentication Manager 6.1 to 8.1 Migration GuideEdit Clients to the RADIUS ServerMigration changes the IP ad

Preface 9RSA Authentication Manager 6.1 to 8.1 Migration GuidePrefaceAbout This GuideThis guide is intended for administrators who are planning and i

90 6: Performing Post-Migration TasksRSA Authentication Manager 6.1 to 8.1 Migration GuideConfiguring Custom PortsIf the RSA Authentication Manager 6.

6: Performing Post-Migration Tasks 91RSA Authentication Manager 6.1 to 8.1 Migration GuideRestart Authentication Manager ServicesThe Authentication Ma

92 6: Performing Post-Migration TasksRSA Authentication Manager 6.1 to 8.1 Migration GuideProcedure1. In the Security Console, click Access > Authe

6: Performing Post-Migration Tasks 93RSA Authentication Manager 6.1 to 8.1 Migration GuideConfigure TACACS+ SupportAuthentication Manager version 8.1

A: Migration Data Conversion 95RSA Authentication Manager 6.1 to 8.1 Migration GuideA Migration Data ConversionConversion of Migrated DataThe followin

96 A: Migration Data ConversionRSA Authentication Manager 6.1 to 8.1 Migration GuideUser agent activation data Existing user-agent associations are ma

A: Migration Data Conversion 97RSA Authentication Manager 6.1 to 8.1 Migration GuideClient type data Agent types are not migrated. Version 8.1 recogni

98 A: Migration Data ConversionRSA Authentication Manager 6.1 to 8.1 Migration GuideTask lists data Task list data is migrated to version 8.1 permissi

A: Migration Data Conversion 99RSA Authentication Manager 6.1 to 8.1 Migration GuideAgent extension data Agent extension data is migrated to the notes