Hi,
I'am trying to integrate ISE 3.1 with RSA Authentication Manger v8.3
The idea is that the administrator connects to a given cisco router/switch, the net device for a lab (cisco router) has aaa configured with a TACACS+ server whose IP is pointing to ISE. And on the ISE the police set/identity sequence allows logging in or not. Depending on whether the username and password match what is on the SecureID server.
I got a properly prepared sdconf.rec file from the administrator which I added to the ISE and configured a simple police set which, in the event of a match, is supposed to allow login.
Unfortunately at the moment this does not work, I have checked with tcpdump and on the firewall which is on the way and the traffic between ISE and RSA server does not appear at all.
The logs tell me that the problem is somewhere on the ISE - "RSA request is declined, because RSA agent initialization has failed - RSA SecurID".
| 13013 | Received TACACS+ Authentication START Request |
| | 15049 | Evaluating Policy Group |
| | 15008 | Evaluating Service Selection Policy |
| | 15048 | Queried PIP - DEVICE.Device Type |
| | 15041 | Evaluating Identity Policy |
| | 22072 | Selected identity source sequence - All_User_ID_Stores |
| | 15013 | Selected Identity Source - RSA SecurID |
| | 13044 | TACACS+ will use the password prompt returned by the identity store |
| | 13015 | Returned TACACS+ Authentication Reply |
| | 13014 | Received TACACS+ Authentication CONTINUE Request |
| | 15041 | Evaluating Identity Policy |
| | 22019 | Identity Policy was evaluated before; Identity Sequence continuing |
| | 15013 | Selected Identity Source - RSA SecurID |
| | 24500 | Authenticating user against the RSA SecurID Server - RSA SecurID |
| | 24560 | Searching for user record in RSA identity store Passcode cache - RSA SecurID |
| | 24562 | User record was not found in Passcode cache - RSA SecurID |
| | 24551 | RSA request is declined, because RSA agent initialization has failed - RSA SecurID |
| | 24503 | Cannot establish a session with the RSA SecurID Server - RSA SecurID |
| | 22059 | The advanced option that is configured for process failure is used |
| | 22062 | The 'Drop' advanced option is configured in case of a failed authentication request |
| | 5412 | TACACS+ authentication request ended with error |
Plase help with the answer where the problem may lie. I created the configuration according to https://community.rsa.com/t5/securid-integrations/authentication-agent-configuration-cisco-ise-rsa-ready-securid/ta-p/559403
Best regards
