RSA SecurID 130 Appliance Basic Setup

I set up one of these years ago and wrote up a short article describing how to use one of these to authenticate against them from a Cisco ASA. I set another of these up recently and figured I'd cover the basic points to get it running.

Assuming your Active Directory domain is called testad.local and you've named the appliance "rsaappliance.testad.local" in DNS...

1. You'll need to do the base configuration and set up the initial license file. It's important that the following is configured correctly:

IP Address (it's probably necessary that you create a PTR record in DNS for the appliance. At the very least, you should have the IP address in DNS with a matching hostname (i.e., rsaappliance.testad.local)

NTP/time sources - you should use the same NTP servers that you're using for your Active Directory domain controllers. If you are running VMware ESX/ESXi and are running the domain controllers as VMs, you can use the ESX/ESXi host(s) as NTP time sources.

2. The next work requires use of the operations-console:

https://rsaappliance.testad.local:7072/operations-console

 Under the admin console -> deployment configuration -> Identity sources -> add new ->

(you'll probably be required to provide administrative credentials to get in)

provide the:

Identity Source Name: descriptive name

Type (Microsoft Active Directory)

Directory URL

directory UL: ldap://dc1.testad.local  (or ldaps://dc1.testad.local, if available)

directory failover URL: ldap://dc2.testad.local

directory user id: you can create a user for this purpose. Assuming you created a user called "rsaauth" in the default users container in Active directory, you'll construct the entry like so:
   cn=rsaauth,cn=Users,dc=testad,dc=local
 
   Of course, you might have OUs set up for these sorts of things. If you had an OU in your domain called "utilityusers," the entry would be:
   cn=rsaauth,ou=utilityusers,dc=testad,dc=local
 
   (for those of you unfamiliar with LDAP, cn should be the full name of the user.)
   2b. click on the "map" tab and set your User Base DN and User Group base DN. If you're not using any OUs, you'll default to the standard cn=users,dc=testad,dc=local... otherwise, put in the appropriate OU. You can fine tune the LDAP search filters and mappings below, but all you need to get started is the User Base DN and User Group DN.
 
  By the way, if you check "Directory is an Active Directory Global Catalog," you'll likely get an error in a later step:
 
  "Cannot link the runtime identity source because no administrative identity sources reference this runtime source"
 
  The easiest way to fix this is to uncheck "Directory is an Active Directory Global Catalog" - or do additional configuration.

3. You'll want to enable the Radius Server, if you're going to authenticate against this appliance from, say, a Cisco ASA:

 Deployment Configuration -> RAIDUS -> Configure Server -> go ahead and create your RADIUS server... the defaults should be fine.


 4. You'll need to link the newly created Identity Source to a realm (newly created or the default SystemDomain realm.)

 Go to the security console:

 https://rsaappliance.testad.local:7004/console-am

 5. From there, go to Administration -> REALMS -> Manage Existing (you can create a new realm, if you have the appropriate licensing)
    select the "SystemDomain" realm (or the realm you created if you chose to create your own.)
    Under Link Identity Source, select the active directory Identity source you created in step one and click the arrow pointing to the right to put it in the linked field. Now, save your entry.
   
    If you get the dreaded "Cannot link the runtime identity source because no administrative identity sources reference this runtime source," this probably means you set the Active Directory Identity Source in step 1 to be a Global catalog.
   
 You should be ready to add tokens. To do so under the security console:

 Authentication ->  Manage existing -> New Import SecurID Tokens Job ->

 

name: just a descriptive name
 

Security domain: SystemDomain (unless you've created your own security domain)
 

Import file: (import the xml file from the CD RSA included with the tokens
 

File password: This password was likely on a scratchoff slip of paper in a separate folder

 Provided the tokens import correctly, you should be able to start assigning them to users.

6. Finally, you'll probably need to add a Radius client if you you enabled the Radius server in step 3. From the Security console ( https://rsaappliance.testad.local:7004/console-am): RADIUS -> RADIUS clients -> add new:

Client Name: use a descriptive name

IP Address: the IP address of the client

Make / Model: Select the appropriate model (i.e., Cisco PIX for Cisco ASA)

Shared Secret: choose a long password

Go ahead and save without RSA agent.

Cisco ASA VPN and RSA SecurID Appliance

I recently set up an RSA SecurID Appliance as a authentication source for a Cisco ASA 5510 running 8.0.x firmware. The basic setup of the box was pretty straightforward. It runs a stripped down Linux distribution with a 2.6.24.x kernel.

Anyway, after setting up an authentication source using a Windows 2003/2008 Active Directory domain controller and importing a batch of time based RSA key token, I set up the ASA to authenticate off the Radius server. Here's the necessary config on the ASA:

aaa-server rsaapp protocol sdi
aaa-server rsaapp (INSIDE) host 10.14.14.50 MY_PASSWORD_FOR_RADIUS_CLIENT

tunnel-group employees type remote-access
tunnel-group employees general-attributes
address-pool employees-pool
authentication-server-group rsaapp
default-group-policy operations
tunnel-group operations ipsec-attributes
pre-shared-key *

Here are several important things to do:

1. set up DNS entries for the RSA box and the ASA, both forward and reverse/PTR. The box seems to be looking for its FQDN. You can use the host file for setup.

2. make sure the ASA, RSA box, and domain controller all have accurate time (via NTP, etc.)

3. setup a radius client on the RSA box and use the same pass phrase you used in the ASA aaa-server config

4. assign token devices to users... start off with one user for testing.

5. Re-synchronize the token. I'm not 100% sure this is necessary, but I tried several tokens, and this seemed necessary.

6. Have the user log into the self-service console:

https://myrsaappliance.mydomain.local:7004/console-selfservice

He or she should log into the console with their active directory username and password. He or she should then set a PIN on the token.

7. Wait for a minute or a two, and then have the user log into the VPN appliance with the Cisco client. This seemed to be necessary, as the token didn't seem to work at first. After running through the configuration again, I tried waiting, and this worked.