For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

cymru81's avatar
cymru81
Icon for Altocumulus rankAltocumulus
Jun 11, 2014

APM and RSA

Hi, we use RSA for 2FA with BIG-IP APM. Gernerally logins work ok but then we do seem to get batches of users that are stuck in 'next tokencode' mode which asks you to wait for the code to change and re-enter. Unfortuantely this code is very rarely accepted and the token has to be re-synced via the RSA Auth Manager (which points to the issue being BIG IP not RSA). This 'next tokencode' also works fine with a legacy Firepass controller we have which also points to it being BIG IP. F5 support aren't forthcoming with the answer to this as well. Anyone else experienced this and no a fix? thanks.

 

7 Replies

  • Suggest that you raise a case with F5 support. There are multiple factors in an APM configuration and without the whole configuration picture it would not hazard a guess as to what may be the problem here. It could be something simple or something much more in depth

     

  • Unfortuantely I have done and was passed along to RSA who confirm they can see no issues and to contact the vendor of the appliance, so stuck in a loop really!

     

  • Suggest you go back to F5 and persist with them. It is their product and if you have support they are meant to help you resolve the issue.

     

  • I may have to, though thought it was worth an ask on here... :)

     

  • Hi, just wondered if you ever got to the bottom of this? We seem to get way more next token code problems than we had with Firepass and often entering the next code doesn't seem to let people in and we need to manually resynchronize it. A tcpdump shows request going to the RSA server but no response when entering next code when it fails, but for 99% of people it works fine, so not a general connectivity issue by any means.

     

  • Not really a resolution, we upgraded to the latest build of BIG IP/APM and the issue doesn't really occur any more!

     

  • Thanks for the reply, we are upgrading our APM's this evening so will check if this fixes the problems being experienced.