When running ./rsautil manage-readonly-dbusers CLU with the -n option, the expected result is that the user is created, and the subnet is allowed to access.  The user is created, but the subnet is not accessible.

1. You created a new database readonly user using the command below. Where -X (debug mode) -a (action - create) -o (OC user) -u (new db username) -i (IP address of client) -n (IP mask of client machine(s)).

rsaadmin@am82p:/opt/rsa/am/utils> ./rsautil manage-readonly-dbusers -X -a create -o ocadmin -u dbreaduser -i 10.114.187.0 -n 255.255.255.0
Enter Operations Console (OC) password: <enter Operations Console admin password>
Enter password for the read-only database user: <enter read-only database user password>
Confirm password for the read-only database user: <re-enter read-only database user password>
Executing action: 'create'.
Trusted Root SSL CA certificate was copied in file '/opt/rsa/am/utils/RSAAMTrustedRootSSLCA.crt'.
'create' action complete.

2. Cat the pg_hba.conf file for the name of the read only user:

rsaadmin@am82p:/opt/rsa/am/utils> cat /opt/rsa/am/rsapgdata/pg_hba.conf | grep dbreaduser
hostssl all             dbreaduser      10.114.187.0    255.255.255.0           md5

3. Change to the root user and check iptables for port 7050, using options to list the rules with numeric output:

# rsaadmin@am82p:/opt/rsa/am/utils> sudo su -
rsaadmin's password: <enter operating system password>
am82p:~ # /usr/sbin/iptables -L -n -v | grep 7050
0 0 ACCEPT tcp – * * 10.114.187.0 0.0.0.0/0 tcp dpt:7050 
0 0 DROP tcp – * * 0.0.0.0/0 0.0.0.0/0 tcp dpt:7050

4. Cat iptables for references to port 7050 to confirm changes:

am82p:~ # cat /etc/sysconfig/iptables | grep 7050
-A INPUT -s 10.114.187.0/32 -p tcp -m tcp --dport 7050 -j ACCEPT
-A INPUT -p tcp -m tcp --dport 7050 -j DROP

Edit /etc/sysconfig/iptables directly.

1. Enable Secure Shell on the Appliance
2. Log On to the Appliance Operating System with SSH
3. Switch to the root user 

login as: rsaadmin
Using keyboard-interactive authentication.
Password: <enter operating system password>
Last login: Thu Jan  2 15:50:00 2020 from jumphost.vcloud.local
RSA Authentication Manager Installation Directory: /opt/rsa/am
rsaadmin@am82p:~> cd /opt/rsa/am/utils
rsaadmin@am82p:~> sudo su -
rsaadmin's password: <enter operating system password>

3. Edit /etc/sysconfig/iptables.  For example, change from /32, as shown:

-A INPUT -s 10.24.0.0/32 -p tcp -m tcp --dport 7050 -j ACCEPT

-A INPUT -s 10.24.0.0/24 -p tcp -m tcp --dport 7050 -j ACCEPT

4. Restart the iptables service:

am82p:~ # service iptables restart
Restarting iptables