Update Identity Router Software
23 days ago

Update Identity Router Software

RSA releases identity router software updates periodically. The updates ensure compatibility with new RSA features and improvements. RSA supports only the latest version and the previous version of the identity router software, and does not support rolling back updates after they are installed. See the following sections:

Update Schedules

When a new software version is released, RSA announces the update and schedules a date and time when each cluster in your deployment will automatically install the latest update. RSA recommends that you allow the update to occur automatically on the default rollout date. Do not perform the update immediately when RSA makes it available unless your organization has a compelling reason to update as soon as possible. The default date and rollout schedule are published in the Release Notes.

The Identity Routers page lists the software version for each identity router in your deployment and, when a new software version is released, displays UPDATE AVAILABLE status for identity routers that do not have the latest software installed.

Identity routers automatically download and install new packages as they become available, so download time is rarely a factor when applying an update.

You can also manage updates separately for each cluster in the following ways:

  • Schedule an automatic update to occur at a date and time you select. You can schedule all clusters to update simultaneously, or stagger the updates over a period of time. Use this as the primary method for updating the identity routers in your deployment.

  • Immediately apply the latest update to all identity routers in a cluster containing an UPDATE AVAILABLE identity router

Update Process

During an update, identity routers in a cluster download and install the new software sequentially to maintain service continuity. User authentication continues while downloads are in progress. In single-router clusters, authentication is not disrupted if a download fails. Each Identity Router typically requires 10–30 minutes to complete the download and update.

If the first Identity Router fails to download, its status is shown as Download Failed and the download must be retried. If download failures persist, contact your administrator.

Best Practices

Follow these best practices before updating identity routers.

  • RSA recommends that you first deploy identity router updates to a test environment. After you have confirmed that updates are operating properly, then migrate the updates to your production environment.

  • Back up the user keychain data from the cluster you want to update.

  • Check the SecurID status page for announcements regarding maintenance downtime for Cloud Access Service (CAS). Do not schedule updates during these periods.

  • Verify that all settings in the Cloud Administration Console are configured properly, and that all pending configuration changes are published.

    • Note:   Unexpected results can occur if Cloud Administration Console settings are not configured properly prior to the update. Updates cannot be rolled back or reverted.

Update an Identity Router

Perform these steps to schedule an update or perform an immediate update.

Note:  RSA schedules blackout periods during which you are not permitted to schedule or perform updates.

Procedure 

  1. In the Cloud Administration Console, click Platform > Clusters.

  2. Next to the cluster you want to update, click the drop-down arrow, and select Update.

  3. In the Start Time section, do one of the following:

    1. To schedule the update to occur at a predetermined date and time, select Later, and specify a date according to the recommended update schedule on RSA Community. Specify the time according to your local time zone.

      2. Note:  RSA recommends scheduling updates during off-peak hours.

    2. To apply the update immediately, select Now.

  4. Depending on your selection, click Save, or click Update Now and confirm the immediate update in the dialog box that appears.

Results 

Depending on your selection, the identity routers in the cluster automatically install the latest software version either immediately, or at the specified date and time. For immediate updates, a notification appears when the update begins.

The Identity Routers page of the Cloud Administration Console displays Downloading status for identity routers while they are downloading.

Note:  Do not reboot identity routers while a download/ update is in progress.

If an Identity Router download fails, the status is shown as Download Failed. This does not impact cluster operations, as the download stage only retrieves the required data for a later upgrade. Once the download completes successfully, the upgrade starts automatically, and the status changes to Active when the upgrade is finished.

After you finish 

After the cluster update completes, if an identity router still displays an UPDATE AVAILABLE status, update the identity router individually from the Identity Routers page. If that update does not succeed, contact RSA Customer Support.

Don't see what you're looking for?