RSA Authentication Manager 7.1 to 8.1 Migration Guide: Upgrading RSA SecurID Appliance 3.0 On Existing Hardware

Transcription

1 RSA Authentication Manager 7.1 to 8.1 Migration Guide: Upgrading RSA SecurID Appliance 3.0 On Existing Hardware

2 Contact Information Go to the RSA corporate website for regional Customer Support telephone and fax numbers: Trademarks RSA, the RSA Logo and EMC are either registered trademarks or trademarks of EMC Corporation in the United States and/or other countries. All other trademarks used herein are the property of their respective owners. For a list of RSA trademarks, go to License Agreement This software and the associated documentation are proprietary and confidential to EMC, are furnished under license, and may be used and copied only in accordance with the terms of such license and with the inclusion of the copyright notice below. This software and the documentation, and any copies thereof, may not be provided or otherwise made available to any other person. No title to or ownership of the software or documentation or any intellectual property rights thereto is hereby transferred. Any unauthorized use or reproduction of this software and the documentation may be subject to civil and/or criminal liability. This software is subject to change without notice and should not be construed as a commitment by EMC. Third-Party Licenses This product may include software developed by parties other than RSA. The text of the license agreements applicable to third-party software in this product may be viewed on the product documentation page on RSA SecurCare Online. By using this product, a user of this product agrees to be fully bound by terms of the license agreements. Note on Encryption Technologies This product may contain encryption technology. Many countries prohibit or restrict the use, import, or export of encryption technologies, and current use, import, and export regulations should be followed when using, importing or exporting this product. Distribution Use, copying, and distribution of any EMC software described in this publication requires an applicable software license. EMC believes the information in this publication is accurate as of its publication date. The information is subject to change without notice. THE INFORMATION IN THIS PUBLICATION IS PROVIDED "AS IS." EMC CORPORATION MAKES NO REPRESENTATIONS OR WARRANTIES OF ANY KIND WITH RESPECT TO THE INFORMATION IN THIS PUBLICATION, AND SPECIFICALLY DISCLAIMS IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Copyright EMC Corporation. All Rights Reserved. Published in the U.S.A. December 2013

3 Contents Preface... 7 About This Guide...7 RSA Authentication Manager 8.1 Documentation... 7 Related Documentation... 8 Support and Service... 9 Before You Call Customer Support... 9 Chapter 1: Planning a Migration...11 Introduction...11 Reviewing the Migration Process...11 Determine if You Can Upgrade the Hardware Appliance Expertise Required for Migration Administrator Planning the Migration Administrator Performing the Migration Access and Permissions Factors that Affect Migration Migration on Existing Hardware Pre-Production and Migration Import Options Authentication Agents Authentication Downtime Potential Data Loss Administrative Downtime Migration Time RSA RADIUS Migration Migration of Multiple Realms from Version Selecting a Migration Scenario Chapter 2: Setting Up for Migration Pre-Migration Checklist Migration Export Utility Installation Install the Migration Export Utility Chapter 3: Pre-Production and Testing Version Pre-Production...31 Migration Package Testing the Migration Create a Backup Image of the Hardware Appliance Install RSA Authentication Manager 8.1 on the RSA SecurID Appliance Export Data from the Primary Instance Import Data to RSA Authentication Manager Contents 3

4 Pre-Production Setup Tasks Deployment Configuration System Configuration RSA RADIUS Authentication Self-Service Authentication Agents Reporting Application Programming Interface Update Selected Migration Scenario Chapter 4: Performing a Basic Migration with the Replica Instances Online Scenario 1: Basic Migration with the Replica Instances Online Migration After Pre-Production Testing Performing a Basic Migration with the Replica Instances Online Create a Backup Image of the Hardware Appliance Install RSA Authentication Manager 8.1 on the RSA SecurID Appliance Export Data Import Data to RSA Authentication Manager Change the Hostname and IP Address of the Primary Instance Additional Tasks for a Changed Hostname and IP Address on the Version 8.1 Primary Instance Chapter 5: Performing a Basic Migration with All Instances Offline Scenario 2: Basic Migration with All Instances Offline Migration After Pre-Production Testing Performing a Basic Migration with All Instances Offline Create a Backup Image of the Hardware Appliance Install RSA Authentication Manager 8.1 on the RSA SecurID Appliance Export Data Import Data to RSA Authentication Manager Change the Hostname and IP Address of the Primary Instance Additional Tasks for a Changed Hostname and IP Address on the Version 8.1 Primary Instance Contents

5 Chapter 6: Performing an Advanced Migration Scenario 3: Advanced Migration Migration After Pre-Production Testing Performing an Advanced Migration Create a Backup Image of the Hardware Appliance Install RSA Authentication Manager 8.1 on the RSA SecurID Appliance Export Data Import a Migration Package from the Version 7.1 Primary Instance Change the Hostname and IP Address of the Primary Instance Additional Tasks for a Changed Hostname and IP Address on the Version 8.1 Primary Instance Export Authentication Updates from a Replica Instance Import a Migration Package from a Version 7.1 Replica Instance Chapter 7: Post-Migration Tasks Post-Migration Tasks When Version 8.1 Settings Are Retained During Import Deployment Configuration Administration RSA RADIUS Authentication Agents Reporting Self-Service Post-Migration Tasks When the Version 8.1 Database is Completely Overwritten During Import Deployment Configuration RSA RADIUS Authentication Authentication Agents System Configuration Self-Service Administration Reporting Reestablishing Trusted Realm Relationships Reestablish a Trust with a Version 7.1 Realm Repair a Trust with a Version 8.1 Trusted Realm Reconfigure Converted Version 7.1 Realms After Migration Administrative Role Permissions in Version Copy the RADIUS Dictionary Files Update the Notification Template After Migrating from Version Configure the Approved Software Token Notification Template After Migration Contents 5

6 Appendix A: Migrated Data Migrated Data Authentication Updates Migrated from a Version 7.1 Replica Instance Appendix B: Non-Migrated Data Data That is Not Migrated Appendix C: Retained and Imported Pre-Production Data Retained Version 8.1 Data Imported Data from Version Appendix D: Restoring a Hardware Appliance Consequences of Restoring a Hardware Appliance Rolling Back to an RSA Authentication Manager 7.1 Deployment Restore an Image on the Hardware Appliance Rolling Back Trusted Realm Relationships Reestablish a Trust with a Version 7.1 Realm Reestablish a Trust with a Version 8.1 Realm Roll Back an Advanced Migration Using a Command Line Uninstall the Migration Export Utility Appendix E: Migrating a Standalone Primary Deployment Performing a Basic Migration on a Standalone Primary Deployment Export Data Create a Backup Image of an Existing Hardware Appliance Install RSA Authentication Manager 8.1 on the RSA SecurID Appliance Import Data to RSA Authentication Manager Appendix F: Troubleshooting Migration Migration Export Utility Logs Resolve Import Errors Migration Results Migration Report Download Troubleshooting Files Access the Migration Report When the RSA Runtime Server is Stopped Appendix G: Summary of Migration Scenarios Migration Scenarios Glossary Index Contents

7 Preface About This Guide This guide describes how to migrate RSA Authentication Manager 7.1 and upgrade to RSA Authentication Manager 8.1 on existing RSA SecurID Appliance 3.0 hardware. It is intended for administrators and other trusted personnel. Do not make this guide available to the general user population. If you want to migrate to RSA Authentication Manager 8.1 on a new hardware or virtual appliance, see the RSA Authentication Manager 7.1 to 8.1 Migration Guide: Migrating to a New Hardware Appliance or Virtual Appliance. RSA Authentication Manager 8.1 Documentation For information about RSA Authentication Manager 8.1, see the following documentation. RSA recommends that you store the product documentation in a location on your network that is accessible to administrators. Release Notes. Describes what is new and changed in this release, as well as workarounds for known issues. Hardware Appliance Getting Started. Describes how to deploy a hardware appliance and perform the Authentication Manager Quick Setup process. Virtual Appliance Getting Started. Describes how to deploy a virtual appliance and perform the Authentication Manager Quick Setup process. Planning Guide. Describes the high-level architecture of Authentication Manager and how it integrates with your network. Setup and Configuration Guide. Describes how to set up and configure Authentication Manager. Administrator s Guide. Provides an overview of Authentication Manager and its features. Describes how to configure the system and perform a wide range of administration tasks, including manage users and security policies. Help Desk Administrator s Guide. Provides instructions for the most common tasks that a Help Desk Administrator performs on a day-to-day basis. Hardware Appliance SNMP Reference Guide. Describes how to configure Simple Network Management Protocol (SNMP) to monitor an instance of Authentication Manager on a hardware appliance. Virtual Appliance SNMP Reference Guide. Describes how to configure Simple Network Management Protocol (SNMP) to monitor an instance of Authentication Manager on a virtual appliance. Troubleshooting Guide. Describes the most common error messages in RSA Authentication Manager and provides the appropriate actions to troubleshoot each event. Preface 7

8 Developer s Guide. Provides information about developing custom programs using the RSA Authentication Manager application programming interfaces (APIs). Includes an overview of the APIs and Javadoc for Java APIs. Performance and Scalability Guide. Describes what to consider when tuning your deployment for optimal performance. 6.1 to 8.1 Migration Guide. Describes how to migrate from an RSA Authentication Manager 6.1 deployment to an RSA Authentication Manager 8.1 deployment. 7.1 to 8.1 Migration Guide: Migrating to a New Hardware Appliance or Virtual Appliance. Describes how to migrate from an RSA Authentication Manager 7.1 deployment to an RSA Authentication Manager 8.1 deployment on a new hardware appliance or virtual appliance. 7.1 to 8.1 Migration Guide: Upgrading RSA SecurID Appliance 3.0 on Existing Hardware. Describes how to migrate from an RSA Authentication Manager 7.1 deployment to an RSA Authentication Manager 8.1 deployment on existing, supported RSA SecurID Appliance 3.0 hardware. Security Console Help. Describes day-to-day administration tasks performed in the Security Console. Operations Console Help. Describes configuration and setup tasks performed in the Operations Console. Self-Service Console Help. Describes how to use the Self-Service Console. To view the Help, on the Help tab in the Self-Service Console, click Self-Service Console Help. RSA Token Management Snap-In Help. Describes how to use software that works with the Microsoft Management Console (MMC) for deployments that have an Active Directory identity source. Using this snap-in, you can enable or disable a token, assign a token, or perform other token-related tasks without logging on to the Security Console. Related Documentation RADIUS Reference Guide. Describes the usage and settings for the initialization files, dictionary files, and configuration files used by RSA RADIUS. Security Configuration Guide. Describes the security configuration settings available in RSA Authentication Manager. It also describes secure deployment and usage settings, secure maintenance, and physical security controls. 8 Preface

9 Support and Service RSA SecurCare Online Customer Support Information RSA Solution Gallery rketplace/rsa?view=overview RSA SecurCare Online offers a knowledgebase that contains answers to common questions and solutions to known problems. It also offers information on new releases, important technical news, and software downloads. The RSA Solution Gallery provides information about third-party hardware and software products that have been certified to work with RSA products. The gallery includes Secured by RSA Implementation Guides with step-by-step instructions and other information about interoperation of RSA products with these third-party products. Before You Call Customer Support Please have the following information available when you call: Access to the RSA Authentication Manager 8.1 appliance. Your license serial number. To locate the license serial number, do one of the following: Look at the order confirmation that you received when your ordered the product. This contains the license serial number. Log on to the Security Console, and click License Status. Click View Installed License. The Authentication Manager appliance software version information. You can find this information in the top, right corner of the Quick Setup, or in the Security Console. Log on to the Security Console, and click Software Version Information. Preface 9

10

11 1 Planning a Migration Introduction Before upgrading your installation of RSA Authentication Manager from version 7.1 to version 8.1 on existing RSA SecurID Appliance 3.0 hardware, you must understand the factors that affect data migration, the setup tasks, the possible pre-production options, as well as the migration steps. Review this chapter carefully so that you can plan for the process and make the best choices for your organization. Important: If you plan to migrate to hardware appliance that is not in production or if you want to migrate to a virtual appliance, see the RSA Authentication Manager 7.1 to 8.1 Migration Guide: Migrating to a New Hardware Appliance or Virtual Appliance. Reviewing the Migration Process Use the following high-level steps to guide you through the migration process. 1. Plan the migration. Do the following: a. Determine if your hardware is eligible for upgrading to version 8.1. For instructions, see Determine if You Can Upgrade the Hardware Appliance on page 13. b. Make sure the administrators planning or performing the migration have the necessary expertise. See Expertise Required for Migration on page 13. c. Consider the factors that affect migration. For more information, see Factors that Affect Migration on page 14. d. Select the migration scenario that best meets the needs of your deployment. See Selecting a Migration Scenario on page 22. e. Determine if you will set up a test environment to test and configure version 8.1. You can save the system settings and deployment topology of the 8.1 pre-production testing environment, or completely overwrite the database. See Pre-Production and Migration Import Options on page 16. 1: Planning a Migration 11

12 f. Review the migration scenario that you selected: For Scenario 1 (Basic Migration with the Replica Instances Online), see Performing a Basic Migration with the Replica Instances Online on page 49. For Scenario 2 (Basic Migration with All Instances Offline), see Performing a Basic Migration with All Instances Offline on page 65. For Scenario 3 (Advanced Migration), see Performing an Advanced Migration on page 81. If you have a standalone primary deployment, see Appendix E, Migrating a Standalone Primary Deployment. g. Review the post-migration tasks. See Chapter 7, Post-Migration Tasks. h. Review the list of data that is migrated and not migrated. See Appendix A, Migrated Data and Appendix B, Non-Migrated Data. 2. Complete the setup tasks. See Pre-Migration Checklist on page Test the migration process, configure system settings, and more. See Chapter 3, Pre-Production and Testing Version When you are ready to put version 8.1 into production, perform the selected scenario. For Scenario 1 (Basic Migration with the Replica Instances Online), see Performing a Basic Migration with the Replica Instances Online on page 49. For Scenario 2 (Basic Migration with All Instances Offline), see Performing a Basic Migration with All Instances Offline on page 65. For Scenario 3 (Advanced Migration), see Performing an Advanced Migration on page Perform the post-migration tasks. See Chapter 7, Post-Migration Tasks. 12 1: Planning a Migration

13 Determine if You Can Upgrade the Hardware Appliance Only some versions of the RSA SecurID Appliance 3.0 hardware can support an installation of Authentication Manager 8.1. To determine if you can upgrade and migrate on a particular appliance, use the following procedure. Before You Begin Enable SSH on the appliance. For instructions, see the Operations Console Help topic Enable SSH on the Appliance NIC. Procedure 1. Log on to the appliance operating system with SSH. For instructions, see Log On to the Appliance Operating System with SSH in the RSA Authentication Manager 8.1 Administrator s Guide. 2. At the command prompt, type the following: -bash-3.00$ omreport chassis info 3. In the results, look for the value of Chassis Model. If the value is either of the following, you can migrate the appliance to version 8.1: PowerEdge R210 PowerEdge R710 If the value is not one of these, you cannot migrate this appliance. Contact RSA Sales or your vendor to purchase new RSA Authentication Manager 8.1 appliance hardware. Expertise Required for Migration To complete a migration, an administrator must have the necessary knowledge to plan and execute the process. This topic summarizes the expertise that is required for administrators who plan or perform the migration. Administrator Planning the Migration The administrator planning the migration must understand the organization s goals and needs to make decisions and select a migration path. Expertise is required in the following areas. Authentication Manager 7.1 Deployment. Understand how the migration affects components such as authentication agents, replica instances, trusted realms, and RADIUS servers. Network. Be familiar with your network and the overall affects of migration. See Factors that Affect Migration on page 14. Testing Migration and Version 8.1 Features. Understand the deployment and features required in production. Before testing migration and features in RSA Authentication Manager 8.1, consider what setup tasks are required and whether to transition the test environment into production. 1: Planning a Migration 13

14 Migration Scenarios. Be familiar with the different scenarios and with the organization s particular needs to lead the decision-making process. See Factors that Affect Migration on page 14. See Selecting a Migration Scenario on page 22. Review and understand the steps that apply to the selected migration scenario. Setup and Post-Migration Tasks. Review the pre-migration and post-migration procedures. See Chapter 2, Setting Up for Migration, Chapter 3, Pre-Production and Testing Version 8.1, and Chapter 7, Post-Migration Tasks. Migrated and Non-Migrated Data. Review which data is included or excluded from the migration. See Appendix A, Migrated Data and Appendix B, Non-Migrated Data. Administrator Performing the Migration The administrator performing the migration should understand the following areas. Authentication Manager 7.1 Deployment. Understand how the migration affects components such as authentication agents, replica instances, trusted realms, and RADIUS servers. See Factors that Affect Migration on page 14. Testing Migration and Version 8.1. Understand the features being tested. Network. Be familiar with your network and the overall affects of migration. Selected Migration Scenario. Understand all required steps and how these steps affect the network and deployment. Setup and Post-Migration Tasks. Review the setup and post-migration tasks. Access and Permissions The administrator performing the migration must have access to the RSA SecurID Appliance 3.0 to install the RSA Authentication Manager 7.1 Migration Export Utility. The administrator must also have permission to execute the installer shell script, and must run the utility as root user. Factors that Affect Migration It is important to understand how the following factors affect the migration process. Migration on Existing Hardware Pre-Production and Migration Import Options Authentication Agents Authentication Downtime Potential Data Loss Administrative Downtime Migration Time 14 1: Planning a Migration

15 Migration on Existing Hardware Migrating data from version 7.1 to version 8.1 on existing RSA SecurID Appliance 3.0 hardware requires that you overwrite the appliance with an installation of version 8.1. During this process, the original 7.1 installation and any data that is saved on the appliance is overwritten. To reuse the RSA SecurID Appliance 3.0 hardware, the following steps are included in every migration scenario: You must back up the appliance with imaging software such as PING to ensure that you have the ability, if necessary, to roll back the migration process and return to the version 7.1 deployment. The version 8.1 installation overwrites version 7.1. You must download the RSA Authentication Manager Hardware Appliance Installer ISO file that is required for 8.1 installation from Download Central. For more information, see Chapter 2, Setting Up for Migration. If the version 7.1 deployment has multiple replica instances, you can create a test environment by removing a replica instance from your deployment and installing version 8.1 on the 7.1 replica appliance. You deploy the former replica instance as a primary instance with a unique hostname and IP address. These actions allow you to dedicate an appliance for testing without seriously affecting or creating conflicts with the current production environment. When you perform a migration, you can preserve the settings that you configured during the testing period and transition this environment into production. For more information, see Pre-Production and Migration Import Options on page 16. If you do not want to test the migration process, during an actual migration, you must first create a temporary 8.1 primary instance from a version 7.1 replica instance to gradually migrate and upgrade your deployment. Although you export data from the version 7.1 primary instance, you do not install version 8.1 on the original 7.1 primary instance until the version 7.1 replica instances have been upgraded and attached to the version 8.1 primary instance. After you install 8.1 on the 7.1 primary appliance, you configure the instance as a replica and attach the instance to the 8.1 primary that you temporarily configured. To recreate the exact deployment that you had in version 7.1, you promote this instance to become the 8.1 primary instance. If you have a standalone primary deployment, you cannot test the migration or follow the steps that are documented in the migration scenario chapters. For instructions on migrating a standalone primary deployment, see Appendix E, Migrating a Standalone Primary Deployment. 1: Planning a Migration 15

16 Pre-Production and Migration Import Options You can test the migration process and version 8.1 by creating a pre-production test environment from a version 7.1 replica appliance. To do this, you remove a version 7.1 replica instance from your deployment, install the appliance with version 8.1, and configure the appliance as an 8.1 primary instance. The test environment is given a unique hostname and IP address to avoid conflict with the 7.1 deployment that is in production. You test version 8.1 with migrated data by exporting the migration package from version 7.1 without stopping services on the deployment. This data is then imported into the 8.1 testing environment. When you are ready for the version 8.1 primary instance to enter production, you create a new migration package. This package includes data that version 7.1 collected while you were testing version 8.1. When you import to the production environment, you can do the one of the following: Update version 8.1 with the latest data from version 7.1 and retain the system settings and deployment topology of version 8.1. This option preserves the overall setup that you tested, and you import data that was updated on version 7.1 during the testing period, such as user and token data. For a list of data that is retained and imported, see Appendix C, Retained and Imported Pre-Production Data. Completely remove existing data from version 8.1 to import the newly exported migration package from the 7.1 primary instance. This option loses the system settings that you migrated and configured during the testing period. All configured components, such as replica instances and web tiers, are lost. If you retain any settings from the testing period, you obtain these benefits: You do not need to reconfigure the deployment and system settings when version 8.1 is in production. You can perform many essential setup tasks during the pre-production period that are required after migration. For example, because scheduled backup and restore settings are not migrated, you can apply these settings during pre-production. You can test the settings before production and save configuration time during production. For a list of pre-production setup tasks that can be preserved during a migration, see Pre-Production Setup Tasks on page : Planning a Migration

17 Authentication Agents After migration, each hardware appliance in your 8.1 deployment is configured with the same hostname and IP address that was set originally in version 7.1. The test environment is initially given a different hostname and IP address. However, this network setting is temporary. During the migration, the hostname and IP address is changed to match its original 7.1 settings. Because you are ultimately reusing the hostname and IP address of each version 7.1 instance, the migration scenarios as documented do not require that you update authentication agents. The agents that communicated with version 7.1 can automatically communicate with version 8.1. This ensures minimal or no authentication downtime for the 8.1 deployment. Note: If you decide to use a different hostname and IP address, you must generate a new sdconf.rec file that contains the new IP address for version 8.1, and distribute the file to all agents. For more information, see the Administrator s Guide. After testing the migration process, you can retain the system settings and deployment topology of the test environment during the migration scenario. For more information about pre-production, see Pre-Production and Migration Import Options on page 16. Authentication Downtime Authentication downtime occurs in the following situations: When you export data from the primary instance with the Basic Migration (All Instances Offline) option. The 7.1 replica instances cannot authenticate users while the primary instance is offline. In a 7.1 standalone primary deployment, services on the primary instance are stopped during migration. The 7.1 RADIUS server uses a different IP address than the 8.1 instance. For example, this situation applies when version 7.1 includes a remote RSA RADIUS server. RADIUS users cannot authenticate until you update RADIUS clients with the hostname, IP address, or both of version 8.1. For more information about updating RADIUS clients, see your RADIUS client documentation. After migration, trusted users cannot authenticate until reestablish trusted realm relationships with version 7.1 and 8.1 realms. 1: Planning a Migration 17

18 Potential Data Loss To avoid or minimize authentication downtime in a replicated deployment, consider the following migration options: Basic Migration (Replica Instances Online): Exports data from the primary instance with stopped services. Services on the primary instance remain stopped after export. The replica instances are available to authenticate users; however, the authentication updates that are recorded by the replica instances are not migrated. Advanced Migration: Stops services on the primary instance to export data from the 7.1 deployment and allows you to eventually export authentication updates that occur on the replica instances while the primary instance is unavailable. When you export data from an instance, services remain stopped on that instance after migration. Data may be lost when you migrate data from only the primary instance and do not migrate the authentication updates such as PIN and password changes that are recorded on the replica instances while the primary instance is unavailable. To avoid data loss, you can do one of the following: Perform a Basic Migration (All Instances Offline), which stops services on the replica instance. Perform an Advanced Migration, which exports data that accumulates on the replica instances while the primary instance is unavailable. Administrative Downtime Migration Time Services stop on the 7.1 primary instance for all migration scenarios. Once the 8.1 primary instance is available, you can administer the system. The following exceptions apply: Services do not stop when you are performing a test migration. While you can administer the system on the version 8.1 primary instance, users cannot authenticate until authentication agents can communicate with the 8.1 deployment The time that it takes to migrate data depends on the size of your database, the hardware where version 7.1 is installed, and the operating system of version 7.1. If you have a large database or a slower system, the data migration may take some time. Important: Migrate data at a time when users do not frequently authenticate, such as on a weekend. 18 1: Planning a Migration

19 RSA RADIUS Migration In version 8.1, each Authentication Manager instance runs an RSA RADIUS server. While data is migrated from a remote or local version 7.1 RADIUS server, the following data is not migrated: The configuration of a RADIUS server, including the server certificate or any trusted root certificate for a RADIUS server The configuration files (.conf,.ini,.aut) Remote RADIUS dictionary files Local RADIUS server authentication agent Administrative permission to view or edit RADIUS settings for administrators who are not Super Admins If you want to include any of these non-migrated files or settings in version 8.1, you can perform RADIUS-related tasks after migration. However, you can perform certain RADIUS-related tasks at pre-production while you test and setup version 8.1 and perform other tasks after migration. For a list of tasks that you can complete in pre-production, see RSA RADIUS on page 44. If you complete these tasks and decide to preserve pre-production settings during import, see the post-migration tasks listed in RSA RADIUS on page 105. If you decide to completely overwrite pre-production settings during your migration, see the post-migration tasks listed in RSA RADIUS on page 108. For a complete list of data that is migrated and not migrated, see Appendix A, Migrated Data and Appendix B, Non-Migrated Data. Migration of Multiple Realms from Version 7.1 In version 8.1, a realm is an organizational unit that includes all of the objects managed within a single deployment, such as users and user groups, tokens, password policies, and agents. In version 7.1, you can create multiple realms in a deployment and distribute your organizational hierarchy throughout these realms. However, version 8.1 does not support multiple realms within a single deployment. Each deployment has one realm that is automatically created when you set up version 8.1. The version 7.1 hierarchy is migrated to version 8.1 as follows: Version 7.1 realms are converted into security domains under the version 8.1 top-level security domain, SystemDomain. Version 7.1 security domains are nested under the new security domains that were formerly version 7.1 realms. 1: Planning a Migration 19

20 The following graphic shows how the migration preserves the management relationships and the version 7.1 hierarchy. When you migrate multiple realms, the following applies: Realm configuration and preference settings are not migrated. The 8.1 realm inherits the system settings and preferences from the 8.1 top-level security domain, the SystemDomain. For example, in version 7.1, settings such as security questions for Self-Service, RADIUS profile priority, default RADIUS profile, and user authentication requirements are configured per realm. However, in version 8.1, these settings are configured in the system settings for the deployment. These settings are migrated only from the default 7.1 realm that is created automatically at installation. They are not migrated from any realms that were subsequently added to version 7.1. External identity source users who were managed in the 7.1 realms that you added after installation are associated with the same subdomains after migration. These subdomains are nested under the newly converted security domain to preserve the same hierarchical relationships. 20 1: Planning a Migration

21 If an external identity source user is in an added 7.1 realm and they were never managed in that realm, they are associated with the 8.1 top-level security domain (SystemDomain) after migration. In version 8.1, you can manually move these users to a lower-level security domain. You can also map external identity sources to security domains. This setting automatically moves users to the mapped domain when they are managed in Authentication Manager. For more information, see the chapter Preparing for RSA Authentication Manager for Administration in the RSA Authentication Manager 8.1 Administrator s Guide and the Security Console Help topic Add Default Security Domain Mappings. If any identity sources contain a duplicate User ID, authentication may not succeed. For more information, see the chapter Administering Users in the RSA Authentication Manager 8.1 Administrator s Guide. Policies are only migrated from the 7.1 default realm. They are not migrated from any 7.1 realm that you created. If the policies associated with the 7.1 default realm are not in the top-level security domain (SystemDomain) and you need them in version 8.1, after migration, you must recreate the policies and assign them to the new security domains. If you do not recreate any custom policies, the security domains are automatically set with the 8.1 default policies. Administrative roles are only migrated from the 7.1 default realm. They are not migrated from any 7.1 realm that you created. Therefore, users who were administrators in an added version 7.1 realm are no longer administrators in version 8.1. After migration, you must create and assign administrative roles to the affected users. For a complete list of data that is migrated and not migrated from the 7.1 realms, see Appendix A, Migrated Data and Appendix B, Non-Migrated Data. 1: Planning a Migration 21

22 Selecting a Migration Scenario Use the following diagram to determine which migration scenario best fits your deployment and network. Start Are you migrating to 8.1 on existing RSA SecurID Appliance 3.0 hardware that is currently in production? YES Do you have a standalone primary instance deployment? NO Do you want to create a test environment with migrated data that can be configured and transitioned into production? YES NO YES NO See Chapter 3. See the RSA Authentication Manager 7.1 to 8.1 Migration Guide : Migrating to a New Hardware Appliance or Virtual Appliance See Appendix E Test the migration process and version 8.1 until satisfied with the results. When you are ready to perform a migration that requires you to overwrite 7.1 with 8.1, continue with the workflow. NO To expedite the migration, can you afford authentication downtime? YES NO In addition to migrating data from the primary instance, do you want to migrate authentication updates from the replica instances? YES See Scenario 1 (Basic Migration with the Replica Instances Online) See Scenario 3 (Advanced Migration ) See Scenario 2 (Basic Migration with All Instances Offline) 22 1: Planning a Migration

23 For more detailed information, see the appropriate reference. Scenario Scenario 1 (Basic Migration with the Replica Instances Online) Scenario 2 (Basic Migration with All Instances Offline) Scenario 3 (Advanced Migration) Chapter Chapter 4, Performing a Basic Migration with the Replica Instances Online Chapter 5, Performing a Basic Migration with All Instances Offline Chapter 6, Performing an Advanced Migration For a high-level comparison of the scenarios, see Appendix E, Migrating a Standalone Primary Deployment. Before you complete a migration scenario, perform any set up tasks. For more information, see Chapter 2, Setting Up for Migration. 1: Planning a Migration 23

24

25 2 Setting Up for Migration Pre-Migration Checklist Before you upgrade to RSA Authentication Manager 8.1, you need to prepare the RSA Authentication Manager 7.1 deployment for migration. Determine if You Can Upgrade the Hardware Appliance Before starting the migration process, you must determine if your existing hardware is eligible for an upgrade. Certain versions of the RSA SecurID Appliance 3.0 do not support RSA Authentication Manager 8.1. For more information, see Determine if You Can Upgrade the Hardware Appliance on page 13. Determine the Method You Will Use to Back Up the Appliance The process of migrating to version 8.1 overwrites the version 7.1 installation on the RSA SecurID Appliance 3.0. A backup of an existing appliance is required to ensure that you can revert an 8.1 appliance back to RSA SecurID Appliance 3.0. If you need to restore version 7.1 to the hardware, you use the backup to overwrite the 8.1 installation. RSA recommends using PING to create a backup image of the hardware appliance in case you need to restore the hardware appliance with an image of Appliance 3.0. For more information, see the RSA Knowledgebase article To download PING, go to Download RSA Authentication Manager Hardware Appliance Installer To prepare for the software upgrade process, you must download the RSA Authentication Manager Hardware Appliance Installer ISO file from Download Central and save the ISO file to a location where you can burn the file onto a DVD. You must use disc burning software that can burn the ISO file as a bootable disk image. To download the RSA Authentication Manager Hardware Appliance Installer, go to 2: Setting Up for Migration 25

26 Determine Which Replica Instance You Will Use As the Version 8.1 Primary Instance RSA recommends that you use an existing version 7.1 replica instance to initially migrate the deployment to version 8.1 for the following reasons: You can continue to use the version 7.1 primary instance during pre-production and testing. You may need to access the version 7.1 primary instance for troubleshooting the migration. If you migrate the primary first, you need to restore it before you attempt to resolve any issues related to the migration process. Ensure that Authentication Manager 7.1 is Running Service Pack 4 RSA Authentication Manager 7.1 requires Service Pack 4 to run the RSA Authentication Manager 7.1 Migration Export Utility. If the 7.1 deployment being migrated has a trust relationship with another 7.1 deployment, you must update the 7.1 trusted realm deployment to Service Pack 4 Patch 21 or higher. To verify the version of Authentication Manager 7.1, in the Security Console, go to Help > About RSA Security Console, and click See Software Version Information. To obtain RSA Authentication Manager 7.1 Service Pack 4 or any Service Pack 4 patch, go to RSA SecurCare Online at and download the update. For instructions on installing Service Pack 4, see the RSA Authentication Manager 7.1 Service Pack 4 Release Notes. For instructions on installing a Service Pack 4 patch, see the Readme file associated with the patch in RSA SecurCare Online. Confirm that the Authentication Manager 7.1 Deployment is Functioning The 7.1 deployment must be in a healthy state. Authentication Manager services, including database services, must be running. Data must be replicating. If a RADIUS server is associated with an instance or trusted realm, the RADIUS server must be available. Save Completed Reports Completed reports are not migrated. If you want to save these reports, you can save the output of completed reports. For instructions on viewing and saving the report output, see the Security Console Help topic View Report Jobs. Complete Pending User Requests You must complete all pending user requests for self-service enrollment, hardware tokens, software tokens, and on-demand tokencodes. Pending user requests are not migrated. For instructions, see the Security Console Help topics Approve and Reject User Requests and Complete User Requests. 26 2: Setting Up for Migration

27 Copy and Save the Notification Template for Approved Software Token Requests The 7.1 notification template for approved software token requests is not migrated. By default, version 8.1 includes an improved notification template for approved software token requests. If you want to reuse the content of the 7.1 notification template for approved software token requests, copy and save the template to an accessible location. During pre-production or after completing a migration, modify the saved 7.1 template for use in version 8.1. Schedule a Cleanup Job Use a scheduled cleanup job to automatically remove unresolvable users and user groups on version 7.1. This process deletes users and user groups that do not exist in an identity source. A cleanup job that is started manually does not remove references to unresolvable user groups. To schedule a cleanup job, see the Security Console Help topic Schedule Cleanup. Prepare for RADIUS Post-Migration Tasks The following RADIUS settings are not migrated from version 7.1: RSA RADIUS server certificate RSA RADIUS configuration files (.conf,.ini,.aut) RADIUS dictionary files from a remote RADIUS server Trusted root certificate for RADIUS servers After migration, you can import RADIUS files such as the server certificate, remote RADIUS dictionary files, and the trusted root certificate. To import, save a copy of these files to an accessible location. If you are migrating to a new appliance, you can perform some of these tasks during pre-production testing. If you have a remote RADIUS server, the 7.1 remote RADIUS dictionary files are located in the following locations: On Windows: RSA_AM_HOME/radius/Service On Linux: RSA_AM_HOME/radius If you edited the RSA RADIUS configuration files and you want to apply these edits to 8.1, record the edits that you made to the 7.1 RADIUS configuration files. Record Manual Contact Lists Version 7.1 manual contact lists for authentication agents are not migrated. After migration, recreate the agent contact lists and assign the lists to authentication agents. If you want to recreate the contact lists from version 7.1, record each contact list and save it to an accessible location. 2: Setting Up for Migration 27

28 Record Network Settings Associated with the 7.1 Instances Record the following network settings of each 7.1 instance: Fully qualified domain name (FQDN) IP Address Subnet mask Default gateway Domain Name System (DNS) servers and search domain configuration During a migration scenario, you apply these settings when deploying the hardware appliance. Install the RSA Authentication Manager 7.1 Migration Export Utility The Migration Export Utility is used to export data from the 7.1 deployment. For more information, see Migration Export Utility Installation on page 28. Migration Export Utility Installation You must install the RSA Authentication Manager 7.1 Migration Export Utility on the version 7.1 primary instance appliance. The RSA SecurID Appliance 3.0 requires the command line version of the Migration Export Utility. This utility securely extracts data to an encrypted migration package that you import to the RSA Authentication Manager 8.1 primary instance. The Migration Export Utility installation file is located in the RSA Authentication Manager 8.1 download kit. You must copy the following installation file from the RSA Authentication Manager 8.1 download kit to an accessible location on the 7.1 host machine: migration-installer.sh migration-installer.jar The migration-installer.jar file must exist in the same directory as the installation file You can use a number of methods to copy the files to version 7.1. For example, you can use a Secure Copy Protocol (SCP) client to copy these files from your local computer to the RSA SecurID Appliance 3.0.If you use an SCP client to copy the installation files to the Appliance, log on as emcsrv and enter the operating system password that you specified during Quick Setup. 28 2: Setting Up for Migration

29 Install the Migration Export Utility Use this procedure to install the RSA Authentication Manager 7.1 Migration Export Utility through a command line. You must use the command line to install the utility on the RSA SecurID Appliance 3.0. Before You Begin Locate the correct installation file, as described in Migration Export Utility Installation on page 28. Using a Windows file sharing mechanism, Secure Copy Protocol (SCP) client, or another method, copy the installation file and the migration-installer.jar file from the RSA Authentication Manager 8.1 download kit to an accessible location on the RSA Authentication Manager 7.1 primary instance host machine. Place the files in the same directory. To determine which installation file you need, see Migration Export Utility Installation on page 28. Make sure you can log on as root. You must run the installer as the root user. Make sure that the execute permission is enabled on migration-installer.sh. You must enable Secure Shell (SSH). For instructions, see the 7.1 Operations Console Help topic Enable SSH on an Appliance NIC. Procedure 1. Do the following to access the installer: a. Using an SSH client, log on to the Appliance operating system with the User ID emcsrv, and the operating system password created during Quick Setup. b. Change users to root. Type: sudo su - and press ENTER. c. When you are prompted for a password, enter the operating system password specified during Quick Setup. d. Change directories to the location where you copied migration-installer.sh and migration-installer.jar to the server. e. Type the following command, and press ENTER:./migration-installer.sh -console 2. On the Welcome screen, type 1 to continue, and press ENTER. 3. On the License Agreement screens, press ENTER to proceed through each Agreement screen. 4. Type 1 to accept the terms of the License Agreement, and press ENTER. 5. To install the utility, enter a full path that does not exist, and press ENTER. The installer will create this path. 2: Setting Up for Migration 29

30 6. Confirm the location that you specified. 7. Type 1 to begin the installation process, and press ENTER. 8. Do one of the following: To run the utility after installation, type 1, and press ENTER. Run the utility only when you are ready to export data. To exit the installer and export data at a later time, type 2, and press ENTER. Next Steps Test the migration process. For instructions, see Chapter 3, Pre-Production and Testing Version : Setting Up for Migration

31 3 Pre-Production and Testing Version 8.1 Pre-Production A pre-production test environment is a deployment of RSA Authentication Manager 8.1 that is not yet live in your network and is used for testing and setup purposes while version 7.1 is in production. You can only test the migration and Authentication Manager 8.1 when the 7.1 deployment is replicated. The testing process requires that you remove a replica instance from your deployment and install version 8.1 on the appliance. If you decide to perform a test migration, make sure that your version 7.1 deployment can be without a replica instance before upgrading to version 8.1. Note: If you plan to test the migration and perform an Advanced Migration, your deployment must include at least two replica instances. The following graphic shows the process that is required to create a temporary 8.1 primary instance for testing. For detailed steps, see Testing the Migration on page 33. 3: Pre-Production and Testing Version