New PIN Mode and Next Tokencode Mode fail after Cisco ASA upgrade to 9.1.7 in RSA Authentication Manager 8.x
Originally Published: 2016-04-07
Last Modified: 2026-06-09
Article Number
000058764
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.x
Platform (Other): Cisco ASA 
O/S Version: ASA 9.1.7
 
Issue
New PIN Mode and Next Tokencode Mode always result in a failure when using Cisco clients after the recent upgrade to ASA 9.1.7.  After the upgrade:
  • Users are unable to set PINs for tokens.
  • Authentication failures when the next tokencode is entered.
The error shows on the Authentication Manager real-time activity monitor as follows: 
Passcode format error and authentication failure
On the Cisco client, the error is: 
Session operation failure processing request from agent



 
Resolution

This is Cisco bug CSCuy89425 (AAA: RSA/SDI unable to set new PIN), and it occurs with the RSA SecurID_Native protocol. 

Possible workarounds include:

  1. Switch to RADIUS protocol (as per the RSA SecurID Access Implementation Guide for the Cisco Adaptive Security Appliance (ASA). 
  2. Authenticate from the Self-Service Console when a token is in New PIN Mode or Next Tokencode Mode.

For more details on how to resolve the issue for a Cisco VPN client or iPhone, review documentation for CSCuy89425 (AAA: RSA/SDI unable to set new PIN).

Related Articles

Trending Articles

Don't see what you're looking for?