Recently I was working on a customer firewall where the preferred authentication method for remote VPN access was an RSA token registered to an RSA SecurID appliance. Unfortunately for this customer, they no longer were able to access the appliance for management, and had to rebuild it entirely from scratch.

After the rebuild finished and all of the tokens had been reassigned, they were unable to authenticate to the VPN configured on the ASA with their RSA tokens. After doing some research and validating the ASA configuration, I found a random post in a forum online that described an &quot;.sdi&quot; file on the ASA that is used to communicate between the RSA SecurID appliance and the Cisco ASA.

<!--more--> This file is SPECIFIC to the instance of SecurID that originally connected to it, and since this customer had essentially brought their SecurID appliance to factory defaults, the .sdi file on the ASA needed to be removed and allowed to be recreated.

To test I simply changed the files extension to &quot;.TEST&quot;, and attempted again to connect. This time I was able to authenticate with my RSA token, and connect to the VPN. I also verified that a new .sdi file was created on the firewall.