# Frequently Asked Questions This Frequently Asked Questions (FAQs) section provides answers to the most commonly asked questions for IQService and its associated services. ## IQService - Auto Update ### What Does Auto-Update Mean? Auto-update means that the service updates automatically and does not require any manual intervention to upgrade to the new IQService version. It is like any other connector-bundle release on your VA. ### Does the UpdateService Require Internet Connectivity to Be Enabled from the IQService Box to Be Able to Download the Updates? Internet access is not required for IQService auto update as long as your VA is getting other bundles updated in your environment. Updates are downloaded at your VA and then the required updates are applied to all the IQService hosts using the UpdateService. ### How Do I Enable the Auto-Update? Auto update should already be enabled on your IQService instance. Other than that, you only need to ensure that IQService and the UpdateService are healthy and running. If auto update is not enabled on your system, refer to [Updating IQService]() for configuration instructions. ### Are IQService Auto Updates Safe/Recommended? Yes, enabling auto updates is safe and recommended by SailPoint. The auto updates ensure that your environment is always up to date with fixes and security patches. ### Are There Post Update Verification Steps That I Am Required to Follow? There are no required post update verification steps. If you want, you can check the UpdateService logs to confirm that you have the latest version and to verify the current update status. For more information on setting the trace log level, refer to [Updating IQService](). ### If I Choose to Not Enable Auto Update on IQService, How Will I Be Notified When It Is Time to Perform the Update Manually? SailPoint does not recommend that you manually update IQService. If you are still using the manual process, IQService releases are announced on the [SaaS Release Notes]() page. ### If an Auto Update Fails, Does IQService Roll Back to the Prior Version, or Does the Failed Update Cause the Service to Go Down? The auto update process includes an auto rollback process. A backup of the existing IQService version is made before starting the auto-update process, and if something goes wrong during the update process the backup is used to restore and restart the required services to restore functionality. If you run into a case where the update is successful and some functionality is not working, reach out to your SailPoint Customer Success Manager (CSM). ### How Long Does the Auto-Update Process Take? The process is quick and can last anywhere from a few milliseconds to 30 seconds. ### What Happens to Any in Progress IQService Tasks or Rules That Are in Execution When the Update Runs? Do They Get Interrupted and Is There an Automatic Recovery or Retry for Interrupted Processes? The auto-update process waits until there are no ongoing IQService transactions before starting the update. If there is an ongoing process the UpdateService will retry the update until there is a break in the transactions. ### How Do I Configure the IQService Auto Update When IQService Is Behind a Load Balancer? Refer to the Load Balancer Deployment column in the table on [Updating IQService](). ### I Have Two IQService Servers (behind a Load Balancer) - Does the Update Occur on One and Then the Other Sequentially? In load-balanced deployments, the UpdateService is shared amongst multiple IQService hosts. IQService instances are updated one at a time. This sequential update process ensures, there is no downtime during updates and at least one IQService instance is always available to process requests. This approach maintains system availability while applying updates to your IQService servers. For more information on configuring the UpdateService in an environment with a load balancer, refer to the Load Balancer Deployment column in the table on [Updating IQService](). ### To Configure UpdateService with TLS What Commands Are Required to Be Executed, or Is It Necessary to Go Through the Entire IQService Installation Process from the Beginning? You do not need to go through the entire IQService installation to configure TLS. Run the following command on the UpdateService and on the remote IQService server: ```text IQService.exe -z "tcps://:" ``` ### What Is the Process for Testing and Verifying the Functionality After Configuring UpdateService with TLS? If you have configured TLS and the UpdateService is running after installation, then that's it. You can run the IQService `-v` command to list the current statuses for all the services including the UpdateService. If the UpdateService is running, then your environment is good to go. ### Can IQService Be Behind the Load Balancer As Required for Redundancy or Load Sharing? IQService can be behind the load balancer as required for redundancy or load sharing. > [!NOTE] > > SailPoint does not certify any specific load balancer, work with your networking/IT team to resolve any configuration issue. For Configuring IQService with Load Balancer, perform the following: 1. For TLS communication, perform the following: 1. Create a certificate on load balancer. 2. For IQService hosts, export the certificate with **Private Key** and copy the certificates to personal and trusted folders. 3. Import the certificate in keystore and restart the web server. 4. Configure IQService with -m command `(-m )` as follows: ```text iqservice.exe -m "FQDNNameOFLoadBalancer" ``` 5. Restart the IQService. 2. For an unknown hosts error, provide the DNS mapping of Load balancer in IdentityIQ hosts files in the following format: ```text IPAddress FQDN 172.18.40.23 FQDNofLoadBalancer ``` File locations: - (For windows) `C:\Windows\System32\drivers\etc\hosts` - (For Linux) `/etc/hosts` 3. For key exchange, the key exchange task request would be triggered for one of the IQService hosts. Now copy the keys on other IQService machines. 4. To avoid Load Balancer creating unnecessary logging in IQService, set the IQService log level to 0. 5. In case of any fail over, the Load Balancer mechanism would redirect the requests to appropriate running IQService hosts. 6. TLS and Non-TLS ports of IQService are allowed through firewall for incoming and outgoing request through Load Balancer. ## IQService - Security ### Is It Possible to Change the TLS Cipher Suites on the IQService Side? Yes, you can change the TLS version and cipher suites on the Windows side. Microsoft provides a list of the default prioritized cipher suites that come as part of Windows OS, and on that list the AEAD ciphers (for example, AES-GCM) are usually on top. By default, IQService uses the top AEAD cipher suite unless the peer is configured to use less secure cipher suites. You have the option to configure TLS versions and cipher suites on Windows, that way if a client tries to negotiate with less secure ciphers, they are disabled on the OS level. The following lists the cipher suites supported on Windows, you can configure these based on your requirements: [Cipher Suites in TLS/SSL](). The following provides information on TLS configurations: [Enable TLS 1.1 and TLS 1.2 onwards support in Office Online Server](). You can enable TLS on the server side. For more information, refer to [Enable TLS 1.1 and TLS 1.2]().