Users are unable to enroll in the Cisco Secure Access Zero Trust Access (ZTA) system, which was previously functioning correctly and could see Server Connectivity Error. The enrollment process fails with communication errors to enrollment servers, preventing users from completing the ZTA enrollment procedure. This issue affects a large number of users and represents a significant disruption to secure access services.
Technology: Solution Support (SSPT - contract required)
Sub-technology: Cisco Secure Access
Product Family: SECACCS
VPN configuration with Default DNS mode enabled
DNS server configuration pointing to non-responsive server
The ZTA enrollment communication errors are resolved by fixing the DNS server configuration issue. The problem occurs when the VPN is configured with Default DNS mode pointing to a DNS server that is not responding to DNS lookups.
Verify that the VPN Default DNS mode is enabled and check if the configured DNS server is responding to DNS queries. The enrollment servers cannot be reached when DNS resolution fails.
Correct the DNS server configuration to ensure it responds properly to DNS lookups. This could involve:
Updating the DNS server IP address to a working server
Restarting the DNS service on the configured server
Verifying network connectivity to the DNS server
Testing DNS resolution functionality
After fixing the DNS server problem, test the ZTA enrollment process to confirm that users can successfully enroll. The enrollment functions as expected once DNS resolution is working properly.
If DNS configuration is correct but enrollment issues persist, verify that network devices such as firewalls are not restricting access from user PCs to the Secure Access ZTA enrollment servers. Ensure that all required destinations for ZTNA enrollment are accessible through the network infrastructure.
The root cause of the ZTA enrollment communication errors is a DNS configuration issue where the VPN Default DNS mode was enabled and pointing to a DNS server that was not responding to DNS lookups. When DNS resolution fails, the ZTA enrollment process cannot communicate with the enrollment servers, preventing users from completing the enrollment procedure successfully.
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
17-Apr-2026
|
Initial Release |