A Secure Access Resource Connector is showing a disconnected state with the error message "This connector is disconnected. Run diagnostics to identify the issue. This often involves checking firewall rules to ensure that the connector can reach Secure Access. If problems persist, contact support." The issue impacts the ability of the connector to function, potentially affecting user access through Secure Access.
Cisco Secure Access
Technology: Secure Access Resource Connector
Multiple Resource Connectors in the same environment
Upstream firewall
The resolution approach involved comprehensive network diagnostics and ultimately deploying a new Resource Connector as a replacement for the faulty unit.
If there is an upstream firewall, you can run packet captures there + tcpdump on faulty Resource Connector to analyze the TLS handshake and network connectivity.
You can retrieve certificate information for api.sse.cisco.com using this command:
echo | openssl s_client -servername api.sse.cisco.com -connect api.sse.cisco.com:443 -showcerts 2>/dev/null | openssl x509 -text -noout -issuer -dates -fingerprint
If you observe TCP RST responses and network-level connectivity issues specific to the faulty RC, deploy a new Resource Connector to replace the problematic unit.
The root cause was identified as network-level connectivity issues specific to the faulty Resource Connector. The TCP RST responses received when attempting to connect to the Secure Access IPs 35.165.184.17 (us.controller.acgw.sse.cisco.com), combined with one-way traffic patterns observed on the upstream firewall, indicated a communication failure between the specific connector and the Secure Access infrastructure. The fact that another RC in the same environment functioned properly confirmed that the issue was isolated to the individual connector rather than being a broader network or firewall configuration problem.
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
05-May-2026
|
Initial Release |