Secure Access Resource Connector Disconnected State

Issue

A Secure Access Resource Connector is showing a disconnected state with the error message "This connector is disconnected. Run diagnostics to identify the issue. This often involves checking firewall rules to ensure that the connector can reach Secure Access. If problems persist, contact support." The issue impacts the ability of the connector to function, potentially affecting user access through Secure Access.

Environment

• Cisco Secure Access

• Technology: Secure Access Resource Connector

• Multiple Resource Connectors in the same environment

• Upstream firewall

Resolution

The resolution approach involved comprehensive network diagnostics and ultimately deploying a new Resource Connector as a replacement for the faulty unit.

Network Traffic Analysis

If there is an upstream firewall, you can run packet captures there + tcpdump on faulty Resource Connector to analyze the TLS handshake and network connectivity.

Certificate Verification

You can retrieve certificate information for api.sse.cisco.com using this command:

echo | openssl s_client -servername api.sse.cisco.com -connect api.sse.cisco.com:443 -showcerts 2>/dev/null | openssl x509 -text -noout -issuer -dates -fingerprint

New Resource Connector Deployment

If you observe TCP RST responses and network-level connectivity issues specific to the faulty RC, deploy a new Resource Connector to replace the problematic unit.

Cause

The root cause was identified as network-level connectivity issues specific to the faulty Resource Connector. The TCP RST responses received when attempting to connect to the Secure Access IPs 35.165.184.17 (us.controller.acgw.sse.cisco.com), combined with one-way traffic patterns observed on the upstream firewall, indicated a communication failure between the specific connector and the Secure Access infrastructure. The fact that another RC in the same environment functioned properly confirmed that the issue was isolated to the individual connector rather than being a broader network or firewall configuration problem.

Related Content

• Cisco Technical Support & Downloads