Resolve Secure Access Errors for Active Directory and Virtual Appliances

Introduction

This document describes common error, warning, and informational messages on the Sites and Active Directory page and provides resolution steps.

Prerequisites and Important Warnings

• Syncing Time: Allow up to 10 minutes for synchronization processes to complete after changes.
• Network Requirements: Ensure connectivity between Connectors, Virtual Appliances, Domain Controllers, and the Secure Access Cloud is permitted.
• Server Support: Use Windows Server 2012 or higher for Connector deployments to ensure compatibility with TLS 1.2.
• Log Collection: If an issue persists after following the provided steps, collect the relevant AD connector logs for further investigation.
  
  

Virtual Appliances

Virtual Appliance Syncing

• [Information] This VA has registered but has never synced: Verify network requirements. If the issue persists, open a support case.
• [Error] This VA was syncing at one point but has since stopped: If the VA is decommissioned, remove it from the Secure Access dashboard. Otherwise, verify network connectivity.
  
  

Connector Connections

• [Information] This VA was previously connected to one or more Connectors, but is now connected to none: If Connectors were removed, delete them from the dashboard.
• [Warning] This Virtual Appliance is connected to some, but not all, of the Connectors for this site: Review prerequisites and collect logs for support.
• [Warning] DNS queries forwarded by this VA to Secure Access are not encrypted: This occurs when DNSCrypt fails. Ensure firewalls do not perform deep packet inspection on port 53. Ensure the VA is on version 3.1.x or higher.

Local Domain and High Availability

• [Information] This VA does not have any local domains configured: Configure local domains via the Local DNS Forwarding settings.
• [Error] This VA is not redundant within its site (2+ VA required per site): Install a second Virtual Appliance to ensure high availability.
• [Error] A large percentage of DNS queries to this VA are failing: Open a support case.
  
  

AD Connectors

Connector Syncing and Connections

• [Information] This Connector has registered but has never synced: Wait 10 minutes for sync. Verify network requirements and collect logs.
• [Error] This Connector was syncing at one point but has since stopped: Verify the server supports TLS 1.2. Ensure the connector version is 1.6.31 or higher.
• [Information] This Connector has either no VA or no DC to connect to: Ensure the site contains at least one VA and one DC.

DC and VA Connections

• [Warning] The Connector is connected to some, but not all, DCs: Verify prerequisites and collect logs.
• [Error] The Connector was once connected, but is not currently connected to any of the DCs available: Verify prerequisites and collect logs.
• [Warning] The Connector is reporting timeout errors while attempting to connect to some VAs: If the VA is on a different LAN, consider using multiple Umbrella sites.
• [Information] The Connector is not syncing events in parallel to VAs: Upgrade the server CPU capacity based on the number of assets.
• [Warning] The Connector is reporting drops while attempting to send events to some VAs: If the event rate exceeds 850 events per second, consider enabling load-balancing by opening a support case.
  
  

Domain Controllers

Connector Connections and WMI

• [Information] This Domain Controller has never connected to a Connector: Install a Connector in the same site as the Domain Controller.
• [Error] Domain Controller is not syncing: https://securitydocs.cisco.com/docs/csa/gov/olh/154807.dita