Unable to Add DNS Domains to Secure Access Virtual Appliance

Issue

Users are unable to add DNS domains to a Secure Access Virtual Appliance (VA), which prevents the configuration of local DNS domains needed for name resolution through the VA. This blocks the intended DNS handling for specific domains via the VA. When attempting to add domains to the Secure Access VA, the configuration fails to accept the domains, preventing proper DNS resolution functionality.

Environment

• Cisco Secure Access with Virtual Appliance (VA) deployment
• Secure Access Internet Security features including Traffic Steering
• Local DNS configuration requirements for specific domains

Resolution

To resolve this issue, the domains must first be added to the Secure Access Traffic Steering configuration before they can be configured on the Virtual Appliance for local DNS handling. Follow these steps:

Step 1: Add Domains to Traffic Steering

Navigate to the Secure Access dashboard and add the required domains to Traffic Steering:

Go to Connect → End User Connectivity → Internet Security → Traffic Steering

Add the domains that you want to configure for local DNS handling through the VA in this section.

Step 2: Configure Local DNS on the Virtual Appliance

After adding the domains to Traffic Steering, configure the domains on the VA using the localdns command. The command syntax supports multiple domains in a single configuration:

config localdns add <IP of local DNS server> <domain1> <domain2> <domain3>

Replace the placeholders with your actual local DNS server IP address and the specific domains you need to configure.

Step 3: Verification

After completing the configuration, verify that the domains are properly configured and that DNS resolution is working as expected for the specified domains through the VA.

Cause

Secure Access requires domains to be present in the Traffic Steering configuration before those domains can be configured on the Virtual Appliance (VA) for local DNS handling. When domains are not added to the Traffic Steering section first, the VA cannot recognize or accept them for local DNS configuration, resulting in the inability to add DNS domains to the VA.

Related Content

• Cisco Technical Support & Downloads

Revision History

Revision	Publish Date	Comments
1.0	19-May-2026	Initial Release