Contents

Issue

Users encounter intermittent 404 errors after clicking "Continue" on a Secure Web Gateway (SWG) warn page instead of being allowed through as intended. This issue occurs during normal policy flow when SWG warn pages are triggered, impacting user web access. The problem manifests as users hitting the SWG warn page via desired policy implementation, but after clicking "Continue" they receive 404 errors instead of proceeding to their intended destination.

Environment

- Technology: Solution Support (SSPT - contract required)

- Sub-technology: Secure Access

- Product Family: SECACCS

- Affected Domain: block.sse.cisco.com

Resolution

The issue has been resolved in CSC version 5.1.16, which is now available on CCO (Cisco Connection Online). The resolution involved modifications to DNS handling and response processing for the affected domain.

Resolution Steps

Step 1: Upgrade to CSC 5.1.16

Download and install CSC version 5.1.16 from CCO, which contains the fix for the DNS record handling issue.

Step 2: Verify DNS Response Changes

The DNS AAAA response for block.sse.cisco.com has been modified to not use mapped IPs, eliminating the root cause of the issue.

Step 3: Test SWG Warn Page Functionality

Verify that users can successfully click "Continue" on SWG warn pages without encountering 404 errors.

Troubleshooting Data Collection

If the issue persists or for diagnostic purposes, collect the following logs.

https://www.cisco.com/c/en/us/support/docs/security/secure-access/221240-troubleshoot-and-collect-basic-informati.html

- DART logs with maximum debug enabled

- Network packet captures (pcap)

- KDF logs

- HAR (HTTP Archive) files from browser sessions

Cause

The issue occurred due to DNS records for block.sse.cisco.com in the internal DNS cache being overwritten by duplicate DNS records with randomized TTLs (Time To Live values). This DNS corruption caused the SWG warn page redirection mechanism to fail, resulting in 404 errors when users attempted to continue through the warn page. The DNS handling inconsistencies prevented proper resolution of the domain used for the warn page functionality.

Related Content

- Cisco Technical Support & Downloads