Identify Source Public IP of a Secure Access Resource Connector VM

Issue

When managing Cisco Secure Access (CSA) deployments with Resource Connector VMs, there is no built-in method within the CSA graphical user interface to view the source global (egress) IP address used by a Resource Connector VM when it connects to the Cisco Secure Access service. This information is often needed to verify network architecture changes, such as confirming that traffic is properly routing through firewalls or other network infrastructure components after migration.

The challenge arises when administrators need to validate that their Resource Connector VM is successfully communicating through updated network paths, such as when routing traffic through Azure Firewall or other security appliances, and require visibility into the actual public IP address being used for outbound connections to CSA.

Environment

• Cisco Secure Access (CSA) with Zero Trust Architecture (ZTA)

• Resource Connector VM deployed in cloud environment (such as Azure)

• Network architecture involving firewall or NAT devices

• Need to verify egress IP address for network validation

Resolution

Since the CSA GUI does not provide a method to view the Resource Connector VM global IP address, and the Resource Connector VM environment has limited Linux commands available, the recommended approach is to use the nslookup command from within the Resource Connector VM itself.

Step 1: Access the Resource Connector VM

Connect to your Resource Connector VM using your standard access method (SSH, console, and more).

Step 2: Execute the nslookup Command

Run this command to query your public IP address:

nslookup myip.opendns.com 208.67.222.222

Step 3: Interpret the Output

The command returns output similar to this format:

Name: myip.opendns.com
Address: xxx.xxx.xxx.xxx

The Address field in the output represents the global IP address that your Resource Connector VM is using to communicate with external services, including Cisco Secure Access.

Important Notes

The Resource Connector VM environment restricts the available Linux commands that can be executed. For a complete list of supported commands, refer to the Cisco Secure Access documentation at: https://securitydocs.cisco.com/docs/csa/olh/120798.dita

This method provides a reliable way to determine the egress IP address without requiring access to the CSA management interface, making it useful for network validation and troubleshooting scenarios.

Cause

The Cisco Secure Access GUI is designed to focus on policy management, user access control, and security posture rather than detailed network connectivity information. The Resource Connector VM egress IP address is considered a network-level detail that is typically managed and monitored through network infrastructure tools rather than the security service interface.

Related Content

• Cisco Secure Access Resource Connector Command Reference

• Cisco Technical Support & Downloads

Revision History

Revision	Publish Date	Comments
1.0	04-Nov-2026	Initial Release