Understand Blocked A Records Error on Umbrella Roaming Client Version 2.2.150

Introduction

This document describes a known issue with blocked A records in Umbrella roaming client version 2.2.150.

Background Information

Version 2.2.150 of the roaming client contains a known issue where the state "Unprotected (Blocked A records)" is reported when the client was previously Protected in prior client versions. If you are seeing this message, please read on for cause and workarounds to remove the error until a resolution is available in a future release. To receive updates on future releases, please subscribe to our release notes.

The error message looks like image:

_thumb_45882.png

Issue Background

Version 2.2.150 of the roaming client includes a new DNS validation check to confirm that A records are resolvable before going encrypted. This serves as insurance to avoid entering the protected and encrypted state in the presence of conflicting 3rd party software such as Bluecoat/K9 and npcap. It is intended as a supplementary check after entering the protected state to ensure that DNS A record resolution is possible.

There is currently a known issue which can result in this check preventing causing the client to enter an Unprotected state. This occurs when the client is failing over from Protected and Encrypted checks to Protected and Unencrypted checks. Rather than successfully entering protected and unencrypted, the A record check causes the client to enter an Unprotected state due to the A record check. Cisco is aware of this issue and is working towards a permanent solution.

Additionally, the time between a state change and a return to unencrypted/protected mode can be delayed.