Cisco Security Cloud Control: AWS VPC Management

PDF

Cisco Security Cloud Control: AWS VPC Management

Troubleshoot Security Cloud Control

Updated: July 2, 2026

Want to summarize with AI?

Log in

Learn how to troubleshoot Security Cloud Control issues, including login failures, access and certificate problems, and object-related errors.

Troubleshooting Access and Certificates

Resolve New Fingerprint Detected State

Procedure

1.

In the left pane, click Security Devices.
2.

Click the Devices tab.
3.

Click the appropriate device type tab.
4.

Select the device in the New Fingerprint Detected state.
5.

Click Review Fingerprint in the New Fingerprint Detected pane.
6.

When prompted to review and accept the fingerprint:

  1. Click Download Fingerprint and review it.

  2. If you are satisfied with the fingerprint, click Accept. If you are not, click Cancel.
7.

After you resolve the new fingerprint issue, the connectivity state of the device may show Online and the Configuration Status may show "Not Synced" or "Conflict Detected." Review Resolve Configuration Conflicts to review and resolve configuration differences between Security Cloud Control and the device.

Troubleshooting SSL Decryption Issues

Handling Web Sites Where Decrypt Re-sign Works for a Browser but not an App (SSL or Certificate Authority Pinning)

Some apps for smart phones and other devices use a technique called SSL (or Certificate Authority) pinning. The SSL pinning technique embeds the hash of the original server certificate inside the app itself. As a result, when the app receives the resigned certificate from the Firepower Threat Defense device, the hash validation fails and the connection is aborted.

The primary symptom is that users cannot connect to the web site using the site's app, but they can connect using the web browser, even when using the browser on the same device where the app fails. For example, users cannot use the Facebook iOS or Android app, but they can point Safari or Chrome at [/concept/conbody/section/p/xref {"link-https"}) https://www.facebook.com (xref] and make a successful connection.

Because SSL pinning is specifically used to avoid man-in-the-middle attacks, there is no workaround. You must choose between the following options:

More Details

If a site works in a browser but not in an app on the same device, you are almost certainly looking at an instance of SSL pinning. However, if you want to delve deeper, you can use connection events to identify SSL pinning in addition to the browser test.

There are two ways an app might deal with hash validation failures:

  • Group 1 apps, such as Facebook, send an SSL ALERT Message as soon as it receives the SH, CERT, SHD message from the server. The Alert is usually an "Unknown CA (48)" alert indicating SSL Pinning. A TCP Reset is sent following the Alert message. You should see the following symptoms in the event details:

    • SSL Flow Flags include ALERT_SEEN.

    • SSL Flow Flags do not include APP_DATA_C2S or APP_DATA_S2C.

    • SSL Flow Messages typically are: CLIENT_HELLO, SERVER_HELLO, SERVER_CERTIFICATE, SERVER_KEY_EXCHANGE, SERVER_HELLO_DONE.

  • Group 2 apps, such as Dropbox, do not send any alerts. Instead they wait until the handshake is done and then send a TCP Reset. You should see the following symptoms in the event:

    • SSL Flow Flags do not include ALERT_SEEN, APP_DATA_C2S, or APP_DATA_S2C.

    • SSL Flow Messages typically are: CLIENT_HELLO, SERVER_HELLO, SERVER_CERTIFICATE, SERVER_KEY_EXCHANGE, SERVER_HELLO_DONE, CLIENT_KEY_EXCHANGE, CLIENT_CHANGE_CIPHER_SPEC, CLIENT_FINISHED, SERVER_CHANGE_CIPHER_SPEC, SERVER_FINISHED.

Troubleshooting Login Failures after Migration

Login to Security Cloud Control Fails Because of Incorrect Username or Password

Solution If you try to log in to Security Cloud Control and you know you are using the correct username and password and your login is failing, or you try the "forgot password" option and cannot recover a viable password, you may have tried to log in without creating a new Cisco Security Cloud Sign On account. You need to sign up for a new Cisco Security Cloud Sign On Account.

Login to the Cisco Security Cloud Sign On Dashboard Succeeds but You Can't Launch Security Cloud Control

Solution You may have created a Cisco Security Cloud Sign On account with a different username than your Security Cloud Control tenant. Contact the Cisco Technical Assistance Center (TAC) to standardize your user information between Security Cloud Control and Cisco Secure Sign-On.

Login Fails Using a Saved Bookmark

Solution You may be attempting to log in using an old bookmark you saved in your browser. The bookmark could be pointing to https://cdo.onelogin.com.

Solution Log in to https://security.cisco.com.

  • Solution If you have created your new secure sign-on account, click the Security Cloud Control tile on the dashboard that corresponds to the region in which your tenant was created:

    • Solution Security Cloud Control APJ

    • Solution Security Cloud Control Australia

    • Solution Security Cloud Control EU

    • Solution Security Cloud Control India

    • Solution Security Cloud Control US

  • Solution Update your bookmark to point to https://security.cisco.com.

Troubleshooting Objects

Resolve Duplicate Object Issues

Duplicate objects are two or more objects on the same device with different names but the same values. These objects are usually created accidentally, serve similar purposes, and are used by different policies. After resolving duplicate object issues, Security Cloud Control updates all affected object references with the retained object name.

To resolve duplicate object issues:

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Objects and choose an option.

3.

Then filter the objects to find duplicate object issues.

4.

Select one of the results. In the objects details panel, you will see the DUPLICATE field with the number of duplicates affected:
5.

Click Resolve. Security Cloud Control displays the duplicate objects for you to compare.
6.

Select two of the objects to compare.
7.

You now have these options:

  • If you want to replace one of the objects with the other, click Pick for the object you to keep, click Resolve to see what devices and network policies will be affected, and then click Confirm if you are satisfied with the changes. Security Cloud Control keeps the object you selected as the replacement and deletes the duplicate.

  • If you have an object in the list that you want to ignore, click Ignore. If you ignore an object, it will be removed from the list of duplicate objects that Security Cloud Control shows you.

  • Click Ignore All if you want to keep the object but do not want Security Cloud Control to find it in a search for duplicate objects.

8.

Once the duplicate object issue has been resolved review and deploy the changes you made now, or wait and deploy multiple changes at once.

Resolve Unused Object Issues

Unused objects are objects that exist in a device configuration but are not referenced by another object, an access-list, or a NAT rule.

Resolve an Unused Object Issue

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Objects and choose an option.

3.

Then filter the objects to find unused object issues.

4.

Select one or more unused objects.
5.

You now have these options:

  • In the Actions pane, click Remove to remove the unused object from Security Cloud Control.

  • In the Issues pane, click Ignore. If you ignore an object, Security Cloud Control will stop displaying it among the results of unused objects objects.

6.

If you removed the unused object, Preview and deploy configuration changes for all devices the changes you made now, or wait and deploy multiple changes at once.

Note

To resolve unused object issues in bulk, see Resolve Object Issues in Bulk.

Remove Unused Objects in Bulk

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Objects and choose an option.

3.

Then filter the objects to find unused object issues.

4.

Select the unused objects you want to delete:

  • Click the checkbox in the object table header row to select all the objects on the page.

  • Select individual unused objects in the object table.

5.

In the Actions pane on the right, click Remove to remove all the unused objects you selected in Security Cloud Control. You can remove 99 objects at a time.
6.

Click OK to confirm you want to delete the unused objects.

7.

You have two choices to deploy these changes:

  • Review and deploy the changes you made now, or wait and deploy multiple changes at once.

  • Open the Security Devices page and find the devices that were affected by the change. Select all the devices affected by the change and, in the Management pane, click Deploy All . Read the warning and take the appropriate action.

Resolve Inconsistent Object Issues

Inconsistent objects are objects with the same name, but different values, on two or more devices. Sometimes users create objects in different configurations with the same name and content, but over time the values of these objects diverge, which creates the inconsistency.

Note: To resolve inconsistent object issues in bulk, see Resolve Object Issues in Bulk.

You can perform the following on inconsistent objects:

  • Ignore: Security Cloud Control ignores the inconsistency between objects and retains their values. The objects will no longer be listed under the inconsistency category.

  • Merge: Security Cloud Control combines all selected objects and their values into a single object group.

  • Rename: Security Cloud Control allows you to rename one of the inconsistent objects and give it a new name.

  • Convert Shared Network Objects to Overrides: Security Cloud Control allows you to combine inconsistent shared objects (with or without overrides) into a single shared object with overrides. The most common default value from the inconsistent objects is set as a default in the newly formed object.

    Note

    If there are multiple common default values, one of them is selected as the default. The remaining default values and override values are set as overrides of that object.

  • Convert Shared Network Group to Additional Values: - Security Cloud Control allows you to combine inconsistent shared network groups into a single shared network group with additional values. The criteria for this functionality is that the inconsistent network groups to be converted must have a minimum of one common object with the same value. All default values that match this criterion becomes the default values, and the remaining objects are assigned as additional values of the newly formed network group.

    For example, consider two inconsistent shared network groups. The first network group 'shared_network_group' is formed with 'object_1' (192.0.2.x) and 'object_2' (192.0.2.y). It also contains additional value 'object_3' (192.0.2.a). The second network group 'shared_network_group' is formed with 'object_1' (192.0.2.x) and additional value 'object_4' (192.0.2.b). On converting the shared network group to additional values, the newly formed group 'shared_network_group' contain 'object_1' (192.0.2.x) and 'object_2' (192.0.2.y)' as default values and 'object_3' (192.0.2.a) and 'object_4' (192.0.2.b) as additional values.

    Note

    When you create a new network object, Security Cloud Control auto assigns its value as an override to an existing shared network object with the same name. This is also applicable when a new device is onboarded to Security Cloud Control.

The auto-assignment happens only when the following criteria are met:

  1. The new network object must be assigned to a device.

  2. Only one shared object with the same name and type must be existing in the tenant.

  3. The shared object must already contain overrides.

To resolve inconsistent object issues:

Procedure

1.

In the Security Cloud Control navigation bar on the left, click Objects and choose an option.

2.

Then filter the objects to find inconsistent object issues.

3.

Select an inconsistent object. In the objects details panel, you will see the INCONSISTENT field with the number of objects affected:
4.

Click Resolve. Security Cloud Control displays inconsistent objects for you to compare.

5.

You now have these options:

  • Ignore All:

    1. Compare the objects presented to you and on one of the objects, click Ignore. Or, to ignore all objects, click Ignore All.

    2. Click OK to confirm.

  • Resolve by merging objects:

    1. Click Resolve by Merging X Objects.

    2. Click Confirm.

  • Rename:

    1. Click Rename.

    2. Save your changes to affected network policies and devices and click Confirm.

  • Convert to Overrides (for inconsistent shared objects): When comparing shared objects with overrides, the comparison panel shows only the default values in the Inconsistent Values field.

    1. Click Convert to Overrides. All inconsistent objects will be converted to a single shared object with overrides.

    2. Click Confirm. You can click Edit Shared Object to view the details of the newly formed object. You can use up and down arrows to move the values between default and override.

  • Convert to Additional Values (for inconsistent network groups):

    1. Click Convert to Additional Values. All inconsistent objects will be converted to a single shared object with additional values.

    2. Save your changes to affected network policies and devices and click Confirm.
6.

After resolving the inconsistencies, review and deploy now the changes you made, or wait and deploy multiple changes at once.

Resolve Object Issues in Bulk

One way to resolve objects with unused, duplicate, or Resolve Inconsistent Object Issues issues is to ignore them. You can select and ignore multiple objects, even if objects exhibit more than one issue. For example, if an object is both inconsistent and unused, you can only ignore one issue type at a time.

If the object becomes associated with another issue type at a later time, the ignore action you committed only affects the issues you selected at that time. For example, if you ignored an object because it was a duplicate and the object is later marked inconsistent, ignoring it as a duplicate object does not mean it will be ignored as an inconsistent object.

To ignore issues in bulk, follow this procedure:

Procedure

1.

From the Security Cloud Control Home page, click Firewall.
2.

In the left pane, click Objects and choose an option.

3.

To narrow your search, you can filter object issues.

4.

In the Object table, select all the applicable objects you want to ignore. The Issues pane groups objects by issue type.

5.

Click Ignore to ignore issues by type. You must Ignore each issue type separately.
6.

Click OK to confirm you want to ignore those objects.