Troubleshooting

Check the scenarios below if you have difficulty validating the Secure Access module for Cisco Secure Client for Android OS after first installing it.

• App download fails in Google Play Store after enabling Cisco Secure client. This is a known limitation from Google on Android OS versions below v10. To avoid this, you must download Apps before enabling the Secure Access App. Google has fixed this behavior in their Android OS 10. Check the issue tracker.

• In Android 10 and later, Google restricts reading serial numbers from the device. As a result, the Serial number field in the Secure Access dashboard displays “unknown” for Android 10 and later devices.

• Avoid using the Wifi Assistant; it may conflict with Cisco Secure Client - AnyConnect and DNS interception.

• Private DNS must be turned off for DNS interception to function properly.

• Click for information about Unusual DNS queries showing in reports.

• Huawei phones, when running in Work Profile mode, do not automatically start Cisco Secure Client - AnyConnect, even when the app was previously open. This does not apply to Huawei phones in Fully Managed mode.

On the first launch, there should be a request for Cisco Secure Client VPN session as shown below. You must accept the connection request by clicking “OK” for the Secure Access protection to start.

Note

Mandatory Security Step: This cannot be bypassed; the behavior is built into Android OS for security reasons.

The Secure Access Module for Cisco Secure Client uses a VPN-like mechanism, but it is not in a traditional VPN. This VPN-like mechanism is used to intercept DNS queries so that the module can process them (add metadata, encrypt and forward to Secure Access). The Android operating system's user interface does not show this distinction, so it appears as if a VPN were running.

When Secure Access protection starts, a green checkmark appears under the Secure Access UI subheading with the text “You are protected by Secure Access.”

Note

Virtual Appliance in the Network

If an Secure Access Virtual Appliance (VA) supporting HTTPS is configured in the network, the Secure Access module detects this and backs off. If a VA is not present, or is present but does not support HTTPS, then the Secure Access module remains active.

The Secure Access module makes a best effort to automatically detect internal (intranet) sites and route DNS appropriately to the local DNS server. However, these mechanisms may not work in all scenarios. Therefore it's important to enter your internal / intranet domains in the Domain Management tools in the Secure Access dashboard. For more details, refer to Manage Domains.

If the Secure Access Section in the Cisco Secure Client - AnyConnect app does not display a green checkmark, check the configuration details pushed from the MDM. If you don't have access, contact your administrator.

You can check if the configuration is available by clicking on the menu button at the top right in Cisco Secure Client - AnyConnect > Diagnostics > Logging and System Information > System > Managed Configuration.

Verify that the managed configuration pushed by the administrator is available.

Navigate to Cisco Secure Client settings > Advanced, and enable the Mobile devices DNS Fail-open field to egress DNS traffic directly to the internet when Secure Access is unreachable.

In case of internal errors, such as the Secure Access Resolver is not reachable or the DNSCrypt Certificate is not available, the Secure Access UI displays an error.

If the https://policy.test.sse.cisco.com/ URL shows 0 for the org id and bundle (policy) id, then refresh the page. Alternatively, clear the browser cache, try an incognito window, or try a different browser.

In order to download apps from the Google Play Store, a Gmail ID should be configured in the MDM. If the ID is configured and the app still cannot be downloaded, the MDM admin may have chosen to disallow installation of apps from the Play Store.

In order to fully remove an end user there are two steps:

• Delete the user from the Mobile Devices page in the Secure Access Dashboard.

• Delete the Cisco Secure Access Module for Android OS from the user's device. This can be done by the MDM. The MDM app itself need not be removed from the user's device.