Connect. Secure. Manage.
Cisco Secure Access Troubleshooting
Investigate access or performance problems across Cisco Secure Access, separating identity, connector, routing and inspection dependencies.
Devices supported
across the UK
Client locations
supported
Traffic handled
at peak time
Average
response time
Average response is not a resolution time or a contractual guarantee. Support scope and response commitments are agreed for each engagement.
Cisco Secure Access troubleshooting follows a failed request from the user to the app. We check whether access was blocked by policy or failed because of identity, DNS, routing, a connector or client settings. Evidence guides the next step. The aim is a traceable cause and an agreed fix for the supported setup.
Defined trust
Make access boundaries explicit rather than relying on an assumed internal network.
Controlled access
Connect identity, policy and network enforcement to the services people actually use.
Evidence for change
Test the intended security outcome and retain useful operational records.
Describe the failed transaction precisely
We start with the app, affected users, device types, location and time of the problem. Whether the user sees an authentication error, a block page, a connection timeout or an incomplete app makes a difference. We compare a failing example with a working one wherever possible, rather than changing broad policies on the strength of a general report that the cloud service is down.
The investigation records recent changes to identity groups, endpoint profiles, app definitions and network paths. A fault affecting one browser at one office has a different likely boundary from a failure affecting all users of a private app. Clear scoping reduces unnecessary changes to services that are functioning correctly.
Standards & partnerships
Confidence in the team behind your network.
Cisco Partner
Cisco Meraki
Cyber Essentials
Cyber Essentials PlusMCI Network Services is operated by Proxar Ltd. Certifications apply to the certified legal entity and the scope of its certificates. View accreditation information
Establish the actual access path
Users and branches can reach protected services through different supported arrangements. We identify whether the request is using an endpoint client, a browser-based workflow, branch network access or another configured path. The expected path is compared with routing, DNS and client state. A device carrying an old profile may not be using the service the support team assumes it is using.
For private apps, we follow the connection through the relevant connector and into the app network. A connector showing online does not prove it can resolve or reach every destination. Firewall rules, app listeners and return routes remain part of the investigation, including dependencies that sit outside the Secure Access platform.
A useful starting point
Not sure where to start?
Bring the requirement. We will help you define the engineering work.
Check identity and policy evaluation
Authentication and authorisation are separate questions. A successful sign-in establishes neither that the correct group was supplied nor that the requested app is allowed. We inspect the available identity context, policy order and the result applied to the actual request, taking care with overlapping groups and exceptions.
Expired certificates, incomplete enrolment, identity-provider changes and unexpected device state can all alter access. We avoid granting broad access simply to make a test succeed. A temporary exception, when justified, should identify the affected identity and destination, have an owner and expiry, and be removed once the root cause is understood.
Different environments. The same care.
Built around the work
your network supports.
Finance, banking and the wider private sector. We start with the systems and people that depend on your connections.
Finance & banking
Market-data paths, routing and provider coordination on clients’ behalf.
Financial-market services ↗Offices & multi-site teams
Reliable access between people, workplaces and business applications.
Office network design ↗Data centres & cloud
Network boundaries, workload connections and operational ownership.
Data centre networks ↗Separate DNS and transport failures
Name resolution can fail before a security policy is meaningfully exercised. We check which resolver answers, whether internal and external names return the intended addresses, and whether the chosen destination is reachable through the configured path. Split DNS and overlapping private address spaces deserve particular attention in hybrid setups.
Transport tests consider the app's real ports and protocols, not only ICMP. We also examine packet size, path MTU, proxy behaviour and any intermediate devices when evidence points in that direction. A connection that works for a small page but fails during a download can require a different investigation from a consistently refused destination.
Investigate inspection and application compatibility
Security inspection can expose certificate, protocol and app assumptions that were previously hidden. We review the relevant events and compare them with the app's failure, including embedded services and redirects. An apparent problem with one website may originate from a blocked dependency hosted elsewhere.
Where encrypted traffic is inspected, the investigation checks trust distribution and any documented app limitations. Excluding inspection is not the automatic answer. We establish whether a narrower policy correction, certificate repair or supported app change addresses the issue, and record the security consequence of any exception the customer approves.
Test resilience and recovery behaviour
Intermittent faults may coincide with branch failover, connector changes or client movement between networks. We correlate timestamps and service events rather than assuming those transitions are harmless. The test plan includes restoration, because a preferred path returning to service can trigger another interruption or reveal stale state.
We agree a safe scope for diagnostic captures and log collection. Records can contain usernames, destinations and other personal or confidential information, so collection is limited to what the investigation needs. Sensitive evidence is transferred through an agreed channel, not posted into an unrestricted support discussion.
Close the incident with a usable explanation
The outcome should explain which dependency failed, the evidence supporting that conclusion and what was changed. Where another supplier owns the failing component, we prepare an escalation with reproducible observations rather than simply passing the customer between teams. Unproven suspicions are identified as such.
MCI can undertake a focused investigation or support a current support team. Our Cisco Secure Access service scope can also include design review where repeated incidents suggest a structural problem. Provide the affected workflow, approximate times and sanitised symptoms first. We can then agree the access, evidence and change authority needed to investigate without weakening controls across the estate.
Technical references
- Cisco Secure Access configuration documentation — Cisco / Cisco Meraki
- Cisco Secure Access technical support documentation — Cisco / Cisco Meraki
Talk to a specialist
What does your network need next?
Tell us what you are planning, changing or trying to improve. We will help define a practical next step and the engineering scope.
+44 203 196 6566Choose option 1
sales@proxar.co.ukUK-wide service.
Most of our engineers are based in Kent, with a focus on London, Sussex, Essex and Berkshire.
Existing customers should use their agreed support and escalation channels. This form is for service enquiries, not a monitored emergency ticket.
Tell us what you need.
A short outline is enough. Please do not include passwords or sensitive network details.
Thank you. Your enquiry has been submitted.
Please check your name, email and message, then try again.
Your form session expired. Please try again.
Please wait a minute before sending another enquiry.
We could not submit your enquiry. Please call or email us instead.