We are rolling out an important enhancement to improve connection reliability for the Cisco Secure Access roaming client. Please review the details below.
What is changing? We are enhancing our data center selection logic to ensure SWG roaming clients always connect to the most optimal data center. This resolves an issue where users with an inactive DNS module could experience sub-optimal DC selection, which was most impactful for reserved IP customers.
What is the benefit? More reliable and higher-performance connections for your roaming users.
Is action required? For most customers, no action is required. The update is applied automatically.
However, you may need to take action if you have manually configured our FQDNs in your environment.
Who needs to take action? You will need to update your configuration if:
- You have firewall or ACL rules that explicitly allowlist FQDNs. You must add the new FQDN pattern to prevent blocked connections. (Note: The FQDN was not widely published, so most customers using allowlists rely on our ingress IPs.)
- You use a PAC file or proxy chain with the old FQDN hardcoded. You should update the FQDN to take advantage of the reliability improvements.
What are the new technical details? The update uses a new FQDN pattern that is specific to your organization.
- Old FQDN:
swg-url-proxy-https-sse.sigproxy.qq.opendns.com
- New FQDN Pattern:
swg-url-proxy-https-#####.sseproxy.qq.opendns.com
- (The
##### is your unique Secure Access organization ID.)
When is this happening? The rollout will be gradual over several weeks, starting on September 8th
If you have any questions, please contact Cisco Support.
Thank you,
The Cisco Secure Access Team
Note: The old FQDN will continue to work even after your organization is updated to support the new FQDN.
