Troubleshoot the SASE Client

Installation Failure

The following error message may display if client installation fails:

• Registration failed Error. Object reference not set to an instance of an object. 

To verify on Windows OS:

1. If the application is unavailable or does not display in the application list, try to reinstall the client as Administrator.
2. Check the system tray for the active Versa SASE client icon to ensure it is running, as shown in the screenshot below.
   
   
3. Go to services.msc and confirm that all Versa-related services are running. For example:
   
   

To verify on MacOS:

1. If the application is unavailable or does not display in the application list, try to reinstall the client as Administrator.
2. If the installation is successful and the application is running, the client icon displays on the MacOS menu bar, as shown in the screenshot below. 
   
   
3. Open the terminal and run the grep command for versa services and ensure that all Versa-related services are running. For example:

usern@abcMBP ~ % ps aux | grep Versa
root             520  0.0  0.0  411746048   13728   ??  Ss   Mon08PM   0:00.23 /Applications/Versa SASE Client.app/Contents/XPCServices/SCAXPCServices.xpc/Contents/MacOS/SCAXPCServices
root             515  0.0  0.0  410794048    3040   ??  Ss   Mon08PM   0:00.02 /Applications/Versa SASE Client.app/Contents/XPCServices/DEMXPCService.xpc/Contents/MacOS/DEMXPCService
root             518  0.0  0.0  410768976    3136   ??  Ss   Mon08PM   0:00.03 /Applications/Versa SASE Client.app/Contents/XPCServices/EIPXPCServices.xpc/Contents/MacOS/EIPXPCServices
[masked]       10666  0.0  0.0  410740096   1408  s000  S+    3:06PM   0:00.00 grep Versa
[masked]       10644  0.2  0.0  412005104  60160   ??  S      3:05PM   0:00.66 /Applications/Versa SASE Client.app/Contents/MacOS/Versa SASE Client /bin
[masked]       10588  0.2  0.0  411834736  62384   ??  S      3:03PM   0:00.47 /Applications/Versa SASE Client.app/Contents/MacOS/VSATrayApp.app/Contents/MacOS/VSATrayApp /bin

Gateway CA Certificate

The following error messages may display if client registration fails:

• Registration failed. Error: Failed to register. Use alternate FQDN for registration. Error: The underlying connection was closed: Could not establish trust relationship for the SSL/TSL secure channel. 
• Registration failed; the underlying connection was closed the connection was closed unexpectedly.
• Failed to connect. Retry after some time, OR choose a different gateway and connect.

A gateway certificate authority (CA) certificate is required to establish secure VPN connections. Ensure that all essential CA certificates are installed in the device's certificate store. Missing or invalid certificates may hinder successful authentication between the SASE client and SASE gateway.

To verify CA certificates (on Windows OS):

1. In Windows, navigate to Run > certlm.msc > Trusted Root Certificate.
2. Verify the relevant CA server in Gateway Secure Access. If a publicly signed certificate is used for VPN authentication, it must also be included in the list.

Port Requirements for Portal and Gateway

The following error messages display in case of port and protocol issues related to SASE portal or gateway:

• Registration failed; the underlying connection was closed the connection was closed unexpectedly.
• Retry after some time OR use alternate FQDN for registration. Error: The underlying connection was closed: The connection was closed unexpectedly. 
• RAS809 network connection between your computer and VPN server could not be established because remote server is not responding.

The SASE client requires the following ports to be open for outbound connections to all portal and gateway FQDN or IP addresses:

If any of the error messages display, check that the required ports and protocols are allowed from the SASE client to the SASE gateway. 

DNS Resolution of Portal, Group, and Gateway FQDN

The DNS server on end-user devices resolves the SASE gateway portal and gateway FQDN IP addresses. In case of issues, the following error messages display:

• Failed to connect. Error: Failed to resolve global.versanow.net 
• Registration failed. Error: Failed to register. Please check your DNS Settings. Error: The remote name could not be resolved: ‘url'
• Retry after some time OR use alternate FQDN for registration. Error: The underlying connection was closed: The connection was closed unexpectedly. 

(For Windows OS) To verify if portal and gateway FQDNs resolve to valid IP addresses, run the ping FQDN CLI command in the command prompt. For example: 

C:\Users\user-1>ping chn-sse-gw1.versanow.net
Pinging chn-sse-gwl.versanow.net [10.163.107.22] with 32 bytes of data: 
Reply from 10.163.107.22: bytes=32 time=3ms TTL=63 
Reply from 10.163.107.22: bytes=32 time=2ms TTL=63 
Reply from 10.163.107.22: bytes=32 time=2ms TTL=63 
Reply from 10.163.107.22: bytes=32 time=2ms TTL=63
Ping statistics for 10.163.107.22:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:
Minimum = 2ms, Maximum = 3ms, Average = 2ms

To verify that the portal, group, and gateway FQDNs resolve all their required IP addresses correctly, in the command prompt, run nslookup portal.example.com (for Windows) or dig portal.example.com (Linux). The following is an example for Windows:

C:\Users\user-1>nslookup
Default Server: dns.versa-networks.com 
Address: 10.75.0.53
> sse-blr-lab-gw1.pslab.versanow.net
Server: dns.versa-networks.com
Address: 10.75.0.53

Non-authoritative answer:
Name: sse-blr-lab-gw1.pslab.versanow.net 
Addresses: 18x.1x.14x.17x
           18x.1x.14x.17x

Note that the portal and gateway FQDNs resolve to the private IP segment for internal networks by using gateway-assisted trusted network detection. For more information, see Configure Detection of Trusted Networks for SASE Gateways.

Test Portal API

To verify that the SASE gateway processes SASE client requests, check the portal API to confirm its accessibility and that you receive a “200 OK” status code. If the browser indicates that sites cannot be trusted, it means that the gateway CA certificate is missing. Refer to “Gateway and SSL Decryption CA Verification.”

For example:

https://portal-FQDN/secure-access/services/gateway?action=discover&ent_name=ENT-NAME

Bypass SSE FQDNs in Third-Party Clients and Security Devices

Third-party endpoint tools such as antivirus, endpoint detection and response (EDR), firewall agents, and web proxies can interfere with SASE gateway connections (HTTPS, IPsec, TLS, or DTLS). To prevent this, do the following: 

• Ensure that portal, gateway group, and gateway FQDNs and IP addresses are allowed in all the endpoints installed on the machine and transit security devices (firewalls and proxies).
• Test the SASE client on a clean device, without additional security agents, to ensure it works in a default environment. 

LDAP User Authentication Failure 

Error messages:

• Authentication failed! Please check UserName and Password, and then resubmit.
• Registration failed. Error: Failed to register. Retry after sometime OR use alternate FQDN for registration.\nError: Unable to reach to the remote server.

User authentication may fail due to the following conditions: 

• The password the user enters is incorrect or locked.
• The SASE gateway is unable to communicate with the LDAP servers. Check reachability of LDAP from the gateway, or check the Administrator user password entered in the LDAP profile configuration.

User with Locked or Expired Password Connects to Client

• If a user’s password expires or changes after connecting to the SASE gateway, the connection remains active. Versa SASE gateway's default authentication cache interval is 10 minutes. If a user disconnects and then reconnects after this interval, the user password is validated.
• In the Concerto UI, navigate to View > User > Live Users, and then force SASE user to disconnect. This clears the SASE gateway cache. The user is forced to validate the password after disconnection. 

SAML Authentication Failure

SAML authentication can fail due to misconfiguration by the identity provider (IdP) or service provider. Try the following checks for such failures:

Validate the Certificate

• Ensure that the certificate provided by the IdP is correctly configured and trusted by the service provider.

Verify Entity ID Configuration

• Confirm that the entity ID configured on both the IdP and service provider sides is an exact match. A mismatch in entity ID can cause assertion rejection or redirection failure. In such cases, authentication goes through, but token validation fails and registration cannot be completed. 
• Verify that the correct IdP certificate is uploaded in Concerto. You must download certificates from the IdP after all configurations.

Verify CA Installation for Decryption

1. In Windows, go to: Run > certlm.msc > Trusted Root Certificates.
2. Check if Versa Networks Root Certificate Authority is present. If the customer provided a CA certificate for SSL decryption, ensure that it is included in the list. For example:
   
   
3. If any certificate is missing, install it in the Certificates folder under Trusted Root Certificate Authority store.

Verify SSL Decryption for Browser-Based Traffic

1. Open any web browser and go to any accessible HTTPS site that utilizes SASE gateways with SSL decryption enabled. Then, to HTTPS > click the lock icon in the address bar > select "Connection secure" and click "More information". 
   "Verified by:" must display the Internal CA server name or the SSE organization name. For example:
   
   
2. If you want to validate further, open the certificate and check for the issuer, which is an internal certificate. For example:
   
   
   
   If the certificates are validated by a public C) such DigiCert or GoDaddy, SSL decryption does not function. For example:
   
   
3. Check if DNS resolution is resolving to IPv6, as this bypasses the tunnel.
4. Verify decryption policies on the SASE gateway.

Unable to Access Private Applications

If you are unable to access private applications when the SASE client is connected:

• Check to make sure the DNS servers learned through the SASE gateway are valid and configured with the domain name. To verify, run the ipconfig /all CLI command from the command prompt. For example:

  C:\Users\ExampleUser>ipconfig /all
  
  Windows IP Configuration
  
     Host Name . . . . . . . . . . . . : ExampleHost
     Primary Dns Suffix  . . . . . . . : example.local
     Node Type . . . . . . . . . . . . : Hybrid
     IP Routing Enabled. . . . . . . . : No
     WINS Proxy Enabled. . . . . . . . : No
     DNS Suffix Search List. . . . . . : abc-networks.com
  
  Unknown adapter Versa-Networks-VPN-DC:
  
     Connection-specific DNS Suffix  . : abc-Networks-Bangalore-DC
     Description . . . . . . . . . . . : abc-Networks-Bangalore-DC Adapter
     Physical Address. . . . . . . . . : AB-CD-EF-12-34-56
     DHCP Enabled. . . . . . . . . . . : No
     Autoconfiguration Enabled . . . . : Yes
     Link-local IPv6 Address . . . . . : fe80::1234:abcd:5678:9abc%7(Preferred)
     IPv4 Address. . . . . . . . . . . : 192.168.100.2(Preferred)
     Subnet Mask . . . . . . . . . . . : 255.255.255.0
     Default Gateway . . . . . . . . . : 192.168.100.1
     DNS Servers . . . . . . . . . . . : 8.8.8.8
     NetBIOS over Tcpip. . . . . . . . : Enabled

• From the PowerShell prompt, run the Get-DnsClientNrptRule CLI command to check if the specific domain name is matched to the private DNS server. For example:

  Name                : {8B0059AE-XXXX-XXXX-XXXX-XXXXXXXXXXXX}
  Version             : 3
  Namespace           : {pslab.example.net, testlab.abc.net, india.example.net, sse-chn.example.org, ...}
  IPsecCARestriction  : 
  DirectAccessDnsServers      : 
  DirectAccessEnabled         : False
  DirectAccessProxyType       : 
  DirectAccessProxyName       : 
  DirectAccessQueryIPsecEncryption : 
  DirectAccessQueryIPsecRequired   : 
  NameServers         : 192.0.2.5
  DnsSecEnabled       : False

• To verify if routes are added on endpoints for the private network and DNS server, run the route print CLI command from the command prompt. Check that the valid routes for DNS and private applications are directed to the IPsec interface.
• To verify if you can resolve private domains, ping them and telnet on required ports. For example, run the following CLI commands from command prompt:
  • ping private URL/application FQDN
  • telnet private URL/application <port number>

Internet Applications via SASE Gateway are Inaccessible

If applications are not functioning as expected after establishing a connection with the SASE client, follow these steps to isolate the Issue:

• Verify that the SASE client is configured with a default route for Internet access directed towards the SASE gateway virtual adapter.  To do this, run the route print CLI command in the command prompt, and then if check the default route points to the IPsec interface IP address. For example:

  C:\Users\admin>route print
  ===========================================================================
  Interface List
   29...XX XX XX XX XX XX ......Example-VPN-Interface
   10...YY YY YY YY YY YY ......Intel(R) PRO/1000 MT Network Connection
    1...........................Software Loopback Interface 1
  ===========================================================================
  IPv4 Route Table
  ===========================================================================
  Active Routes:
  Network Destination        Netmask          Gateway        Interface     Metric
            0.0.0.0          0.0.0.0          10.10.0.1      10.10.0.100      281
            0.0.0.0          0.0.0.0          On-link        192.168.1.3        2
            4.2.2.2  255.255.255.255          10.10.0.1      10.10.0.100      525
            8.8.4.4  255.255.255.255          On-link        192.168.1.3        2

• Ensure that the DNS learned from the SASE gateway does not have a domain mapped to it (even if its VISA+VSPA). The namespace must be empty.
• Ping the application FQDN and confirm that it resolves to a valid IPv4 address and not to an IPv6 address. If it resolves to an IPv6 address:
  1. Disable the IPv6 address.
  2. Enable DNS filtering on SASE Gateways to block “AAAA" records.
  3. Deactivate the IPv6 adapter on the client and prohibit IPv6 DNS requests in the SASE gateway.

     C:\Users\ExampleUser>ping google.com
     
     Pinging google.com [142.250.189.206] with 32 bytes of data:
     Reply from 142.250.189.206: bytes=32 time=207ms TTL=109
     Reply from 142.250.189.206: bytes=32 time=208ms TTL=109
     Reply from 142.250.189.206: bytes=32 time=207ms TTL=109
     Reply from 142.250.189.206: bytes=32 time=209ms TTL=109
     
     Ping statistics for 142.250.189.206:
         Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
     Approximate round trip times in milli-seconds:
         Minimum = 207ms, Maximum = 209ms, Average = 207ms

     IPv6 Ping Output:
     PING ipv6.google.com(muc12s12-in-x0e.1e100.net (2a00:1450:4016:809::200e)) 32 data bytes
     40 bytes from muc12s12-in-x0e.1e100.net (2a00:1450:4016:809::200e): icmp_seq=1 ttl=118 time=7.39 ms
     40 bytes from muc12s12-in-x0e.1e100.net (2a00:1450:4016:809::200e): icmp_seq=2 ttl=118 time=7.09 ms
     40 bytes from muc12s12-in-x0e.1e100.net (2a00:1450:4016:809::200e): icmp_seq=3 ttl=118 time=7.26 ms
     40 bytes from muc12s12-in-x0e.1e100.net (2a00:1450:4016:809::200e): icmp_seq=4 ttl=118 time=7.09 ms
     

• Verify that the resolved IP address in the ping test does not appear in the route print output and is directed to the local network Interface. If yes, it means that an application bypass is configured for the application in the secure access rule on SASE gateways. Verify this configuration. 
  
  In this case, the default route points to the SASE gateway and all internet traffic is routed through a VPN tunnel interface. All applications take the default route unless an application is configured with application bypass. For example:
  
  IP configuration:

  PPP adapter Example-VPN-Interface:
     Connection-specific DNS Suffix  . :
     Description . . . . . . . . . . . : Example-VPN-Interface
     Physical Address. . . . . . . . . : XX-XX-XX-XX-XX-XX
     DHCP Enabled. . . . . . . . . . . : No
     Autoconfiguration Enabled . . . . : Yes
     IPv4 Address. . . . . . . . . . . : 10.10.10.136(Preferred)
     Subnet Mask . . . . . . . . . . . : 255.255.255.255
     Default Gateway . . . . . . . . . : 0.0.0.0
     DNS Servers . . . . . . . . . . . :
     NetBIOS over Tcpip. . . . . . . . : Enabled
  
  Ethernet adapter Ethernet Instance 0:
     Connection-specific DNS Suffix  . :
     Description . . . . . . . . . . . : Intel(R) Ethernet Connection
     Physical Address. . . . . . . . . : XX-XX-XX-XX-XX-XX
     DHCP Enabled. . . . . . . . . . . : No
     Autoconfiguration Enabled . . . . : Yes
     Link-local IPv6 Address . . . . . : fe80::abcd:bcf9:6035:5734%3(Preferred)
     IPv4 Address. . . . . . . . . . . : 10.195.62.139(Preferred)
     Subnet Mask . . . . . . . . . . . : 255.255.0.0
     Default Gateway . . . . . . . . . : 10.195.0.1
     DNS Servers . . . . . . . . . . . : 8.8.8.8
     NetBIOS over Tcpip. . . . . . . . : Enabled

  
  ping output:

  C:\Users\admin>ping outlook.com
  
  Pinging outlook.com [52.96.91.34] with 32 bytes of data:
  Reply from 52.96.91.34: bytes=32 time=240ms TTL=228
  Reply from 52.96.91.34: bytes=32 time=240ms TTL=228
  Reply from 52.96.91.34: bytes=32 time=240ms TTL=228
  Reply from 52.96.91.34: bytes=32 time=239ms TTL=228
  
  Ping statistics for 52.96.91.34:
      Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
  Approximate round trip times in milli-seconds:
      Minimum = 239ms, Maximum = 240ms, Average = 239ms

  
  route print output:

  C:\Users\admin>route print
  ===========================================================================
  Interface List
   29...XX XX XX XX XX XX ......Example-VPN-Interface
   10...XX XX XX XX XX XX ......Intel(R) Ethernet Connection
   11...XX XX XX XX XX XX ......Intel(R) Ethernet Connection #3
    1...........................Software Loopback Interface 1
  ===========================================================================
  
  IPv4 Route Table
  ===========================================================================
  Active Routes:
  Network Destination        Netmask          Gateway       Interface  Metric
            0.0.0.0          0.0.0.0          10.195.0.1    10.195.62.139   281
          10.10.10.136  255.255.255.255       On-link       10.10.10.136   425
          10.195.0.0      255.255.0.0         On-link       10.195.62.139   281
          10.195.62.139  255.255.255.255      On-link       10.195.62.139   425
          10.195.255.255 255.255.255.255      On-link       10.195.62.139   425
          127.0.0.0      255.0.0.0            On-link       127.0.0.1       331
          127.0.0.1      255.255.255.255      On-link       127.0.0.1       331
          127.255.255.255 255.255.255.255     On-link       127.0.0.1       331
        169.254.0.0      255.255.0.0          On-link       169.254.84.224  281
    169.254.84.224        255.255.255.255     On-link       169.254.84.224  281
    169.254.255.255      255.255.255.255      On-link       169.254.84.224  281
          224.0.0.0      240.0.0.0            On-link       10.195.62.139   281
          224.0.0.0      240.0.0.0            On-link       169.254.84.224  281
          255.255.255.255 255.255.255.255     On-link       10.195.62.139   281
          255.255.255.255 255.255.255.255     On-link       169.254.84.224  281

  
  nslookup output:

  C:\Users\admin>nslookup
  Default Server:  dns.google
  Address:  8.8.8.8
  
  > outlook.com
  Server:  dns.google
  Address:  8.8.8.8
  
  DNS request timed out.
      timeout was 2 seconds.
  DNS request timed out.
      timeout was 2 seconds.
  Non-authoritative answer:
  Name:    outlook.com
  Addresses: 52.96.229.242
             52.96.228.130
             52.96.222.226
             52.96.111.82
             52.96.222.240
             52.96.3.2
             52.96.91.34
             52.96.214.50
             52.96.172.98
             52.96.222.194

• Verify third-party proxy applications or proxies configured in the endpoint device browser. If any are enabled, disable them and test again. To verify:
  • Navigate to Settings > Network & internet > Proxy. For example:
    
    
  • Otherwise, from the PowerShell command, run the Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" CLI command. For example:

    PS C:\Users\admin> Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
    
    CertificateRevocation    : 1
    DisableCachingOfSSLPages : 0
    IE5_UA_Backup_Flag       : 5
    PrivacyAdvanced          : 1
    SecureProtocols          : 1200
    User Agent               : Mozilla/4.0 (compatible; MSIE 8.0; Win32)
    ZonesSecurityUpgrade     : {182, 113, 75, 18...}
    WarnonZoneCrossing       : 0
    EnableNegotiate          : 1
    ProxyEnable              : 1
    MigrateProxy             : 1
    LockDatabase             : 133868971572318107
    ProxyServer              : 1.1.1.1:8080
    PSPath                   : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings
    PSParentPath             : Microsoft.PowerShell.Core\Registry::HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
    PSChildName              : Internet Settings
    PSDrive                  : HKCU
    PSProvider               : Microsoft.PowerShell.Core\Registr

Local Breakout Application Does Not Work

In scenarios where where specific applications or FQDNs must break out locally before they are forwarded to the SASE gateway, verify the following:

• Ensure that the SASE gateway secure access rule configuration includes the required FQDN in the application bypass list, and that changes are published after the SASE client is re-registered.
• Run the ping CLI command to validate FQDN resolution and check if an entry populates in the route print output for the resolved IP address, which points to the device's local interface and not the SASE gateway.
  
  In the following example, the Dropbox application is routed through local internet or adapter:
  
  VPN adapter (PPP)

  PPP adapter sulaisse-SSE-GW2-001:
  
     Connection-specific DNS Suffix  . :
     Description . . . . . . . . . . . : sulaisse-SSE-GW2-001
     Physical Address. . . . . . . . . :
     DHCP Enabled. . . . . . . . . . . : Yes
     Autoconfiguration Enabled . . . . : Yes
     IPv4 Address. . . . . . . . . . . : 10.10.13.106 (Preferred)
     Subnet Mask . . . . . . . . . . . : 255.255.255.255
     Default Gateway . . . . . . . . . :
     DNS Servers . . . . . . . . . . . : 8.8.8.8
     NetBIOS over Tcpip. . . . . . . . : Enabled

  
  Local adapter (Ethernet)

  Ethernet adapter Ethernet Instance 0:
  
     Connection-specific DNS Suffix  . :
     Description . . . . . . . . . . . : Intel(R) Ethernet Adapter
     Physical Address. . . . . . . . . : 52-54-00-5E-F2-02
     DHCP Enabled. . . . . . . . . . . : Yes
     Autoconfiguration Enabled . . . . : Yes
     IPv4 Address. . . . . . . . . . . : 10.195.62.139 (Preferred)
     Subnet Mask . . . . . . . . . . . : 255.255.0.0
     Default Gateway . . . . . . . . . : 10.195.0.1
     DHCPv6 IAID . . . . . . . . . . . : ########
     DHCPv6 Client DUID. . . . . . . . : ###########
     DNS Servers . . . . . . . . . . . : 8.8.8.8

  
  ping output (Dropbox):

  C:\Users\admin>ping dropbox.com
  
  Pinging dropbox.com [162.125.248.18] with 32 bytes of data:
  Reply from 162.125.248.18: bytes=32 time=134ms TTL=55
  Reply from 162.125.248.18: bytes=32 time=134ms TTL=55
  Reply from 162.125.248.18: bytes=32 time=134ms TTL=55
  Reply from 162.125.248.18: bytes=32 time=134ms TTL=55
  
  Ping statistics for 162.125.248.18:
      Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
  Approximate round trip times in milli-seconds:
      Minimum = 134ms, Maximum = 134ms, Average = 134ms
  

  
  nslookup output (Dropbox):

  C:\Users\admin>nslookup
  
  DNS request timed out.
      timeout was 2 seconds.
  Default Server:  Unknown
  Address:  8.8.8.8
  
  > dropbox.com
  Server:  Unknown
  Address:  8.8.8.8
  
  DNS request timed out.
  DNS request timed out.
  Non-authoritative answer:
  Name:    dropbox.com
  Addresses:  2620:100:6018:18::a27d:f812
             162.125.248.18
  

  
  route print output (the highlighted text shows Dropbox route pointing to VPN adapter):

  C:\Users\admin>route print
  
  Interface List
   23...00 00 00 00 00 00 ...... sulaisse-SSE-GW2-001
   12...52 54 00 5e f2 02 ...... Intel(R) Ethernet Adapter
    3...52 54 00 ca 24 1a ...... Intel(R) Ethernet Adapter #3
    1........................... Software Loopback Interface 1
  
  IPv4 Route Table
  ===========================================================================
  Active Routes:
  Network Destination        Netmask          Gateway       Interface  Metric
            0.0.0.0          0.0.0.0       10.195.0.1   10.195.62.139    281
         10.10.13.106  255.255.255.255       On-link     10.10.13.106      2
         10.195.0.0      255.255.0.0       On-link      10.195.62.139    281
         10.195.62.139   255.255.255.255   On-link      10.195.62.139    281
       127.0.0.0        255.0.0.0         On-link          127.0.0.1    331
      162.125.248.18    255.255.255.255   10.195.0.1   10.195.62.139    425
       ...
  

Perform Diagnostics

To automatically fix basic issues on the Versa Client, perform the diagnostics procedure:

1. In the SASE client home screen, click the  Settings icon.
2. Click App Settings and then click click Diagnostics.
   
   
   
   When the diagnostics complete, a message displays.
   
   

Collect Complete Debug Logs

To collect a complete set of debug logs to help the Versa Managed Services NOG team debug issues on the Versa client and the operating system:

1. In the SASE client home screen, click the  Settings icon.
2. Click App Settings.
   
   
3. Click Log Settings.
   
   
4. In the Log Settings screen, click Log Level, and select a log severity level:
   • Debug—Log application debug-level information.
   • Error—Log error-level information.
   • Info—Log informational-level information. This is the default.
   • Verbose—Log additional information during the interaction with the client user interface.
   • Warm—Log warming-level information.

To save the log files:

1. In the App Settings screen, click Export Logs.
   
   
2. Select a folder and save the log file on your computer. The saved log file is in .zip format.
3. Share the .zip file with the Versa Managed Services NOC team.

C:\Users\user1>nslookup sj-sandbox.versa-test.net
Server: dns-aa.versa-networks.com
Address: 10.10.11.111
Non-authoritative answer:
Name: sj-sandbox.versa-test.net Address: 200.40.10.10