Cisco
Login
Search

Cisco Secure Access Help Provision Users, Groups, and Endpoint Devices from Active Directory Manage AD Connectors AD Connector Communication Flow and Troubleshooting Troubleshooting Network Requirements

Last updated: Aug 22, 2025

Network Requirements

The Cisco AD Connector communicates with Secure Access and the deployed domain controllers. Ensure that you allow certain domains and services on your firewalls. For more information, see Network Requirements for Secure Access.

Port and Protocol Source Destination Note
443/TCP AD Connector

api.sse.cisco.com

disthost.umbrella.com

  • Initial registration with the Secure Access
  • Automatic updates
  • Health status reporting in Secure Access
80/TCP AD Connector

x1.c.lencr.org

r10.c.lencr.org

r11.c.lencr.org/33.crl

Check for certificate revocations through the certificate revocation list (CRL). Certificate Distribution Points (CDPs) are dynamic and may change based on the certificate signing criteria.


 

The URLs for these partitioned CRLs generally follow the pattern:

https://[intermediate_id].c.lencr.org/[crl_number].crl

  • [intermediate_id] refers to the specific intermediate certificate (e.g., r11, e1).

  • [crl_number] is the partition number for that intermediate (e.g.,1,2, ...,128`).

To retrieve the latest CRL CDP, run the following command: 

echo | openssl s_client -servername api.sse.cisco.com -connect api.sse.cisco.com:443 2>/dev/null | openssl x509 -noout -text | grep -oE 'URI:http[^[:space:]]+' | grep 'lencr.org' | sed 's/^URI://'
389/TCP 636/TCP AD Connector Domain controller or domain Sync with LDAP/LDAPS

 
The Digicert domains resolve to various IP addresses based on a CDN and are subject to change.

If you experience any issues communicating with Secure Access, we recommend that you check for any Layer-7 application proxies, which may block or drop data sent to Secure Access. A common case is the inspect feature on Cisco devices that communicate on DNS, HTTP, or HTTPS. For more information, see Cisco Security Appliance Command Line Configuration Guide, Version 7.2.

Previous topic Troubleshooting Next topic Restart the Active Directory Connector