This topic lists the network diagnostics-related error codes for the Secure Access Service Edge (SASE) client, including the error type, description, and resolution for each code.
Error codes
| Error code | Description | Error type | Resolution |
|---|---|---|---|
| -1 | An unknown error occurs. | Unknown error | Check whether the SASE client is properly installed. If the issue persists, contact the administrator. |
| 20000 | Failed to obtain the authentication service URL. | Internal error | Reinstall the SASE client. |
| 20001 | Failed to obtain the logon URL. | ||
| 20002 | Failed to obtain the updater URL. | ||
| 20003 | Authentication failed. | Network or DNS exception | Check your network connection or switch to a different network. If the issue persists, check the DNS settings on your device. For DNS server recommendations, see DNS server recommendations. |
| 20004 | Logon failed. | ||
| 20005 | Upgrade failed. | ||
| 20006 | The upgrade configuration file does not exist. | ||
| 20007 | Failed to connect to the time server. | ||
| 20008 | The connection to the service access point timed out. | ||
| 20009 | No connections are established at the service access point. | Log on to the SASE console and enable internal network access. | |
| 20010 | Client startup items are abnormal. | Client error | Reinstall the SASE client. Alternatively, check the optimization and network acceleration features of other security software installed on your device and clear the startup optimization option for the SASE client. |
| 20011 | SASE is not running. | ||
| 20012 | macOS system extensions are not installed. | Grant permissions again and install the SASE system extension for macOS. | |
| 20013 | Proxies conflict. | Software conflict | The proxy software installed on your device may conflict with the SASE client. Stop the proxy software and restart the SASE client. |
| 20014 | OS proxies conflict. | The default system proxy may conflict with the SASE client. Disable the system proxy through your browser settings or system settings, then restart the SASE client. | |
| 20015 | The system time is abnormal. | System error | Turn on Set the time automatically in Windows. This enables NTP-based time calibration. |
| 20016 | The logon page does not exist. | Server error | Contact the administrator to check whether the identity source is enabled in the SASE console. |
| 20017 | The certificate for Internet access is not installed. | Certificate error | Log on to the SASE client again. The SASE service automatically issues and installs the certificate. |
| 20018 | The root certificate for 802.1X is not installed. | ||
| 20019 | The user certificate for 802.1X is not installed. | ||
| 20020 | The root certificate for 802.1X has expired or is about to expire. | ||
| 20021 | The user certificate for 802.1X has expired or is about to expire. | ||
| 20022 | The root certificate for 802.1X is not trusted. | Open Keychain Access on macOS and select Always Trust for the certificate. | |
| 20023 | The user certificate for 802.1X is not trusted. | ||
| 20024 | The driver for traffic redirection is not running. | Client error | Reinstall the SASE client. Alternatively, check the optimization and network acceleration features of other security software installed on your device and clear the startup optimization option for the SASE client. |
| 20025 | The Base Filtering Engine (BFE) service is not running. | Check whether the BFE service is running. If not, use one of the following methods: enable the BFE service (see Enable the Base Filtering Engine service), or reinstall your operating system. | |
| 20026 | The SASE service is not started. | Restart the SASE client and log on. | |
| 20027 | Private access is disabled. | Contact the administrator to enable internal network access. | |
| 20028 | Failed to connect to the stunnel client. | Client or network error | Check your network conditions and DNS settings. |
| 20029 | Software conflicts due to the same listening port. | Software conflict | The software installed on your device may conflict with the SASE client. Stop the conflicting software and restart the SASE client. |
| 20030 | Software conflicts due to processes or dll. | ||
| 20031 | Software conflicts due to drives. | A driver running on your device may conflict with the SASE client. Uninstall the conflicting driver and restart the SASE client. | |
| 20032 | The SHA-256 patch is missing. | Download and install the SHA-256 patch for your Windows version, then try again. For installation steps, see Install the SHA-256 patch. |
DNS server recommendations
For error codes 20003–20008, if switching networks does not resolve the issue, configure a reliable DNS server on your device:
-
If your device is in China, use
114.114.114.114. -
If your device is outside China, use
8.8.8.8.
Install the SHA-256 patch
Error code 20032 indicates the SHA-256 patch required by Windows 7 is missing.
Download the patch
Download the patch that matches your Windows version:
Start Windows Update before installing
Before installing the patch, start the Windows Update service:
-
Open Control Panel and click System and Security.
-
Click Administrative Tools.
-
In the Administrative Tools window, double-click Services.
-
Find Windows Update, right-click it, and select Properties.
-
In the Windows Update Properties window, set Startup type to Automatic.
Third-party error codes
The SASE client integrates with Lark, WeCom, and DingTalk. For errors originating from these platforms, refer to their documentation: