• Overview
• Symptoms
• Potential Root Cause
• Resolution Steps
  • Step 1: Find the process that uses port 53
  • Step 2: Free port 53, or turn on NRPT rules
  • Step 3: Reconnect the Service Tunnel

Overview

The Service Tunnel does not connect because another application or service on the device already uses port 53, the standard DNS port. The CSE desktop app uses this port to resolve DNS for the Service Tunnel and for Internet Threat Protection (ITP).

Symptoms

• When an end user connects to a Service Tunnel, the desktop app shows the error Could not connect to the tunnel config. Please ensure port 53 is not in use.
• On a device that has an ITP policy, ITP does not start, but the ITP health check still reports that it is working.

Potential Root Cause

Another application or service on the device listens on port 53. Examples include local DNS proxies, DNS filtering clients such as the Cisco Umbrella Roaming Client, and name responders that also answer DNS queries on port 53.

Resolution Steps

Step 1: Find the process that uses port 53

Disconnect the Service Tunnel, and then run the commands for the device’s operating system.

Windows (PowerShell, run as administrator):

Get-NetUDPEndpoint -LocalPort 53 | Select-Object LocalAddress, OwningProcess
Get-NetTCPConnection -LocalPort 53 -State Listen | Select-Object LocalAddress, OwningProcess
Get-Process -Id <OwningProcess>

macOS and Linux:

sudo lsof -nP -i :53

Note: On Linux, systemd-resolved listens on 127.0.0.53 by default. This listener is expected and does not cause the error.

Step 2: Free port 53, or turn on NRPT rules

Choose the option that fits the device:

• Free port 53. Stop the application or service that you found in Step 1, or change its configuration so that it no longer listens on port 53. This option works on every operating system, and devices that have an ITP policy require it.
• Turn on NRPT rules (Windows, Service Tunnel only). If the device runs Windows, uses the Service Tunnel, and does not have an ITP policy, you can turn on Name Resolution Policy Table (NRPT) rules. The Service Tunnel then connects while the other service keeps port 53. NRPT rules are an org-wide setting that applies to every Windows device in the org.

To turn on NRPT rules:

2.1 In the Command Center, navigate from Settings > Configurations > Service Tunnels.

2.2 Under Use NRPT rules for Windows DNS resolution, select Enable.

Note: NRPT rules can take up to 1 hour to take effect. See Enabling NRPT Rules.

Step 3: Reconnect the Service Tunnel

In the desktop app, connect to the Service Tunnel again. The Service Tunnel shows as Connected.