User is not able to browse the internet after WSSA is installed or upgraded
search cancel

User is not able to browse the internet after WSSA is installed or upgraded

book

Article ID: 220328

calendar_today

Updated On:

Products

Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Upgraded WSS agent from v6.1.1 to v7.2.x or later on the users' machine (host previously ran Unified Agent before that

The user is unable to browse the external internet, and on certain occasions, internal sites will work intermittently. The failure to browse occurs when either the WSS agent is Active or Passive.

Symdiag for WSS Agent and WSS Service shows the following errors:

  1. wssak service is not configured and operating properly.
  2. Service is stopped when it should be running.
  3. Service last exited with code 183

Disabling the agent failed to resolve the issue. The issue is worked around by:

  • The user uninstalled the agent and could browse again successfully.
  • Installing the agent's previous version allowed the user to work fine as well.

Environment

  • Web Security Service
  • Unified Agent
  • WSS Agent

Cause

An instance of the previously upgrade Agent driver existed in the Windows drivers directory and was getting loaded prior to the WSS agent driver, causing the WSS driver to fail to load.

The old driver was could've been left behind due to several reasons:

  • The user did not reboot the machine after upgrading from Unified Agent to WSS Agent.
  • Possible error during the MSI upgrade process.
  • bcua-wfp.sys driver accidentally included in the SOE image.
  • A bug in the Unified Agent uninstaller.

Note: Upgrading Unified Agent to WSS Agent 8.x is not supported.

Resolution

Unified Agent:

  1. Manually delete the bcua-wfp.sys file from c:\windows\system32\drivers directory.
  2. Re-install the WSS Agent.

If no, bcua-wfp.sys found:

WSS Agent:

  1. Manually delete the wssak.sys file from c:\windows\system32\drivers directory.
  2. Re-install the WSS Agent.

Note: If the driver cannot be disabled, the administrator may need to delete it using the following command:  sc delete bcua-wfp

 

Additional Information

SymDiag:

The symdiag shows the wssak.sys kernel driver as stopped with exit code 183.

The old Unified Agent kernel driver bcua-wfp.sys is running.

Command Prompt (Administrator) while running the command: sc start wssak

 

Powered by Wolken Software