If the connection to Symantec is successful, the output contains the following
line:
symantecConnectionState: SUCCEEDED
If the output doesn't contain the preceding line, or the
symantecConnectionState isn't SUCCEEDED, your connection to Symantec is
unsuccessful.
This issue can be caused by one of the following reasons.
The API key that you uploaded when you
created a realm
isn't valid.
To resolve this issue,
verify the format of the secret
that contains the API key. The secret must use the following format and must
not include any white spaces or tabs:
USERNAME:PASSWORD
If the secret doesn't match the preceding format,
edit the secret. If the secret matches
the preceding format, try generating and uploading a new API key.
The secret doesn't exist, the secret isn't associated with the realm, or the
service account lacks permissions.
The Symantec location might already be in use by an existing attachment.
To resolve this issue, make sure that you use a location that's not in use.
The Symantec site is temporarily unavailable.
To resolve this issue, check with Symantec about the availability of their
service.
Connection states to Symantec
The following table lists the connection states to Symantec and what they mean.
State
Description
SYMANTEC_CONNECTION_STATE_UNSPECIFIED
The default value when the state is omitted.
SUCCEEDED
Successfully connected to Symantec.
READ_SECRET_FAILED
Can't access the API key in the provided secret_path because the secret
doesn't exist or the service account doesn't have the required permissions
to read it.
REQUEST_TO_SYMANTEC_FAILED
Failed to get a successful response from Symantec API due to an invalid
API key or Symantec API unavailability.
If you encounter a Palo Alto Network Prisma Access attachment creation error,
check for the following issues.
You aren't setting Symantec-specific fields.
You aren't specifying an invalid resource name.
To resolve this issue, make sure that your resource name
conforms with RFC 1034, is
restricted to lowercase letters, numbers and hyphens, and has a maximum
length of 63 characters. Additionally, the first character must be a letter
and the last a letter or a number.
A corresponding partner realm already exists and the associated
realm is in the PARTNER_ATTACHED state.
If the realm isn't in the
PARTNER_ATTACHED state, you must complete the attachment process in the
Palo Alto Network Prisma Access console.
Realm states
The following table lists the realm attachment states and what they mean.
Realm state
Description
STATE_UNSPECIFIED
The default value used when the state is omitted.
PENDING_PARTNER_ATTACHMENT
This realm has never been attached to a partner realm. Used only for
Palo Alto Networks Prisma Access.
PARTNER_ATTACHED
This realm is attached to a partner.
PARTNER_DETACHED
This realm was attached to a partner before but has been detached.
KEY_EXPIRED
This realm is not attached to a partner realm, and its pairing key has
expired and needs key regeneration. Used only for Palo Alto Networks Prisma
Access.
Attachment states
The following table lists the Secure Access Connect attachment
states and what they mean.
Attachment state
Description
STATE_UNSPECIFIED
No state specified.
PENDING_PARTNER_ATTACHMENT
Has never been attached to a partner.
PARTNER_ATTACHED
Attached to a partner.
PARTNER_DETACHED
Was attached to a partner before but has been detached.
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-08-29 UTC."],[],[],null,["# Troubleshoot Secure Access Connect\n\n| **Preview**\n|\n|\n| This feature is subject to the \"Pre-GA Offerings Terms\" in the General Service Terms section\n| of the [Service Specific Terms](/terms/service-terms#1).\n|\n| Pre-GA features are available \"as is\" and might have limited support.\n|\n| For more information, see the\n| [launch stage descriptions](/products#product-launch-stages).\nThis page shows you how to resolve issues with Secure Access Connect.\n\n\u003cbr /\u003e\n\nAttachment creation errors\n--------------------------\n\nThis section lists errors that you might encounter when creating attachments and\nprovides suggestions for how to fix each of them.\n\n### Symantec connection is unsuccessful\n\nWhen you identify the Symantec site that you want to connect your attachment to\nusing the\n[`gcloud beta network-security secure-access-connect realms describe` command](/sdk/gcloud/reference/beta/network-security/secure-access-connec/realms/describe),\nthe output indicates whether your Symantec connection is successful.\n\nIf the connection to Symantec is successful, the output contains the following\nline: \n\n```\nsymantecConnectionState: SUCCEEDED\n```\n\nIf the output doesn't contain the preceding line, or the\n`symantecConnectionState` isn't `SUCCEEDED`, your connection to Symantec is\nunsuccessful.\n\nThis issue can be caused by one of the following reasons.\n\n- The API key that you uploaded when you\n [created a realm](/secure-access-connect/docs/create-realms#create-realm)\n isn't valid.\n\n To resolve this issue,\n [verify the format of the secret](/secret-manager/docs/access-secret-version)\n that contains the API key. The secret must use the following format and must\n not include any white spaces or tabs: \n\n ```\n USERNAME:PASSWORD\n ```\n\n If the secret doesn't match the preceding format,\n [edit the secret](/secret-manager/docs/edit-secrets). If the secret matches\n the preceding format, try generating and uploading a new API key.\n- The secret doesn't exist, the secret isn't associated with the realm, or the\n service account lacks permissions.\n\n To resolve this issue, do the following:\n - [View the realm details](/secure-access-connect/docs/view-realms#view-realm-details)\n and confirm that the secret name is correct.\n\n - Verify and correct the permissions granted in\n [Create a Secure Access Connect realm](/secure-access-connect/docs/create-realms#create-realm).\n\n- The Symantec location might already be in use by an existing attachment.\n\n To resolve this issue, make sure that you use a location that's not in use.\n- The Symantec site is temporarily unavailable.\n\n To resolve this issue, check with Symantec about the availability of their\n service.\n\n#### Connection states to Symantec\n\nThe following table lists the connection states to Symantec and what they mean.\n\n### Palo Alto Network Prisma Access attachment creation errors\n\nIf you encounter a Palo Alto Network Prisma Access attachment creation error,\ncheck for the following issues.\n\n- You aren't setting Symantec-specific fields.\n\n- You aren't specifying an invalid resource name.\n\n To resolve this issue, make sure that your resource name\n conforms with [RFC 1034](https://datatracker.ietf.org/doc/html/rfc1034), is\n restricted to lowercase letters, numbers and hyphens, and has a maximum\n length of 63 characters. Additionally, the first character must be a letter\n and the last a letter or a number.\n- A corresponding partner realm already exists and the associated\n realm is in the `PARTNER_ATTACHED` state.\n\n If the realm isn't in the\n `PARTNER_ATTACHED` state, you must complete the attachment process in the\n Palo Alto Network Prisma Access console.\n\n### Realm states\n\nThe following table lists the realm attachment states and what they mean.\n\n### Attachment states\n\nThe following table lists the Secure Access Connect attachment\nstates and what they mean."]]
