After a user configures a connection profile with a bookmark list and tests the clientless SSL VPN connection, all of the bookmarks are grayed out. What must be done to correct this behavior?

Applying a bookmark to a group policy controls visibility of bookmarks for users, but bookmarks that are visible yet grayed out already have the correct policy association - the issue is server reachability, not policy assignment.

An incorrect port in the bookmark would result in a connection error or timeout after the link is clicked, not the grayed-out state that indicates the ASA cannot reach the server at all.

In clientless SSL VPN, the ASA acts as a proxy and initiates all connections to internal servers on behalf of the user, so it must resolve server hostnames itself. When bookmarks are grayed out, it signals the ASA cannot reach the server, and the most common root cause is that no DNS server is configured on the ASA or the DNS server has no record for the web server. Configuring a DNS server on the ASA and verifying the DNS record allows the ASA to resolve the hostname and successfully proxy the connection.

Verifying HTTP/HTTPS connectivity is a useful secondary check, but without DNS resolution the ASA cannot form a TCP connection in the first place, making DNS configuration the primary corrective action.