Whitelist and Blacklist behaviour on Symantec Web Gateway (SWG)

Products

• Web Gateway

Issue/Introduction

There is a need to know details of how the Whitelists and Blacklists are processed by Symantec Web Gateway (SWG)

Cause

 

Resolution

General precedence order for Whitelists/Blacklists on SWG is as follows:

• Whitelist IP/Blacklist IP
• Rule Detection
  • Phone Home
  • APC
  • User Defined Blacklist Domain with keyword
  • User Defined Blacklist by file extension

• Whitelist Domain (Default and User Defined)
• Botnet
• Blacklist Domain
• URL Content Filter
• AV Scan
• Insight

 
Please also be aware of following considerations:

• SWG in Proxy mode does not support whitelist by IP address http://www.symantec.com/docs/TECH157358 , for this reason in case of SWG proxy mode PAC file exceptions or use of Content Filter policies/exceptions is recommended
• Symantec Web Gateway (SWG) whitelist functionality appears not to work as expected http://www.symantec.com/docs/TECH191485
• Ignore authentication in Whitelists does not work with NTLM v2(407) http://www.symantec.com/docs/TECH157391
• ​Whitelists don't work when the target URL is accessed through a redirect http://www.symantec.com/docs/TECH162252
• Do URL exceptions and domain whitelists apply to embedded URLs http://www.symantec.com/docs/TECH171070

For a more general list of SWG supportability considerations please see following KB article:
http://www.symantec.com/docs/TECH201581