The ProxySG appliance tries to connect to the OCS directly and not through the parent proxy.

The appliance tries to connect to the OCS directly because it is clientless traffic from pipelining, or fresh traffic.

Use the following policy to force forwarding of the clientless connections using the condition has_client=yes|no:
 
<Forward> 
; catch all clientless transactions and forward them 
has_client=no forward.fail_open(no) forward(forwarding_host-name)