DRTR Health Check fails on child Edge SWG (ProxySG)

Products

• ProxySG Software - SGOS

Issue/Introduction

In a Edge SWG (ProxySG) chaining deployment it is possible to have the child Edge SWG (ProxySG) forward dynamic categorization requests through upstream Edge SWG (ProxySG). See SGOS Administration Guide for more information.

If DNS is not configured on the child Edge SWG (ProxySG) you will see that the DRTR health check will fail, even though WEBPULSE and BCWF is functioning correctly.

Cause

In order to avoid having DRTR health checks fail the child proxy needs to be able to resolve sp.cwfservice.net  for SGOS 6.5 and webpulse.es.bluecoat.com for SGOS 6.6.x and later.
 

Resolution

The preferred solution would be to allow DNS forwarding so that the DNS resolution could succeed. This could be limited to only work for sp.cwfservice.net

An alternative solution might be to set DNS configuration on the parent Edge SWG (ProxySG).