WSS Network Error: "Connection Refused"

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

All users from one WSS location are attempting to access a website, but are receiving the error:  

Network Error: A communication error occurred: "Connection Refused"

Other locations connecting to different data-centers are able to reach the website successfully.

Resolution

This type of "Network Error" means the the destination website is blocking the WSS egress IP's.

This can happen from websites that only allow certain egress IP address ranges to access their sites (such as some banking, legal, or governmental sites).

For sites that only allow white-listed (allowed) traffic, those sites must allow traffic from the WSS egress IP ranges, as documented at: 

Web Security Service (WSS) ingress and egress IP addresses

The two solutions are: 

(1) Contact the website to allow the WSS egress ranges, or 

(2) You can simply bypass the site from WSS (this is the most common and most immediate solution)

 

Additional Information

"Network Error" and "tcp_error" going through WSS