Verdict "connect_method_denied" in Cloud SWG (formerly WSS)

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

A CloudSWG verdicts report shows a verdict of "connect_method_denied"

• The "connect_method_denied" appears in the report when the page is blocked
• Cannot access a web page because the connection method was denied

Cause

By default, the Cloud SWG service only allows web traffic over ports 80 and 443.

Resolution

Cloud SWG can be configured to allow connections to non-standard ports.

Allow non-standard ports:

• VPN/Firewall (IPsec) access method: 
  • The "All Ports" license (now deprecated) will allow any port to pass through the Cloud SWG service for IPsec/VPN.
  • The Web Protection Suite (WPS) license includes the Cloud Firewall Service (CFS).
  • The Cloud Firewall Service (CFS) will allow any port to pass through the Cloud SWG service via Policy > Cloud Firewall.
  • Domain bypass at the firewall from the IPsec tunnel will prevent traffic from going into Cloud SWG service.  This workaround will allow traffic to use the non-standard port (and route out directly to the Internet).
    
    
• WSS Agent (WSSA): 
  • The Cloud Firewall Service will allow any port to pass through the Cloud SWG service via Policy > Cloud Firewall.
  • Forward specific ports in the Cloud SWG portal via Connectivity > Agent Traffic Manager > Traffic Intercept Rules.
  • Bypass the domain from the Cloud SWG service via Connectivity > Agent Traffic Manager > Traffic Bypass Rules.
    
    
• Explicit Proxy (PAC File): 
  • Bypass the domain from the Cloud SWG service via Connectivity > PAC File Bypasses > Bypassed Domains.