"No connectivity to the proxy server" in WSS/Cloud SWG when accessing web isolated pages

Products

• WSS add-on - Selective Isolation
• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

You see the error, "No connectivity to the proxy server," when accessing an uncategorized site (e.g. http://www.example.com/) in Cloud SWG (formerly known as WSS),

Filtering rules should have allowed web isolated access to this site.

Other web browsing may be working, or access to the site without Cloud SWG or via another Web Security provider may work without issue.

Cause

Incognito mode may be enabled on the browser, which blocks access to the required Cloud SWG isolation cookie shown below. Chrome incognito mode will not preserve cookies or any data for that browsing session.

 

Resolution

We must allow access to required isolation cookies for incognito mode to work. Multiple options exist to enable this:

• Avoid using incognito mode with isolated sites
• Specifically allow 3rd party cookies in isolation mode
  1. Click on the 'eye' icon to right of URL and make sure you see message that the 3rd party cookie is blocked
  2. Click link to see cookies
  3. Select to allow ALL cookies or just allow the blocked global-noauth-shared.fire.glass cookie

Additional Information

Using developer tools you can clearly see that requests to the sharedomain.html object (Network tab) fail into the isolation service

but more importantly, the console tab shows why ('no access to session storage')

As a result we cannot complete the websocket connection and sandbox the domain for isolation.