WSS Agent cannot connect to data centers documented in WSS IP address article

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

WSS Agent used to access internet via WSS.

Some UK users have strict requirements to access WSS traffic in the UK, yet some users (living close to borders and geographically closer to other data centers, or travelling for work) connect to other non UK data centers.

dpOverride option is used to manually connect users to UK data centers defined in WSS IP address KB article.

dpOverride change enforced with GPO and WSS admin needs to know IP addresses to use.

Until recently (June '22), the override option to 148.64.26.164 worked fine but connection failures exist from this date onwards.

Environment

WSS Agent 

Cause

WSS Agents should only connect to WSS Agent sites and not the fixed sites. Exceptions will occur for smaller data centers where WSS agent and fixed site traffic hits the same VIP.

WSS IP address KB article publishes VIP IP address for fixed sites, and not for the WSS Agent users. This is because our CTC service is used to send users to nearest data center. 

Resolution

Although the WSS agent VIPs are not published, an admin can retrieve them by looking at the 'support logs' from any local WSS Agent user and taking the IP addresses.

In the example below, we can see the following local IP addresses which can be used with dpOverride - GIEDU-148.64.15.164  GGBLO-148.64.9.164  GGBDO-170.176.242.164.

For the UK, the following VIP IP addresses can be used with dpOverride to send traffic to UK pods - 148.64.28.164, 148.64.9.164 and 170.176.242.164  may all be used.