Auth Connector fails to connect to Cloud SWG when routing via a proxy
search cancel

Auth Connector fails to connect to Cloud SWG when routing via a proxy

book

Article ID: 245609

calendar_today

Updated On:

Products

Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

The Auth Connector is unable to communicate with the Cloud SWG (Web Security Service) authentication IPs.

  • Auth Connector status in Portal showed several Auth IPs to which it failed to connect into Cloud SWG.
  • Auth Connector is configured to use a proxy server for outbound connections to the internet.
  • No firewall or device after the proxy blocking outbound connections.

Environment

  • Cloud SWG Auth Connector
  • Cloud Secure Gateway

Cause

The local proxy server had SSL interception enabled which was breaking the SSL handshake between the Auth Connector and Cloud SWG.

Resolution

It is recommended to:

  • Add the internal IP of the Cloud SWG Auth Connector Server to the proxy's SSL exemption list - Set to Do Not Intercept.
  • Add the internal IP of the Cloud SWG Auth Connector Server to the proxy's Auth exemption list - Set to Do Not Authenticate.

Technical Requirements:

  • Direct Internet Requirement—The Auth Connector must have a direct connection to the Internet.
  • If a proxy is required—The proxy must be configured as a pass-through only with no SSL interception and no Authentication.
  • Do not allow the Auth Connector to connect through the same IPsec tunnel that goes to Cloud SWG

Additional Information