Destinations that should be allowed (for UPE tenants) are blocked but some rules are in place to allow those, what is missing in the policy ?

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

For UPE tenants (tenants using Management Center to publish policies to Cloud SWG), certain websites are being blocked, despite the category presence in an Allow rule. The block page shows category-based block which does not match the categorization with Sitereview.

Environment

Management Center policies for WSSA or IPSEC

Cause

When the client is not using explicit proxy settings with WSSA or IPSec, Cloud SWG proxies are used in transparent mode.

This means that dns resolution happens locally on the device and the Cloud SWG proxy does not receive a http CONNECT request but only see a tcp connection request e.g. tcp://#.#.#.#:443.

In this case, Cloud SWG checks categorization against both IP of the URL and the URL. URLs are often categorised correctly, but its IP(s) also needs to have categorization or to have a categorization which is allowed in the policy.

Issue happens when:

1. IP addresses are not categorised and therefore uncategorized ip addresses can give undesired results and block sites if uncategorized/none category is set to block.
2. IP addresses have different category than original URL and that category is defined under blocked rule. 

Resolution

Compose a cpl layer inside VPM using below cpl. Below rule will allow all the uncategorized URL IPs (not URLs).

#if enforcement=wss
<proxy>
url.scheme=tcp category=Uncategorized url.host.is_numeric=true Allow
#endif

Admin may add other categories in above rule in order to allow broader spectrum of IPs after evaluating security risk. However, for unsecure categories, it is always recommended to raise recategorization request for that IP from Sitereview Website as allowing category in above rule will grant access to all IPs under that category regardless of URL.

Additional Information

How to write rules using CPL (with examples)