WSSA 8.1.X intercepting requests sent to 192.0.2.0/24 range IPs even after bypassing the subnet.

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Web or DNS requests sent to the IP's that belongs to 192.0.2.0/24 range are intercepted by WSSA version 8.1.1 and later even after adding the IP\subnet into the bypassed IP list.

Environment

WSSA 8.1.1 and later

Resolution

The address range 192.0.2.0/24 is in the "Reserved IP addresses" block - (https://en.wikipedia.org/wiki/Reserved_IP_addresses).

WSSA uses this IP block for internal routing between the driver and service component.

Anything that is sent by external applications destined for this address block will be intercepted by the agent and sent through the tunnel. Customers should not be using "Reserved IP addresses" ranges with WSSA.

The rule execution order of these addresses has been changed starting from version 8.1.1 – therefore you would see this behavior only in version 8.1.1 and later.

Since this reserved address range is internally used by WSSA, it cannot be bypassed as that would cause the agent to stop functioning. Customers should not be using reserved address ranges on their network.