CloudSOC may require additional domains for Custom Gatelets depending on the user geolocation

Products

• CASB Gateway
• CASB Gateway Advanced

Issue/Introduction

CloudSOC may require additional domains for Custom Gatelets depending on the user geolocation. 

This may even apply to Full Gatelets where testing hasn't been performed for traffic originating from certain areas/regions.

 

• A customer using a Custom Gatelet for 'DocSend' observed that their Data Transfer Policy worked for other Gatelets but not for for their DocSend - Custom Gatelet.

• They had configured DocSend with <docsend.com>. 

• When Support performed the same test using the same domain for DocSend, the Policy successfully blocked the file transfer activity.

Environment

CloudSOC & Gatelet for traffic Steering

Cause

• Some applications such as DocSend may be configured to use additional domains depending on the user's geolocation and activity type such as upload/download.

• In the reported example, the user was based out of Montreal, Canada whereas Broadcom Support was testing out of the us-west area and did not observe the same problem.

 

Resolution

• For DocSend, the issue was resolved by adding the additional domain <docsend-prod.s3.amazonaws.com>.

• If you encounter a similar issue for DocSend or another application /site, we recommend you obtain an HTTP capture to evaluate the domains consumed for your target/activity and update your Custom Gatelet and retest. You can also open a Support case for assistance.