UPE - allowed categories not matching the policy

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Single Policy configured that enables certain categories and disabled others. For example, in this case everything which is related to "Security" is checked, except "File Storage/Sharing" and "Software Downloads". So, "Security" was checked, and then the 2 categories were unchecked:

Then the policy is configured to block the above URL Category. However, all the sites which belongs to "File Storage/Sharing" or "Software Downloads" are blocked as well, although they should be allowed.

Environment

Cloud SWG managed using UPE policy

Cause

When the above policy is saved, this is shown in the Generated CPL:

 

unselected categories are listed within the same quote "File Storage/Sharing,Software Downloads". Since there is no such category, all sites from "File Storage/Sharing" or "Software Downloads" are not matching it.

Resolution

The workaround to this current problem is to just select categories which should be blocked, leaving unchecked those which should be allowed. In the below example everything from "Security" group is selected except those 2 categories ("File Storage/Sharing" and "Software Downloads") but this is achieved in the opposite way as before - just matching the remaining categories:

 

as a result, Generated CPL shows categories in the single quotes now: