Error: "CONNECT tunnel failed, response 426" when accessing sites via Cloud proxy from Azure VM

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Customer have configured IPsec tunnel from Azure to Cloud SWG data center.

User accessing internet sites from Azure VM via Cloud proxy (i.e. ep.threatpulse.net:80) and getting following error

CONNECT tunnel failed, response 426

Environment

Firewall/VPN access method
Trans-proxy (Explicit proxy over IPsec)

 

Cause

There is Azure native firewall which inspect all the traffic coming from Azure VM before traffic gets sends out into IPSec tunnle to Cloud SWG.

Azure firewall getting blocking traffic going to Cloud proxy (i.e. ep.threatpulse.net:80) hence the error.

Resolution

To resolve this allow traffic destined to Cloud proxy (i.e. ep.threatpulse.net:80) in Azure firewall.