Cloud SWG not SSL Intercepting Office 365 destination despite G2 rule set to Intercept.

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

SSL intercept was not happening even when the G2 rule (with "Office 365 Destinations") in TLS/SSL Interception policy in Cloud SWG was set to intercept. 

Cause

The G2 rule is NOT an SSL intercept rule. It just tells Cloud SWG that we "will" be intercepting Office 365 Destinations. The intercept decision depends on rule that is underneath G2. By default, the G3 rule exist and is set to Any Any Intercept. In this case the G3 rule have been set to "Do Not Intercept" hence SSL interception did not take place. 

Resolution

Configure the G3 rule back to default which is to Intercept as shown below.