Cloud SWG UPE custom exception pages are showing default values

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

The observed issue is the following:

• Custom exception pages are deployed via Universal Policy Enforcement (UPE) but are no longer being served to clients.
• Clients receive default Broadcom block pages instead of the organization's custom branding.
• In the policy view or reference proxy, the section under exception.all in http -> format (the core template HTML) appears effectively empty:
  

  (exception.all
    (contact)
    (details)
    (format)
    (help)
    (summary)
    (http
      (code)
      (contact)
      (details)
      (format)
      (help)
      (summary)
    )
  )

   

Environment

Cloud SWG with UPE policy mode

Cause

The issue is typically caused by an empty shared object added to the policy. This configuration issue breaks the exception pages display and prevents the Management Center from correctly pushing the exception.all content into the WSS policy

Resolution

To restore the exception pages, follow these steps on the reference proxy and Management Center:

1. Identify Empty Policy Objects: Review the policy layers on your reference proxy for any shared objects (e.g., categories, conditions) that contain no values. Remove any empty objects found.
2. Verify Exception Definitions: Go to Configuration > Policy and check the Included Objects. If there is any object empty, please Delete it.
3. Re-push UPE Policy: Perform a new policy push from the Management Center to the Cloud SWG tenant.
4. Verification: Verify that the exception.all section is now populated in the Cloud SWG policy and that the custom pages are being served to end-users.