Error: Condition not defined for IP Address List in Cloud SWG

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

When implementing an IP block list in Cloud SWG managed via Management Center (Unified Policy Enforcer), policy installation fails with a context error. This occurs when an upstream load balancer forwards traffic and the proxy does not recognize the IP list object within the CPL layer.

Symptoms:

• Policy installation fails in Management Center.
• Error: Condition not defined in or visible from the 'global_context' context: '####/addresses'
• client.effective_address does not match expected source IPs.

Environment

• Broadcom Cloud SWG
• Management Center / Unified Policy Enforcer (UPE)
• Downstream Load Balancer (e.g., F5)

Cause

The "IP Address List" shared object is not configured to trigger on the effective client address, causing the proxy to see the load balancer's IP as the source.

Resolution

1. Log in to the Management Center.
2. Navigate to the IP Address List shared object used in the policy.
3. Open Advanced Settings.
4. Enable Use client.effective_address trigger.
5. In the VPM CPL layer, add the following code to load the shared object in the global context and extract headers:

   #if enforcement=wss
   ; Load the Shared Object definitions in the global context FIRST
   ${include:Blocked_User_IPs}
   <Proxy>
       ; Extract the load balancer headers
       client.effective_address.request("$(request.header.x-forwarded-for)", "$(request.x_header.x-client-ip)")
   <Proxy>
       ; Enforce the deny rule based on the extracted IP
       condition=Blocked_User_IPs force_deny
   #endif

Additional Information

To speak with a customer representative or a Support Engineer, see Contact Broadcom Support.