api.anthropic.com not working over HTTPS

Products

• Cloud Secure Web Gateway - Cloud SWG

Issue/Introduction

Users accessing internet sites via Cloud SWG using WSS Agents.

As part of some testing done on a Cloud SWG Tenant with Cloud Firewall & DNS Proxy Enabled, some users have noticed that they are unable to connect to either claude.ai or api.anthropic.com over HTTPS.

Looking at the Enterprise Console logs, admins can only see the HTTP traffic from the impacted users.

The same admin cannot see any failed TCP/SSL traffic for either domain, suggesting the requests did not even reaching the policy engine.

From the Agent PCAPs, DNS is being resolved, and traffic is sent to the resolved IP, but a RST is returned.

Nothing is seen in Cloud firewall log or proxy logs. I can see it in the DNS logs and the routing logs.

Environment

Cloud SWG.

UPE managed tenant.

WSS Agent.

 

Cause

Policy misconfiguration blocking access to the destination site.

Resolution

Make sure that the destination IP address for the api.anthropic.com site is allowed in the policy. In the above case, the server_url statement was added to the previous condition so that the TUNNELed requests were allowed through.

define condition Allow_Anthropic_domains
    url.domain=//api.anthropic.com/    
    request.application.name="Claude AI"
    server_url.addr=#.#.#.#
end

Previous policy had an allow for url.domain=api.anthropic.com, but with UPE managed tenants this initial TUNNELed request was blocked and not passed to the SSL layer where the proxy could identify the domain. HTTP layer worked as the domain is in clear text.

Additional Information

HAR file shows HTTP working with HTTPS failing: