Sharefile uploads/downloads fail or hang when sent through Cloud SWG

Products

• Cloud Secure Web Gateway - Cloud SWG
• CASB Advanced Threat Protection
• CASB Audit
• CASB Gateway
• CASB Gateway Advanced
• CASB Security Advanced
• CASB Security Advanced IAAS
• CASB Security Premium
• CASB Security Premium IAAS
• CASB Security Standard
• CASB Securlet IAAS
• CASB Securlet SAAS
• CASB Securlet SAAS With DLP-CDS

Issue/Introduction

Uploads and/or downloads are not successful when sending Sharefile traffic through Cloud SWG. The upload or download might hang or simple fail as shown in the example image below:

Environment

Cloud SWG

Symantec CloudSOC (CASB)

Cause

Sharefile is sensitive to our IPv6 anonymized XFF headers. It has been determined that when sending traffic using an anonymized header, the upload and/or download fails. When reviewing a har file captured while reproducing the issue, traffic destined for sf-api.com was failing. 

Resolution

The following are possible workarounds that should help resolve the issue with the uploads and/or downloads through Sharefile. Depending on the environment in use, one option may be preferable over another. See notes related to CASB integrations. 

1.  Add sf-api.com as an SSL exemption in the Cloud SWG policy. When you exempt the domain from SSL interception, the proxy will not intercept and insert the X-Forwarded-For (XFF) header.
   
   Exempt traffic from SSL Interception in Cloud SWG
   
   NOTE: If you are also leveraging a CASB integration with gatelets enabled for the Sharefile application, exempting the traffic from SSL interception in Cloud SWG may not be the best solution as exempting the traffic from SSL interception will result in information missing from logged activities related to Sharefile in the CASB console. 
   
   sf-api.com is part of the CASB domains of interest as outlined in the following: 
   
   Symantec CloudSOC - Sharefile
   
   The following two workarounds will be preferable when utilizing CASB as they will maintain SSL inspection for this traffic.
   
   
2. Use Original Source IP setting found in the Cloud SWG console. (Select Policy > Header Modification > Global Rules > Select Original Source IP). For further information on this setting: 
   
   Anonymize Source IP Addresses in the XFF Header
   
   Use an anonymous IP in the X-Forwarded-For (XFF) Header Field
   
   NOTE: If using a Cloud SWG tenant that only utilizes the CASB component (the setting for changing the Anonymized IP to Original IP will not be available in these "CASB only" Cloud SWG tenants). If this is the case, please refer to option 3.
   
   
3. A policy fragment (applied on the backend) can be applied specifically to sf-api.com. This policy fragment will have the same effect as Option 2 but will be targeted only to traffic for sf-api.com. If you wish to maintain the anonymized IP setting in Cloud SWG, or you have a "CASB Only" Cloud SWG tenant, please reach out to support and this can be enabled for your tenant to resolve the issue in this manner.