Determine Which Policy Is Applied For SWG Proxy

Overview

Through Web policies, you set the rules as to how Umbrella applies security and access control to your identities Web traffic. This article will help an Umbrella administrator:

• Confirm that Web traffic is routed to Umbrella’s Secure Web Gateway (SWG)
• Identify the applied Web Policy for a given identity
• Conduct basic Web policy troubleshooting

Confirm Traffic is Reaching the SWG

If traffic is sent to the SWG the public IP address will fall within the 146.112.0.0/16 or 155.190.0.0/16 range. The following test will determine if traffic is reaching the SWG.

Determine the Web Policy

To know which Web policy the identity is matching a given identity, the administrator will need to open a Web browser on the client machine and navigate to the following debug link:

 http://policy-debug.checkumbrella.com/

The output will look similar to the example below: 
<OrgID> is a unique organization identifier
<Bundle ID> is a unique policy identifier

https://dashboard.umbrella.com/o/<OrgID>/#/configuration/policy/<Bundle-ID>

If the administrator is logged into the Umbrella dashboard, clicking the link will direct them to the applied Web Policy. In the screenshot below, we see the ‘webpolicy’ (bundle 1215094) is applied.

Basic Troubleshooting

• Ensure traffic is routed to the SWG
• Ensure the Web policy is applied to the expected identity. Please see: https://docs.umbrella.com/deployment-umbrella/v1.0.6/docs/add-a-gateway-policy
• If the domain is bypassing the SWG, check if the domain is listed in the dashboard's 'External Domains' list. Found under Deployments > Configuration > Domain Management

If you are raising a Support case, please provide the following:

• A copy of the debug link
• The expected identity and Web policy
• Method of connection to the SWG: PAC file, AnyConnect SWG module or Tunnel

Note:

The command nslookup-q=txt debug.opendns.com cannot be used to determine policy for SWG and is only limited to determining policy for DNS.