Troubleshooting Umbrella Secure Web Gateway: Policy Debug and Diagnostic Tests

Overview

The existing version of the Umbrella Diagnostic Tool provides important information for troubleshooting network identities, Virtual Appliances and AD Integration, and some Roaming Client instances (and can be found here: Umbrella Diagnostic Tool: What to Provide Support When Asked. For users wanting to troubleshoot issues with Secure Web Gateway (SWG), you can use the policy-debug page and the new SWG Diagnostic Tool listed in this article.

Policy Debug Page

As a first step to troubleshooting, go to policy-debug.checkumbrella.com (or policy-debug.opendns.com) while you are using SWG with the expected Web Policy applied:

You may have to expand "Diagnostic Info" to view your results. Copy and paste these results to your ticket when submitting your question or replying to your case.

Providing a HAR file capture

When asked for a HAR capture, see our guide for How to: Get .HAR files for troubleshooting.

AnyConnect SWG Logs

Capture a DART file. If asked for max logging - see Cisco Anyconnect SWG: How to enable the max debug logging. Once set, reproduce and then capture a DART.

Downloading the SWG Diagnostic Tool

In addition to the above, support may ask for the results of an SWG Diagnostic Tool to provide additional information.   The tool is available from software.cisco.com using the following link:
https://software.cisco.com/download/home/286312181/

When you are asked to run the SWG Diagnostic Tool by umbrella support, you should change the default configuration before proceeding with tests.  Click the 'Settings' icon and choose 'Measure page load time and create HTTP Archive'.  

The SWG diagnostic tool contains the following features:

• Overall Diagnostic
  Compares page load time for one or more websites.  A number of popular websites are tested by default.  The tool will attempt to compare performance with SWG vs Direct Internet Access.
• One URL Diagnostic
  Test page load time for a single URL.  The tool will attempt to compare performance via SWG vs Direct Internet Access.
• Collection
  System configuration information and basic connectivity tests 
• Scheduler
  The diagnostic tool can be (optionally) configured to run at a scheduled time

After running the Diagnostic please gather the Results .zip file from the Archive folder and upload this to your Umbrella technical support ticket.