Users will receive a "401 Authorization Required" error when the source / egress IP is not registered on the Umbrella Dashboard as part of a Secure Web Gateway web policy. This typically happens when a device is taken off-network but the web traffic is still being forwarded to Umbrella using PAC file.
PAC files deployment is not supported for mobile or roaming devices. SWG for devices off-network should be deployed using the AnyConnect SWG module. You can also manually add the location to your PAC file using this function:
isInNet( )(host, pattern, mask)
- host is a DNS host name or IP address. If a host name is passed, this function will resolve it into an IP address.
- pattern is an IP address pattern in the dot-separated format
- mask is the IP address pattern mask that determines which parts of the IP address should be matched against. A value of 0 means ignore; 255 means match. This function is true if the IP address of the host matches the specified IP address pattern.
isInNet( )(host,18.104.22.168, 255.255.0.0)
More information on customizing PAC file can be found here: Customize Umbrella's PAC File