SIG - Web Policy Issue?

[dianawinskymartin]

We experience inconsistent user experience when using the internal network or on-network, there are times that we can access the site or not and no logs are captured. We are using AD users' identities only that shared information with roaming client. Roaming is working when off-network and hits the policy and has logs. All users are domain-joined. When in on-network we have tunnels going to umbrella. What could be the possible solution in on-network that should hit the same policy as when off-network? We also tried using DNS forwarder but the status is unable to resolve. Could the routing to the tunnels be the issue?

[nbogdaje]

Check your SWG backoff settings in the roaming computer settings. If you are backing off your roaming users SWG then you will need to use SAML to get the AD user info when going over the tunnels for web traffic.

[dianawinskymartin]

Hi, we are still experiencing this issue. There are checks in the SD-WAN section, but their findings show that traffic is being forwarded to SIG if the app or domain is not part of Cloud On-Ramp. Upon checking the policy debug in end devicess without secure client or with secure client that enabled backoff settings, we still see "Protected by DNS" instead of "Protected by SWG," and when using WhatIsMyIP, the public IP displayed is the SD-WAN public IP instead of the Umbrella IP.