Configure External Domains List in CSC SWG to Bypass the SWG Proxy

Introduction

This document describes configuring the External Domains List in Cisco Secure Client (CSC) Secure Web Gateway (SWG) to bypass the SWG Proxy.

Prerequisites

Requirements

There are no specific requirements for this document.

Components Used

The information in this document is based on SWG.

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.

Overview

Note: Cisco announced the End-of-Life of Cisco AnyConnect in 2023 and the Umbrella Roaming Client in 2024. Many Cisco Umbrella customers are already benefiting from migrating to Cisco Secure Client, and you are encouraged to begin migration as soon as possible to get a better roaming experience. Read more in this Knowledge Base article: How do I install Cisco Secure Client with the Umbrella Module?

The Cisco Secure Client (CSC) (formerly AnyConnect) Secure Web Gateway (SWG) Agent is a component of the Umbrella module for CSC. All web traffic is intercepted by the SWG agent to send to the CSC SWG except domains and IPs on the External Domains List and the Internal Domains List. The External Domains List bypass can contain IPs or domains to bypass. 

If you are using the CSC SWG agent for your SWG deployment, please read this article to avoid seeing issues bypassing your content.

Functionality limitation in versions under 4.9

The CSC Secure Web Gateway (SWG) Agent can send any web traffic on the External Domains List directly and bypass the SWG proxy. For AnyConnect versions under 4.9, there is a known issue in the SWG agent functionality for bypassing by domain. This applies to domains that are CNAMEs or tied to certain applications such as Office365.

To ensure your bypass is completely functional by domain, please take one of these steps:

• Upgrade to AnyConnect 4.9+.
• Add the IP addresses to bypass belonging to critical to bypass domains.

Note: If migrating from Cisco CWS, import your entire bypass list as-is. Please do not remove any bypass entries to ensure a 1-1 bypass migration.