Troubleshoot Proxy Error "401 Authorization Required"

Available Languages

Download Options

  • PDF     (47.1 KB)
    View with Adobe Reader on a variety of devices
  • ePub     (116.5 KB)
    View in various apps on iPhone, iPad, Android, Sony Reader, or Windows Phone
  • Mobi (Kindle)     (101.3 KB)
    View on Kindle device or Kindle app on multiple devices
Updated:October 1, 2025
Document ID:224940

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

    Introduction

    This document describes how to troubleshoot proxy error "401 Authorization Required".

    Overview

    Users receive a "401 Authorization Required" error when the source/egress IP is not registered on the Umbrella Dashboard as part of a Secure Web Gateway web policy. This typically happens when a device is taken off-network but the web traffic is still being forwarded to Umbrella using PAC file. 

    401_screenshot.png401_screenshot.png

    Solution

    PAC file deployment is not supported for mobile or roaming devices. SWG for devices off-network must be deployed using the AnyConnect SWG module. You can also manually add the location to your PAC file using this function:

    isInNet( )(host, pattern, mask)

    Where:

    • host is a DNS host name or IP address. If a host name is passed, this function resolves it into an IP address.
    • pattern is an IP address pattern in the dot-separated format
    • mask is the IP address pattern mask that determines which parts of the IP address must be matched against. A value of 0 means ignore; 255 means match. This function is true if the IP address of the host matches the specified IP address pattern.

    Example: 

    isInNet( )(host,198.95.0.0, 255.255.0.0)

    More information on customizing PAC file can be found here: Customize Umbrella's PAC File

    Revision History

    Revision Publish Date Comments
    1.0
    01-Oct-2025
    Initial Release
    TAC Authored

    Contributed by Cisco Engineers

    Was this Document Helpful?

    FeedbackFeedback

    Contact Cisco

    This Document Applies to These Products