Contents

Introduction

Overview

Solution

Introduction

This document describes how to troubleshoot proxy error "401 Authorization Required".

Overview

Users receive a "401 Authorization Required" error when the source/egress IP is not registered on the Umbrella Dashboard as part of a Secure Web Gateway web policy. This typically happens when a device is taken off-network but the web traffic is still being forwarded to Umbrella using PAC file.

401_screenshot.png

Solution

PAC file deployment is not supported for mobile or roaming devices. SWG for devices off-network must be deployed using the AnyConnect SWG module. You can also manually add the location to your PAC file using this function:

isInNet( )(host, pattern, mask)

Where:

- host is a DNS host name or IP address. If a host name is passed, this function resolves it into an IP address.

- pattern is an IP address pattern in the dot-separated format

- mask is the IP address pattern mask that determines which parts of the IP address must be matched against. A value of 0 means ignore; 255 means match. This function is true if the IP address of the host matches the specified IP address pattern.

Example:

isInNet( )(host,198.95.0.0, 255.255.0.0)

More information on customizing PAC file can be found here: Customize Umbrella's PAC File