Bypass Traffic in Secure Web Appliance

Explicit Proxy Configuration

Steps to exclude URLs from reaching the SWA

PAC File Configuration 

Depends on how you configured your PAC file, you can define the exception list and set the action to DIRECT.

Here are some samples to bypass the private IP address from reaching the SWA

var resolved_ip = dnsResolve(host);
if (isInNet(resolved_ip, "10.0.0.0", "255.0.0.0") ||
isInNet(resolved_ip, "172.16.0.0", "255.240.0.0") ||
isInNet(resolved_ip, "192.168.0.0", "255.255.0.0") ||
isInNet(resolved_ip, "127.0.0.0", "255.255.255.0"))
return "DIRECT";

This is an Example to Bypass the traffic to www.cisco.com from redirecting the SWA

if (localHostOrDomainIs(host, "www.cisco.com")) return "DIRECT";

This example is to bypass all the sub-domains of cisco.com from redirecting the SWA

if (dnsDomainIs(host, ".cisco.com")) return "DIRECT";

Note: Since PAC file is not Cisco product, the information is provided as a courtesy for your convenience. For further assistance, please contact the software vendor.

Browser Configuration ( Microsoft Edge, Internet Explorer, Google Chrome) 

Step 1. In the Start Menu, type Internet Options and press Enter.

Step 2. Navigate to Connections tab and click LAN Settings 

Step 3. Click on the Advanced

Step 4. Define your desired URLs in the Exceptions section.

Image - Navigate to Lan Settings

Image - Define the Exceptions

Browser Configuration (Mozila FireFox) 

Step 1. On the top right corner, click on the three bar menu and select Settings.

Step 2. In the search bar, type proxy.

Step 3. Define your desired URLs in the No Proxy for section.

Image - Define the Exceptions in Fire Fox

Browser Configuration (Apple Safari) 

Step 1. On the top-left corner, click on the Apple icon and choose System Settings.

Step 2. From the left panel navigate to Network and select the Network Interface you are using to access the Internet.

Step 3. Click on the Details.

Step 4. From the left panel, select Proxies.

Step 5. Define your desired URLs in the Bypass Proxy Settings section.

Image - Define the Exceptions in Fire Fox

Group Policy Configuration 

Depends on how you configured the Group Policy to push the proxy settings, you can define the exception list.

Bypassing traffic Transparent Proxy Deployment 

Steps to bypass the traffic from reaching the SWA

SWA Bypass Setting

Step 1. From GUI, Choose Web Security Manager. 

Step 2. Select Bypass Settings.

Step 3. Click Edit Proxy Bypass Settings.

Step 4. You can enter the URL, IP address or adding a Custom URL Category to the list.

Step 5. Submit and Commit the changes. 

Image - Configure Bypass Settings

Tip: Traffic that is Bypassed with this settings are not logged in the Accesslogs and can be viewed in the Bypass_Logs.

Redirect the Traffic From WCCP/PBR Router

You can configure source or destination IP address in your WCCP or Policy Based Router (PBR) to not redirect some traffics to the SWA.

Steps

Steps

Step 1. Create a Custom URL Category for the URLs.

1.1. From GUI, Choose Web Security Manager and then click Custom and External URL Categories.
1.2. Click Add Category to add a Custom URL Category.
1.3. Assign a unique Category Name.
1.4. (Optional) Add Description.

1.5. From List Order, choose the first category to position on top.

1.6. From Category Type drop-down list, choose Local Custom Category.

1.7. Add desired URLs in the Sites Section.

1.8. Submit. 

Image - Create a Custom URL Category

Step 2. Create an Identification Profile to exempt traffic from Authentication.

2.1. From GUI, Choose Web Security Manager and then click Identification Profiles.
2.2. Click Add Profile to add a profile.
2.3. Use the Enable Identification Profile check box to enable this profile, or to quickly disable it without deleting it.
2.4. Assign a unique profile Name.
2.5. (Optional) Add Description.
2.6. From the Insert Above drop-down list, choose where this profile is to appear in the table.

2.7. In the User Identification Method section, choose Exempt from authentication/ identification.

2.8. In the Define Members by Subnet, leave this field blank to include all Client IP address unless you would like to Pass Through the traffic for a certain IP addresses. 

2.9. From Advanced section, choose Custom URL Categories.

Image - Add Identification Profile

2.10. Add the Custom URL Category that was created on Step 1.

2.11. Click Done.

2.12. Submit. 

Step 3. Create a Decryption Policy to pass through traffic. 

3.1. From GUI, Choose Web Security Manager and then click Decryption Policy.

3.2. Click Add Policy to add a Decryption Policy.

3.3. Use the Enable Policy check box to enable this policy.
3.4. Assign a unique Policy Name.
3.5. (Optional) Add Description.
3.6. From the Insert Above Policy drop-down list, choose the first Policy.

3.7. From the Identification Profiles and Users, choose the Identification Profile that you created in Step 2.

3.8. Submit.

Image - Create a Decryption Policy

3.9. In the Decryption Policies page, under URL Filtering, click on the link associated with this new Decryption Policy.

Image - Select URL Filtering

3.10. Select Pass Through as the action for the URL Category created on Step 1.

Image - Set the Action to Pass Through

3.11. Submit. 

Step 4. Create an Access Policy to allow Microsoft Updates traffic.

4.1. From GUI, Choose Web Security Manager and then click Access Policy.

4.2. Click Add Policy to add an Access Policy.

4.3. Use the Enable Policy check box to enable this policy.
4.4. Assign a unique Policy Name.
4.5. (Optional) Add Description.
4.6. From the Insert Above Policy drop-down list, choose the first Policy.

4.7. From the Identification Profiles and Users, choose the Identification Profile that you created in Step 2.

4.8. Submit.

Image - Create Access Policy

4.9. On the Access Policies page, under URL Filtering, click on the link associated with this new Access Policy.

Image - Select URL Filtering

4.10. Select Allow as the action for the Custom URL category created for the URL Category created on Step 1.

Image - Set the Action to Allow

4.11. Submit. 

4.12. Commit changes.