DCE-IP Feature Enablement Support for Skyhigh Secure Web Gateway: Hybrid Mode

SCP Policy Traffic Flow

Main traffic gets sent to the primary gateway (c.hybrid.skyhigh.cloud) where hybrid policy from Classic SWG applies. However, any traffic going to domains listed in your STRING list gets redirected to the alternate gateway (c.wgcs.skyhigh.cloud) instead. This alternate route enables dedicated egress IP addresses for those specific domains. 

This configuration creates two traffic pathways: 

1. Main Path: SCP traffic goes to the primary gateway (Classic SWG) and follows hybrid policy rules. 
2. Exception Path: For specific domains in your STRING list, traffic routes to alternate gateway (SSE/MOWGLI SWG) to use dedicated IP addresses.

Step 1: Login to SWG Cloud Console

1. Navigate to Setting > Infrastructure > Web Gateway Setup > Manage SCP Option.
2. Click on Gateway Object List (...) and create two new Gateway Objects (for testing purposes, can be changed for production users):
   Gateway 1(Admin: Primary Gateway) :c<CustomerID>.hybrid.skyhigh.cloud
   Gateway 2 (Admin: Alternate Gateway):c<CustomerID>.wgcs.skyhigh.cloud
3. After creating the two Gateway Objects, navigate to Configuration Policies.
4. Click on (...) to create a new SCP Policy.
5. Add Gateway 1 as the Primary Gateway and Gateway 2 as the Alternate Gateway.
6. Click Save to complete the process.

 Example: Below screenshot shows DEV_DCEIP_Testing and the SCP Policy which include Primary Gateway Object as c<CustomerID>.hybrid.skyhigh.cloud and Alternate Gateway Proxy as c<CustomerID>.wgcs.skyhigh.cloud (FQDN). 

Step 2: Create List Catalog Exception

 DCE-IP Hostname List to be routed via Alternate Proxy at the time of Egressing and Evaluating via SWG Cloud (SSE/Mowgli). 

1. Navigate to Policy > Web Policy > List Catalog > String.
2. Click on (...) to create a new String List.
3. Name the String List as Dedicated Egress IP Host List.
4. Add the list of Hosts that need to egress via Dedicated Egress IP.
5. On the top right corner, click Actions > Add New Items to add hostnames.
6. Click Save to complete the process.

Step 3: Add a DCE-IP Hostname String List to SCP Policy

• Navigate to Settings > Infrastructure > Web Gateway Setup > Manage SCP option.
• Go to the SCP Policy where the Gateway Object List was created and mapped as Gateway 1 (Admin: Primary Gateway: c<CustomerID>.hybrud.skyhigh.cloud. and Gateway 2(Admin: Alternate Gateway: c<CustomerID>.wgcs.skyhigh.cloud) in step 1. 
• Navigate to List Redirection option > Lists from Web Policy List Catalog.
• Click Add List option.
• Navigate to the DCE-IP Hostname string List created in step 2.
• Select the String List
• Click Save to complete the process.

Step 4: DCE-IP Web Policy Configuration via Rule Builder

• Proceed with configuring the DCE-IP Web Policy Ruleset Condition for the Selected DCE-IP Hostname List from the String List created in Step 2.
• Refer to the technical reference guide for DCE-IP Web Policy Ruleset Configuration (DCE-IP) for more details and examples.
• Navigate to Policy > Web Policy > Policy.
• Click on the hybrid Web Policy Ruleset.
• Navigate to the Hybrid Policy All Traffic Condition.
• On the extreme right corner, click on the three dots option.
• Select Add Policy Via Rule Builder Option.
• Follow the Ruleset Condition example provided to configure the DCE-IP Ruleset Condition.

Now the end user traffic for DCE-IP Hostname List will be evaluated via Alternate Gateway i.e. (WGCS Cloud) considering top-bottom ruleset evaluation and thus Hybrid Routing Policy will work as expected in hybrid mode, policy synchronized via SWG On-Prem. 

Scope of the feature : All traffic value conditions in Hybrid Mode for DCE-IP Web Policy Ruleset are not suggested/required, only specific DCE-IP hostname lists can be defined under the String List based on customer specific requirement in hybrid mode setup.