SWG 12.2.x Known Issues and Workaround

-

12.2.13

Issue: On KVM VM, kernel upgrade from 12.2.12 to 12.2.13 fails.

Workaround: Follow the steps below for workaround

1. Need to boot using the previously installed kernel version.
2. Need to build the initramfs using the dracut command.
3. Finally, update the grub with the newly built initramfs.
4. Reboot and boot using the latest kernel version; the system will come up.

For details, see TSWS-13308

12.2.11

12.2.10

Issue: In the latest SWG release 12.2.10, a save operation post addition or updates to the below configuration items might fail with an error message popup being displayed in UI.

NOTE: If you intend to change configuration values for any of the following fields, Skyhigh recommends not upgrading to 12.2.10.

Central Management:
    - IP addresses and ports of this node used for central management communication
    - Group network
   
Proxies > Data Exchange Layer:
    - Subscription Topics
    - Services

Date and Time
Bandwidth Control:
    - Interface names, for which classes need to be applied.
   
Hardware Security Module:
    - Keys to be loaded
    - HSM server port definition list

12.2.15

12.2.8

Issue: If the following conditions are met in your environment:

1. SWG version ≤ 12.2.8
2. The deployment mode is HAProxy/Router
3. You are not using Director (active and passive) as a scanner

Then upgrading to any later version will cause HAProxy to fail to start.

Workaround: The best practice is to add the Director as a scanner.

12.2.10

12.2.8

Issue: HA proxy service is not running after upgrading to SWG 12.2.8 and 11.2.22

This is an issue with the latest Haproxy version 2.9.3.
In the previous HAProxy version, we were getting the same issue as warnings.
but now it is coming as an alert, and haproxy is not starting.
The above errors will come if the configuration has some complicated configurations like multiple listeners etc. Following warnings are coming
"[WARNING] 150/111007 (2674) : parsing [/etc/haproxy/haproxy.cfg:141] : backend 'send_check_HTTP', another ser...commended.
May 30 11:10:07 director11 haproxy[2666]: [WARNING] 150/111007 (2674) : parsing [/etc/haproxy/haproxy.cfg:149]: backend 'send_check_FTP', another serv...commended.
May 30 11:10:07 director11 haproxy[2666]: [WARNING] 150/111007 (2674) : parsing [/etc/haproxy/haproxy.cfg:151]: backend 'send_check_FTP', another serv...commended.
May 30 11:10:08 director11 haproxy[2666]: [  OK  ]"

Workaround:

1) If the customer has not upgraded to the affected version then they can go to backend and do "haproxy -c -f /etc/haproxy/haproxy.cfg" and check if they have any warnings
if warnings are present Then the customer can refrain from upgrading to 12.2.8 or to 11.2.22.
2) If the customer has already upgraded then the resolution will be the following.
Following will be the alert messages
“[/etc/haproxy/haproxy.cfg:138]: backend 'send_check_HTTP', another server named 'srv__serv_192.169.10.109090' was already defined at line 134, please use distinct names.” 
now go to /etc/haproxy/haproxy.cfg
as per the above warning go to line 138 and comment out those lines.For commenting ,need to type '#' at the beginning of line.
example
"#server serv___serv_192.169.10.109090 192.169.10.10 check port 9090 inter 1000"
Then at the backend execute “service haproxy restart”.
if any changes in ui corresponding to haproxy or network the restart will happen and the same error will occur, then again comment in haproxy.cfg and restart.

Applications that use long-lived HTTP streaming responses, such as Server-Sent Events (SSE), may fail when accessed through Skyhigh Secure Web Gateway with HTTPS scanning enabled.

These applications keep response streams open and do not send a terminating end-of-data signal. As a result, the gateway cannot complete content processing, which may disrupt application functionality.

Workaround: Bypass HTTPS scanning for the affected application traffic to allow streaming connections to function correctly.