Overview

This guide provides admins with a general procedure to follow in order to identify and troubleshoot common Internet Threat Protection issues. Use this doc to map symptoms to causes and apply resolutions before escalating to support.

Pre-requisites

• admin access to SIA org

General Troubleshooting Procedure

Step 1: Identify the symptom(s)

For example, a public website or a local website may be unexpectedly inaccessible or unexpectedly accessible to end users in your org; alternatively, end users in your org may be experiencing high latency.

Step 2: Verify the environment

Check for network connectivity, verify that the applicable ITP policy configuration is accurate and current (e.g., check which domain categories, apps, specific domains, and geo-locations you've selected to block), and verify your org's licensing (i.e., ensure that you have SIA licenses).

Step 3: Collect logs and diagnostic info

• Request that end users send logs via the CSE desktop app.
• Capture an HTTP Archive file (HAR file) to view calls and responses associated with a user's web session.
• Review how a specific domain is being handled by using the Lookup domain search function in the ITP policy.

Step 4: Apply relevant fixes

This may involve adjusting your ITP policy configuration to correct unexpected behaviours (e.g., adding a domain or URL to Domain & URL Bypass, adding a domain or URL to Domain & URL Blocking, or adjusting Application Filtering or Application Bypass) or adjusting your firewall rules to accept swg agent traffic.

Step 5: Escalate to support

If further assistance is required, reach out to support at support@sonicwall.com.

A URL block or bypass is not being applied

Symptom: A URL added to Domain & URL Blocking or Domain & URL Bypass on an ITP policy is not enforced. Domain entries on the same policy continue to work.

Root cause: URL entries are enforced only when SSL decryption is enabled on the ITP policy. If SSL decryption was turned off (or was never on), URLs on the policy are kept but not enforced. The console surfaces a red outline on the affected entries and an inline error in the relevant section.

Resolution:

1. In the Command Center, navigate from Internet Access > Internet Threat Protection and open the policy.
2. In the Assignment progression, toggle SSL decryption on.
3. Save the policy. Existing URL entries in Domain & URL Blocking and Domain & URL Bypass become enforced immediately; no re-entry is required.

If a URL still does not enforce after SSL decryption is on, confirm the URL is not also bypassed elsewhere — bypasses are processed before block rules. See How ITP rules are processed.

Diagnostics and Tools

Use Lookup domain to review how a domain is being classified and handled by the ITP policy

Request end users to send logs via the desktop app

Common Error Codes and Messages