Web gateway alternative auth for none MCP nodes

[al-faunzo]

Dear mcafee ,

we have been testing a ruleset to allows machines (linux with no MCP support) to bypass the MCP Authentication ruleset. See sscreenshot

In the Explicit ruleset their is a rule saying that  "Only allow users of Allowed user groups". 
This rule is set to "Domain users" only.

How ever, WE notice local accounts like "systems" and "network account" in other Win10 OS beeing blocked once they request 443 requests (which should be normal since they are not in domain users or domain joined). This is not visible for the users but we can se it in the logs. 

Any ideas what we could do here..? 

Br

[mkutrieba]

Hello @al-faunzo,

so if I understand this correctly, the concern is about "user does not see the block which you see in logs"!?

This sounds like the CONNECT request (e.g. CONNECT www.google.com:443) gets blocked. Following information is just based on this thought (I hope it is correct).

In this case, it is normal that users do not really see the McAfee block page.

Reason is, that MWG responds with a HTTP response such as a block page (e.g. URL Filter, MediaType filter, GAM scanning, etc.) to a CONNECT request from the browser. The browser sends HTTPS and receives HTTP which he is not expecting. Therefore, no McAfee block page is shown but a blank page from browser.

HTTPS Scanning must be performed first (Handle CONNECT Call, Certificate verification and content inspection). Once this is through (in policy shown as CONNECT and CERTVERIFY cycle), the SSL traffic is broken and MWG can see the actual HTTP GET/POST request/cycle in there. If it then responds with a block page, the browser is in HTTP communication and should show the actual McAfee block page.

Let me know if this answers your questions or if you have further.