Selective TLS Inspection and Guest Bypass in a Umbrella SIG Migration
A university with 7,500 staff and 22 branch sites uses a hub-and-spoke MPLS network. It is replacing an on-prem web proxy with Cisco Umbrella SIG. Branches will run IPsec tunnels to the two nearest Umbrella data centers; 2,000 laptops get the roaming client. The security team wants TLS inspection for malware and DLP for 500 finance users, plus blocking of unsanctioned SaaS. After a pilot, Outlook fails for some users, two banking portals break, branch guest Wi-Fi is unfiltered, and SaaS latency from a remote branch rises from 40 ms to 180 ms. The proxy team insists on keeping a PAC file for legacy applications. The university has an internal PKI and cannot decrypt traffic to a student health clinic. Explain what to change.
1. Design the TLS inspection and bypass rules. Why do Outlook and the banking portals break, and how should the policy be ordered?
Read the worked answer
Outlook and the banking portals break because TLS inspection with an internal resigning CA causes certificate-pinning failures, and because some financial categories must not be decrypted. Build first-match rules: do-not-decrypt for finance and health categories, the specific banking applications, and any known pinned applications; do-not-decrypt for the student health clinic by destination or identity; then decrypt only the user populations that require malware and DLP inspection. For Outlook, check modern authentication endpoints and pinning behavior, and exclude only the specific failing Microsoft 365 endpoints if necessary, not all Microsoft traffic. Apply DLP only to the finance identity group and only for uploads to unsanctioned destinations; do not decrypt everything to feed DLP. Confirm that the resigning CA is trusted by endpoints and that the root chain is complete. Log decryption errors and review them weekly, because an exception placed after a broad decrypt rule will not take effect.
2. Why is branch guest Wi-Fi unfiltered, and how do the PAC file and identity design fit into the target architecture?
Read the worked answer
Guest Wi-Fi is unfiltered because the guest SSID or VLAN bypasses the branch tunnel, or it uses a tunnel identity that has no policy. Put guest traffic through a dedicated tunnel and identity with a guest policy that blocks malware but does not decrypt, or isolate it and force it through the same SIG edge. Do not let guest traffic go direct to the internet without policy.
A PAC file only helps applications that honor proxy settings. Legacy applications that ignore PAC or connect directly will bypass SIG unless they are tunneled or explicitly proxied. Keep a PAC file only for applications that require explicit proxy, and point it at the SIG proxy; never treat PAC as the security policy. Map AD groups to policies, use the roaming client for laptops, and use tunnel identity for branches. Separate staff, contractor, and guest identities so that one group's exceptions do not become everyone's policy.
3. Troubleshoot the latency increase and recommend tunnel placement and failover changes.
Read the worked answer
The 40 ms to 180 ms increase indicates that branch traffic is hairpinning through the hub MPLS to a distant SIG data center. Use direct internet access at the branches with local IPsec tunnels to the nearest SIG edge, or place the tunnel on the branch router with the shortest path. Check whether a roaming client is active on a laptop that is also behind the tunnel, which causes double inspection. Measure per-hop latency and SIG processing time, and ensure tunnel bandwidth and failover to a secondary SIG node are adequate.
If policy permits, exclude latency-sensitive SaaS from decryption rather than disabling inspection globally. Validate failover by disabling the primary tunnel and measuring how long existing sessions take to recover. Do not solve latency by turning off the proxy or sending traffic direct; use selective policy and correct tunnel placement.