Bypass settings for Private Access SAML

You must add a bypass destination for each Private Access gateway. Each gateway is assigned a unique ACS, and each ACS must have a corresponding bypass destination configured.

Steps

  1. Select the configured Identity Provider and see the Service Provider Assertion URL field in the SAML Identity Provider with Metadata XML pane.
    Note: A complete list of the available ACS URLs for your tenant can be found under Administration > Authentication > Identity Provider
    A tenant is provisioned with up to 10 ACS URLS, allowing the tenant up to 10 Private Access gateways (5 for High Availability). More gateways can be added if required. Each URL will be identical except for a sequence number.
  2. Add each ACS as a proxy bypass.
    1. Sign in to the Cloud Security Gateway portal.
    2. Navigate to Web > Bypass Settings.
    3. Select the Proxy Bypass tab.
    4. In the Proxy Bypass list, click Add.
    5. Enter a name and a description (optional), for example, the name of the internal application, such as "Private Access SAML".
    6. In the Type drop-down menu, select Domain.
    7. In the Domain field, add the external FQDN for the ACS as defined in the Private Access management portal.

      The ACS FQDN is found in the Private Access management portal, under Administration > Authentication > Identity Provider. Click the name of the configured Identity Provider to view its details, including the Service Provider Assertion URL list.

      Example: The FQDN for ACS URL:

      https://proxy-0.acme.bba.services.amer.forcepoint.io/acs

      will be:

      proxy-0.acme.bba.services.amer.forcepoint.io

    8. Check Send traffic to another proxy.

      A dialog displays.

    9. In the dialog box, enter the service edge address for the ACS.

      The service edge is identical to the ACS URL, except that bba is replaced by pa, and port 8080 is added.

      The corresponding service edge for:

      proxy-0.acme.bba.services.amer.forcepoint.io

      will be:

      proxy-0.acme.pa.services.amer.forcepoint.io:8080.

    10. Click Submit.
    Repeat this for each ACS URL.