Manage IP Surrogates for User Authentication
The Cisco Secure Access Secure Web Gateway (SWG) uses a cookie surrogate for Security Assertion Markup Language (SAML) authentication. Secure Access checks if a cookie is set in the HTTPS request. If the cookie surrogate is not set in the HTTP header, then Secure Access can not authenticate the user's connections to secure internet destinations.
We recommend using IP surrogates when the user's private IP address is visible, when your network tunnels don't use NAT, or when your networks incorporate a Proxy Chain with the X-Forwarded-For (XFF) request header. If the user's private IP address or an IP address is shared by multiple users, then we recommend using cookie surrogates. You can bypass IP surrogates for the internal networks that you add to an SSO authentication identity provider (IdP) integration.