Is there a clear example to the "Late" next to a rule in a trace file?

[Wasfi Bounni]

Hi;

Is there a clear example to the "Late" next to a rule in a trace file? I mean as opposed to a "Match" or a "Miss".

Also is late effectively a miss?   


Kindly
Wasfi

[Jacob Miles]

Hi Wasfi,

I think you may find this KB helpful

https://knowledge.broadcom.com/external/article/169002/in-a-policy-trace-what-does-the-late-tag.html

Thanks,

[Raunak Tiwari]

Hi Wasif,

Let say you are trying to connect to example.com and its allowed for the particular AD Group members and you are also part of the AD Group.

When you will hit example.com in browser it will try to connect to proxy and then proxy will look for the Policies,
Note:- remember at this stage you are not authenticated to Proxy.

so proxy has following details of you: (Proxy will have more details than this but for explanation I'm considering only two)
1> Your IP.
2> Website that you are trying to connect.

Based on the Auth policy Proxy will ask you to Authenticate but at the same time when it will look for the Authorization Layer (Web Access Layer) Policy, there you will see Late condition because proxy can think you can be part of this AD Group (in Policy) as this policy is for example.com and you are also connecting to example.com.

In other words Polices are based on 2 tuples Source and Destination, If any of the tuple will match then it will be considered as "Late" match.

I hope I'm clear.

------------------------------
KR,
Raunak
------------------------------

[Paul Riddington]

Hello Wasif,

The KB at https://knowledge.broadcom.com/external/article/169002/in-a-policy-trace-what-does-the-late-tag.html explains it well.

Regards
Paul