Symptom

When Cloud Web Security and NAT Virtual Interface are configured on the same box, CWS fails to load web traffic on a client that is subjected to redirection to CWS.

Conditions

CWS and NVI (NAT Virtual Interface) NAT need to be configured together on the ISR.

Workaround

Use legacy NAT to identify the NAT inside and outside interface in VRF-Lite setups where only one interface is in a VRF and another interface is in global

Further Problem Description