KB Article | Forcepoint Support

Notes & Warnings

Errors may also appear if the HWSconfig.xml file is missing from the installation directory. Ensure the file exists.

Problem Description

How do I determine if the endpoint client is using the Hybrid or Hosted (Cloud Web) PAC file?

If web endpoint client is using the wrong PAC file, then you may receive one of the following error messages:
  • "You are not authorized to use Hybrid"
  • A Web Defence error authentication message.


There are two PAC files types
  • Hybrid: If you have an on-premises V-Series appliance and filter off site users with Cloud services, then you should use the Hybrid PAC file.
  • Hosted (Cloud Web): If you filter off site users with Cloud services and DO NOT use an on-premises V-Series appliance, then you should use the Hosted (Cloud Web) PAC file.

The information for the PAC file URL for the endpoint is found as follows:
  • Hybrid:  A "customer unique tag" is displayed in the TRITON console. Select Settings > Hybrid Configuration > Hybrid User Identification > Web Endpoint > Deployment Method > Deploy Web Endpoint Manually. This tag should have been populated to the HWSconfig.xml file during endpoint client deployment. If not listed, then you must edit the file to add the missing customer unique tag. The HWSconfig.xml file is located in the endpoint installer folder. A tag example follows:
  • Hosted (Cloud Web):  A "customer unique tag" is displayed in Cloud Security Portal. Select Web  > Settings > Endpoint > General > Deployment  Settings > GPO Code. This tag should have been populated in the installation batch file during endpoint client deployment. A tag example follows:
From the endpoint machine, you can run a packet capture to identify which PAC file type (Hosted or Hybrid) is in use. 
  • In a Hybrid packet capture, you see the hybrid-web.global.blackspider.com:8082 GET request (shown below). The hybrid-web sub-domain identifies the URL as a "Hybrid” PAC file. The GET request also displays the "customer unique tag." For example, the info listed after "GET /proxy.pcap?p=" as shown in the following image.
User-added image


  • In a Hosted (Cloud Web) packet capture, you see the webdefence.global.blackspider.com:8082 GET request (shown below). The webdefence sub-domain identifies the URL as a "Hosted (Cloud Web)” PAC file.
User-added image

wscontext; endpoint; pac; pcep;proxy connect endpoint; wireshark; Deploy Web Endpoint Manually; HWSconfig.xml; not authorized to use Hybrid; authentication

Article Feedback

Thank you for the feedback and comments.