We discovered that version 5.2 and later of the Symantec Web Gateway software does not work in Span/Tap mode if the incoming packets contain VLAN tags. This was something we found out when we upgraded our main corporate 8490 from 5.1 to 5.2 and no longer were able to see web traffic. We opened a case with Symantec technical support at the time, and they were able to escalate to development to confirm that the SWG does not support VLAN tags when connected in span/tap mode. The resolution for that to get it working again was to downgrade it back to version 5.1 which is where it remains today along with the majority of our SWG infrastructure.
We’ve been working with our network operations group to try and get the VLAN tags removed from the span port feeding our main corporate SWG here in Des Moines, but unfortunately that is not currently possible with the network gear we’re using. I’d like to put in a feature request to have VLAN tag support introduced in the next software version. We are currently unable to upgrade our SWG’s to the latest software version due to this limitation.
I am aware that VLAN tags are supported in Inline Mode, but that is not something we are prepared to do at this time.