Bypassing the Cato Cloud

This article discusses how to configure a site to bypass the Cato Cloud and egress traffic directly to the Internet.

Bypassing the Cato Cloud

The Bypass screen lets you define bypass rules for traffic that will directly egress to the Internet instead of being routed to the Cato Cloud. Bypassed traffic is not inspected by the Cato Cloud security stack.

By default, the Socket automatically chooses the WAN port for the bypass traffic based on performance metrics. The Socket can select different WAN ports for different flows.

Preferred Socket Port

You can choose to assign a preferred Socket WAN port for a bypass rule that is used to egress the traffic. With this option, the Socket will use the preferred WAN port for the bypass traffic, as long the port has Internet connectivity. If the preferred WAN port loses connectivity, then the Socket selects a different WAN port for the traffic.

The Preferred Socket Port feature is supported from Socket v15.0 and higher.

Note

Note: Bypassing Internet traffic is only supported for Socket and vSocket sites.

To define a bypass rule:

From the navigation menu, click Network > Sites and select the site.
From the navigation menu, click Site Settings > Bypass.
For the Destination or Source rule, click New. The New Interface panel opens.
Configure the settings for the bypass rule:
- The Name of the new bypass rule
- The IP range or IP addresses for the rules
- (Optional) The traffic protocols that are bypassed: TCP, UDP, ICMP or None (all protocols are allowed)
(Optional) In Preferred Socket Port, select the WAN port that egresses traffic directly to the Internet.
Click Save.

To delete a bypass entry:

From the navigation menu, click Network > Sites and select the site.
From the navigation menu, click Site Settings > Bypass.
Click the Delete icon next to the bypass rule you wish to delete. The rule is removed.
Click Save. The rule is deleted.

Cato Networks Knowledge Base

Bypassing the Cato Cloud