Recent Discussions
Seamless SSO with External vs. Embedded Browser – Conditional Access & Compliance Issues
Hi Community, I'm currently testing Seamless SSO with Cato and ran into an issue that I’d appreciate some input on. When using an external browser for authentication, Conditional Access (CA) policies work as expected, and compliant devices are recognized. However, when trying to authenticate via the embedded browser, the device fails to report compliance, which leads to failed Conditional Access checks. My questions are: Is Seamless SSO currently supported when using the external browser flow with full Conditional Access and device compliance evaluation? Is there any official support or workaround for enabling embedded browser authentication with Conditional Access and device compliance checks? For example, is there any roadmap item or setting that might allow the embedded browser to pass device compliance state? I’ve reviewed the official SSO guide, but it doesn’t address this specific scenario. Thanks in advance for any insights or guidance!
Cato Connect Event: AMA with Professional Services
Ever wish you could get direct time with the experts? On June 3rd, 2025 at 11:00 AM EDT, you’ll get just that — a live AMA with two of our Principal Consultants from the Cato Professional Services team. We’ll cover topics like: Designing and implementing a CMA deployment Best practices we’ve seen across real-world environments Your questions — seriously, bring them Here’s how to get the most out of it: Click here to register and get the calendar invite and join us live Post your questions below in the comments — we’ll answer pre-submitted ones first, before tackling live chat during the session + See a question you like? Give it a “like” to help it rise to the top Note: We won’t be able to look at specific CMA instances — demos will be done using internal environments. That’s it — register, post your questions, and we’ll see you there! Presenters: Principal Consultant Professional Services, Italy Principal Consultant Professional Services, USA If you run into any issues, @mention me or email us at community@catonetworks.comPolicy Rule Not Hitting When Destination is Set to 'Any' – Expected Behavior?
Hi all, I ran into a situation with a security policy in Cato and would like to hear if anyone else has experienced something similar. Here is the scenario: I created a policy where the source site is set to "Site A", the destination is set to "Any", and the application is defined as a specific IP address, for example 192.168.1.1. In this setup, the rule does not match and traffic is not allowed as expected. However, when I change the destination from "Any" to the specific site where 192.168.1.1 is located, the rule starts working correctly and the traffic is matched. My questions: Is this expected behavior in Cato? Does using "Any" as the destination somehow prevent matching traffic to a specific internal IP? Is there something else I might be missing? Appreciate any insights or experiences. Thanks!
CATO always on
Hi, I am currently deploying Cato across my entire organization, transitioning from Fortinet’s VPN platform to Cato’s ZTNA. We are enabling Always On to enforce the use of Cato for all users. However, this feature requires an initial login from the user. How can I force an end user (who does not use any sensitive company services but still needs enforcement as part of ZTNA) to complete the initial login to the Cato Client? Since we are rolling this out company-wide, I do not want to enforce it for all users, but rather for a specific group. Is there an option to do that? Thanks!
Updating resource group names
I have noticed that if I go to Resources > Groups and change a group's name, that changed group name does not reflect in any firewall rules that reference that group. For instance, I create a group named group_1. I create an Internet Firewall rule with group_1 as the source. If I go back to and change the name of the group to group_one, the group name group_1 is still listed as the source in the Internet Firewall rule (it seems like it should update to group_one when he group's name is changed). If I change a group name that is referenced in a firewall rule, do I need to manually update the group reference in the firewall rule? If not, how long does it usually take for a firewall rule to update it's group name if the group name changes?
Cato SDP Client to be auto intelligent to login instead of manual logging
I have recently migrated from Netskope to Cato Networks. One issue we have noticed is that users need to login once to Cato SDP client and then "Always-on policy" gets enabled. But users are smart, they don't login to SDP client itself as many sites gets blocked as per policy which they don't want so they don't login once also to SDP client thus making us non-compliant as absence of SDP client makes them vulnerable as they can browse malicious sites as well as can upload company data on public sites which typically gets blocked when connected over SDP client. In Netskope, we just had to push agents to the laptop and no user intervention was required, it automatically detects logged in user credentials so there was no scope for user to not login or bypass security controls. Can't we make zero touch experience for user so that there is no room for escape or delay as now we are totally dependent on user.
