ETP Client statuses on desktop computers and machines

After the desktop client is distributed to corporate machines, users are protected by SIA. An end user can access the ETP Client on their machine. This example of the ETP Client shows how the client appears when end users access it as an application.

IMAGE_STUB

📘
These statuses apply to ETP Client. If you are using Threat Protection in the Zero Trust Client, different statuses apply. For more information, see Zero Trust Client documentation.

Depending on the connection, end users see one of these statuses:

Your device is protected. Indicates that DNS requests are monitored and protected as a result of the SIA policy settings. The end user's machine may be on or off the corporate network. However, if the end user's machine is off the corporate network, the Off Network Client policy applies.

If the full web proxy setting is enabled, this status also means that web traffic is protected by ETP Client. In this case, you or an administrator configured ETP Client as the local web proxy on the end user’s machine or you enabled transparent traffic interception. If transparent traffic interception is enabled, the status indicates that transparent mode is active. Whether ETP Client acts as a local web proxy or a transparent proxy, ETP Client forwards traffic to SIA Proxy for malware scanning. For more information, see ETP Client for web traffic.

Depending on your configuration, ETP Client may show what type of traffic is protected by the client. If your enterprise includes a local proxy or a local DNS server, the client may also specify what type of traffic is protected by the local network. In addition to the “Your device is protected” status, one of these statuses appear:
- DNS traffic is protected by ETP Client. Web traffic is protected by local network. Indicates that ETP Client forwards DNS traffic to SIA. It also forwards web traffic to the enterprise (on-premises) proxy. ETP Client detected that the on-premises proxy is chained to SIA Proxy. In this scenario, SIA Proxy and the forward proxy setting is enabled in a policy. For more information, see ETP Client for web traffic.
- DNS traffic is protected by ETP Client. Indicates that ETP Client forwards DNS traffic to SIA. If you or an administrator enabled SIA Proxy to scan only risky web traffic, the client forwards this traffic to the proxy. In this scenario, the forward proxy setting is not enabled in a policy. For more information, see ETP Client for DNS only.
- DNS traffic is protected by local network. This status appears if ETP Client cannot send requests to SIA because outbound UDP port 53 is blocked in your firewall. This means the end user’s machine is protected only when it’s on the corporate network with a DNS resolver that’s configured to forward DNS requests to SIA. In this case, the local DNS server handles requests.
  
  If you or an administrator enabled SIA Proxy, ETP Client directs traffic to an on-premises proxy. The on-premises proxy forwards this traffic to SIA Proxy. In this scenario, the forward proxy setting is not enabled in a policy.

📘
If DoT is enabled for ETP Client, the client shows a locked padlock icon to indicate that traffic is private and encrypted with TLS. For more information, see DNS over TLS.

Your device is NOT protected. Indicates that ETP Client is disabled or disconnected, or that the connection is interrupted. The client cannot reach Akamai infrastructure, including SIA configuration, SIA DNS, or SIA Proxy. In this situation, ETP Client intercepts DNS traffic and uses a local DNS resolver to resolve DNS requests. This status may also appear temporarily while ETP Client authenticates and connects with SIA.

If there is an on-premises proxy in the corporate network, this status indicates that the on-premises proxy does not forward web traffic to SIA Proxy.

An application icon is available for ETP Client on the end user’s Windows desktop toolbar or Mac menu bar. If ETP Client is not protected, this icon appears:

If the proxy is enabled, you can enforce a walled garden configuration that’s applied when ETP Client is in an unprotected state. This policy configuration allows you to block all traffic except for the domains and IP addresses that are configured as exceptions in the Local Bypass Settings. For instructions on configuring exceptions and walled garden, see Configure walled garden exceptions and Enable walled garden.

📘
If your organization uses Windows Server 2012 as a local DNS resolver and all requests are directed to the local DNS resolver before they are directed to SIA, ETP Client shows the “Your device is NOT protected” status. In this situation, Window Server 2012 is not supported with the client.