FortiDAST Proxy Troubleshooting FAQs

My internal target is up, but Authorization is still failing. What could be the issue?

Check if the Proxy Icon on the Scans Overview page is red. This indicates the proxy tunnel is not up. Bring up the proxy server container and try to authorize again once the proxy icon turns green. If the proxy is up but authorization still fails, make sure to whitelist the FortiDAST IP (35.222.40.56) in your firewall if you have any geo-restrictions enabled.

FortiDAST Proxy shows up in the UI, but my scan is failing. What could be the issue?

Ensure the target application is reachable from the FortiDAST proxy server Docker container. Check if you can curl the target URL from the proxy server Docker instance and receive a 200 OK response. If curl fails, check if HTTP/HTTPS communication is allowed between the proxy server Docker container and the target server.

docker exec -it <containerid> /bin/sh

curl -v <targeturl>

My FortiDAST Proxy server container is not coming up. What could be the issue?

Check the Docker logs of the container:

docker logs <containerid>

One reason could be if you are using an older version of the YAML file and have generated a new privileged API key in DAST settings. In that case, you will see a key not matching error similar to:

Connection failed: {"Status":"Unauthorized access - key not matching"}

Download the new YAML file again from the DAST Proxy section in the scan configuration page. Another reason could be an issue with the proxy server Docker image or a version mismatch. Pull the latest image from the FortiDAST registry: registry.fortidast.forticloud.com.

My FortiDAST Proxy and targets are up, but I am seeing "Internal error encountered during scan. Please check logs or contact tech support."

Check if your target application can handle multiple concurrent requests from FortiDAST. If any rate limits are configured in your WAF/firewall, it can lead to such failures. Whitelist the FortiDAST IP in your WAF/firewall.

You can perform a small test using the Apache HTTP server benchmarking tool (https://httpd.apache.org/docs/2.4/programs/ab.html) on your target application to see if any failures occur.

ab -n 1000 -c 100 http://<targeturl>

This sends 1000 requests to the target URL with 100 concurrent requests. If you see any failures, check your WAF/firewall logs to determine if any rate limits are configured and if the FortiDAST IP is whitelisted.

My FortiDAST Proxy scan was running fine but aborted with the error "Proxy server no longer running, Terminating scan."

This can happen due to an issue with the proxy server not responding or network connectivity issues between the FortiDAST cloud and the proxy server, which can lead to the tunnel going down. Check for any network connectivity issues on your proxy server machine or any issues with the DAST Proxy Docker container.