Configuring a Proxy

The Core service, the .NET Web API behind the FSProtect-Core IIS site, can send its outbound HTTPS calls through a proxy. You set the proxy in C:\Forestall\FSProtect\core\Web.config. The Configuration Center forms have no proxy field.

What honours the proxy

Outbound connection	Honours the proxy?
Azure / Entra ID connections (token requests, Microsoft Graph, Azure Resource Management calls)	Yes, via the general proxy setting
Cloud Scanner (all providers: Entra ID, AWS, GCP, GitHub)	Yes, it uses the same proxy setting as Core automatically
Any other outbound call the Core process itself makes	Yes, the general proxy is also set as the process's default WebRequest proxy at Core startup
CyberArk AIM vault calls	Yes, but through a separate CyberArk-only proxy setting, not the general one
Online update check, AI provider calls, Jira, Splunk, mail (SMTP)	No. The proxy applies to the scanning modules only

The general proxy and the CyberArk proxy are two independent settings. Setting one does not change the other. CyberArk traffic has its own key so that you can route it differently.

Where it's configured

Both settings live in the <appSettings> section of C:\Forestall\FSProtect\core\Web.config:

<!-- Proxy (leave empty to disable) -->
<add key="ProxyAddress" value="" />
<!-- Set to true for proxies that require Windows Auth -->
<add key="ProxyUseDefaultCredentials" value="false" />
<!-- CyberArk Proxy (leave empty to disable) -->
<add key="CyberArkProxyAddress" value="" />
<!-- Set to true for proxies that require Windows Auth -->
<add key="CyberArkProxyUseDefaultCredentials" value="false" />

Set ProxyAddress (and, for CyberArk, CyberArkProxyAddress) to the proxy URL, for example:

<add key="ProxyAddress" value="http://proxy.corp.local:8080" />
<add key="ProxyUseDefaultCredentials" value="false" />

Leave ProxyAddress or CyberArkProxyAddress empty to disable that proxy. Those calls then go out directly.

Address format

Write the address as http://<host or IP>:<port>. The same format applies to CyberArkProxyAddress.

Value	Result
http://proxy.corp.local:8080	Correct: host name and port
http://10.10.1.20:3128	Correct: IP address and port
proxy.corp.local:8080	Works, because http:// is added automatically, but write the scheme explicitly
https://proxy.corp.local:8080	Wrong. Use http:// even though the traffic is HTTPS. The proxy tunnels HTTPS connections. A TLS connection to the proxy itself isn't supported
http://proxy.corp.local	Uses port 80. Add the port if your proxy listens on another one
http://user:[e-mail]:8080	Wrong. Credentials in the address are ignored. For an authenticating proxy, set ProxyUseDefaultCredentials to true (Windows authentication with the IIS application pool account)
http://proxy.corp.local:8080/proxy.pac	Wrong. PAC files and auto-detection aren't supported. Enter the proxy itself
http://proxy1:8080;http://proxy2:8080	Wrong. Only one proxy address is supported

The value is read when the Core site starts. An address that isn't a valid URL (for example with spaces, quotes or a missing host) can stop the Core site from starting. After iisreset, open the Health Check page and confirm that Core shows Running.

Only FSProtect.WebAPI\Web.config (the Core site) has these keys. The Django API's .env and the frontend's config.js have no proxy setting of their own.

After editing Web.config, run iisreset in an elevated prompt for the change to take effect.

The CyberArk proxy

CyberArk AIM calls, which fetch a domain account's password from the vault, use CyberArkProxyAddress and CyberArkProxyUseDefaultCredentials instead of the general proxy. You can send vault traffic through a different proxy, or through none, regardless of the general setting. See CyberArk.

Verification and limits

• Authentication: the proxy can take no credentials (an anonymous or allow-listed proxy) or Windows Integrated Authentication with the IIS application pool identity (UseDefaultCredentials = true). You cannot enter a proxy username and password.

• Bypass list: local addresses always bypass the proxy (BypassOnLocal = true). You cannot configure any other bypass list.

• TLS-inspecting proxies / custom CA: The proxy path has no custom CA or certificate-pinning handling. If your proxy inspects TLS with a private CA, add that CA to the Windows certificate store on the server. Contact Forestall support if calls still fail.

• To verify: restart the Core site and run a cloud scan, for example an Azure scan. Check the scan logs, or look for the expected outbound host in your proxy's access logs. With a wrong or unreachable ProxyAddress, those calls fail while local features keep working.