> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/introduction/maintenance/proxy.md).

# Configuring a Proxy

The Core service, the .NET Web API behind the **FSProtect-Core** IIS site, can send its outbound HTTPS calls through a proxy. You set the proxy in `C:\Forestall\FSProtect\core\Web.config`. The Configuration Center forms have no proxy field.

## What honours the proxy

| Outbound connection                                                                             | Honours the proxy?                                                                             |
| ----------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------- |
| Azure / Entra ID connections (token requests, Microsoft Graph, Azure Resource Management calls) | Yes, via the general proxy setting                                                             |
| Cloud Scanner (all providers: Entra ID, AWS, GCP, GitHub)                                       | Yes, it uses the same proxy setting as Core automatically                                      |
| Any other outbound call the Core process itself makes                                           | Yes, the general proxy is also set as the process's default `WebRequest` proxy at Core startup |
| CyberArk AIM vault calls                                                                        | Yes, but through a **separate** CyberArk-only proxy setting, not the general one               |
| Online update check, AI provider calls, Jira, Splunk, mail (SMTP)                               | No. The proxy applies to the scanning modules only                                             |

{% hint style="warning" %}
The general proxy and the CyberArk proxy are two independent settings. Setting one does not change the other. CyberArk traffic has its own key so that you can route it differently.
{% endhint %}

## Where it's configured

Both settings live in the `<appSettings>` section of `C:\Forestall\FSProtect\core\Web.config`:

```xml
<!-- Proxy (leave empty to disable) -->
<add key="ProxyAddress" value="" />
<!-- Set to true for proxies that require Windows Auth -->
<add key="ProxyUseDefaultCredentials" value="false" />
<!-- CyberArk Proxy (leave empty to disable) -->
<add key="CyberArkProxyAddress" value="" />
<!-- Set to true for proxies that require Windows Auth -->
<add key="CyberArkProxyUseDefaultCredentials" value="false" />
```

Set `ProxyAddress` (and, for CyberArk, `CyberArkProxyAddress`) to the proxy URL, for example:

```xml
<add key="ProxyAddress" value="http://proxy.corp.local:8080" />
<add key="ProxyUseDefaultCredentials" value="false" />
```

Leave `ProxyAddress` or `CyberArkProxyAddress` empty to disable that proxy. Those calls then go out directly.

### Address format

Write the address as `http://<host or IP>:<port>`. The same format applies to `CyberArkProxyAddress`.

| Value                                        | Result                                                                                                                                                                                    |
| -------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `http://proxy.corp.local:8080`               | Correct: host name and port                                                                                                                                                               |
| `http://10.10.1.20:3128`                     | Correct: IP address and port                                                                                                                                                              |
| `proxy.corp.local:8080`                      | Works, because `http://` is added automatically, but write the scheme explicitly                                                                                                          |
| `https://proxy.corp.local:8080`              | **Wrong.** Use `http://` even though the traffic is HTTPS. The proxy tunnels HTTPS connections. A TLS connection to the proxy itself isn't supported                                      |
| `http://proxy.corp.local`                    | Uses port 80. Add the port if your proxy listens on another one                                                                                                                           |
| `http://user:password@proxy.corp.local:8080` | **Wrong.** Credentials in the address are ignored. For an authenticating proxy, set `ProxyUseDefaultCredentials` to `true` (Windows authentication with the IIS application pool account) |
| `http://proxy.corp.local:8080/proxy.pac`     | **Wrong.** PAC files and auto-detection aren't supported. Enter the proxy itself                                                                                                          |
| `http://proxy1:8080;http://proxy2:8080`      | **Wrong.** Only one proxy address is supported                                                                                                                                            |

{% hint style="warning" %}
The value is read when the Core site starts. An address that isn't a valid URL (for example with spaces, quotes or a missing host) can stop the Core site from starting. After `iisreset`, open the [Health Check](/forestall/health-check.md) page and confirm that **Core** shows **Running**.
{% endhint %}

{% hint style="info" %}
Only `FSProtect.WebAPI\Web.config` (the Core site) has these keys. The Django API's `.env` and the frontend's `config.js` have no proxy setting of their own.
{% endhint %}

After editing `Web.config`, run `iisreset` in an elevated prompt for the change to take effect.

## The CyberArk proxy

CyberArk AIM calls, which fetch a domain account's password from the vault, use `CyberArkProxyAddress` and `CyberArkProxyUseDefaultCredentials` instead of the general proxy. You can send vault traffic through a different proxy, or through none, regardless of the general setting. See [CyberArk](/forestall/configuration-center/cyberark.md).

## Verification and limits

* **Authentication**: the proxy can take no credentials (an anonymous or allow-listed proxy) or Windows Integrated Authentication with the IIS application pool identity (`UseDefaultCredentials = true`). You cannot enter a proxy username and password.
* **Bypass list**: local addresses always bypass the proxy (`BypassOnLocal = true`). You cannot configure any other bypass list.
* **TLS-inspecting proxies / custom CA**: The proxy path has no custom CA or certificate-pinning handling. If your proxy inspects TLS with a private CA, add that CA to the Windows certificate store on the server. Contact Forestall support if calls still fail.
* **To verify**: restart the Core site and run a cloud scan, for example an Azure scan. Check the scan logs, or look for the expected outbound host in your proxy's access logs. With a wrong or unreachable `ProxyAddress`, those calls fail while local features keep working.