FortiGate sends an HTTP request every 5 seconds to the configured monitor address of the parent proxy server. If FortiGate does not receive a response from the parent proxy within 20 seconds, the proxy server state flag is marked as down.
Until the state flag changes to down, FortiGate continues forwarding user traffic to the parent proxy. Once the state flag is down, FortiGate handles traffic according to the configured server-down-option or group-down-option.
The server-down-option can be configured under:
config web-proxy forward-server
edit "<forward_proxy>"
set healthcheck enable
set monitor www.fortinet.com
set server-down-option block/pass
next
end
block: Block sessions until the server is back up.
pass: Pass sessions to their destination, bypassing the forward server.
This option does not take effect until the proxy server state flag is down. As a result, FortiGate continues sending traffic to the parent proxy for 20 seconds before applying the configured action.
The group-down-option can be configured under:
config web-proxy forward-server-group
edit "<forward_proxy_group>"
set group-down-option block/pass
next
end
This option also takes effect only after the proxy server state flag goes down. As a result, FortiGate continues forwarding traffic to the parent proxy for 20 seconds before applying the configured action.
Use the following CLI commands to troubleshoot and verify the Forward Proxy health check status:
diagnose test application wad 2200
diagnose debug enable
diagnose test application wad 103
Example output:
FortiGate # diagnose test application wad 103
Web proxy forwarding server for vd=root n_svrs_in_mem=1
[001] name=lab304-forward-proxy(0x7f7af9511048) addr=ipv4/10.104.11.100:8080 state=down health_check=enable down-opt=bypass
ref_cnt= 2
stats_conn: fail=0 active=0
stats_get_svr: forward=0 bypass=0 block=0
stats_get_ip: forward=0 bypass=0 block=0
Web proxy forwarding server group for vd=root n_grps_in_mem=1
[001] name=lab-forward-group lb-alg=weight n_servers=1 affinity=disable down-opt=block
weight=(total:0 gen:13 cur:0) ref_cnt=2
stats_get_svr: forward=0 bypass=0 block=0
name=lab304-forward-proxy hits=0 status=down weight=10 gen:0 cur:0 n_conns=0
In the output above, verify the state or status field to determine whether the parent proxy is marked as up or down.
Notes:
group-down-option overrides the server-down-option. Since FortiOS v7.4.8, FortiGate considers the parent proxy server as up as long as it receives any HTTP response from the parent proxy. FortiGate only verifies whether the parent proxy is reachable and responsive. It does not validate the HTTP status code returned by the server.
| 
