| Solution |
A FortiProxy VM running on AWS queries an API to retrieve AWS Inspector information using a public IP address when loading the dynamic address on the GUI. The root cause of the delay is the failure of the API query due to AWS Inspector being unreachable through the Internet or timing out.
awsd & httpsd debug:
2025-09-17 14:41:02 [httpsd 1370 - 1758087662 info] fweb_debug_init[455] -- New GET request for "/api/v2/monitor/firewall/address-dynamic" from "<FPX public IP>:49995"
2025-09-17 14:41:02 [httpsd 1370 - 1758087662 info] fweb_debug_init[457] -- User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
2025-09-17 14:41:02 [httpsd 1370 - 1758087662 info] fweb_debug_init[459] -- Handler "api_monitor_v2-handler" assigned to request
2025-09-17 14:41:02 [httpsd 1370 - 1758087662 info] api_store_parameter[332] -- add API parameter 'mkey' (type=string)
2025-09-17 14:41:02 [httpsd 1370 - 1758087662 info] api_store_parameter[332] -- add API parameter 'vdom' (type=string)
2025-09-17 14:41:02 [httpsd 1370 - 1758087662 info] endpoint_process_req_vdom[1024] -- new API request (action='select',path='firewall',name='address-dynamic',vdom='root',user='admin')
2025-09-17 14:41:02 [httpsd 1370 - 1758087662 info] endpoint_process_req_vdom[1030] -- completed API request (rss_pre=42104, rss_post=42104, rss_delta=0)
2025-09-17 14:41:02 [httpsd 1370 - 1758087662 info] fweb_debug_final[319] -- Completed GET request for "/api/v2/monitor/firewall/address-dynamic" (HTTP 200)
..skip..
2025-09-17 14:41:07 curl DNS lookup failed: inspector.us-east-1.amazonaws.com
2025-09-17 14:41:07 aws get host failed
2025-09-17 14:41:07 [httpsd 1366 - 1758087667 error] build_aws_inspector_findings[154] -- build_aws_inspector_findings: Failed to call AWS inspector listFindings
2025-09-17 14:41:07 [httpsd 1366 - 1758087667 warning] api_return_http_result[1304] -- API error 6 raised
2025-09-17 14:41:07 [httpsd 1366 - 1758087667 info] endpoint_process_req_vdom[1030] -- completed API request (rss_pre=38156, rss_post=42120, rss_delta=3964)
2025-09-17 14:41:07 [httpsd 1366 - 1758087667 debug] fpx_monitor_endReq[52] -- FPX API Request: aws.inspector.(null) [500 - 83]
2025-09-17 14:41:07 [httpsd 1366 - 1758087667 info] fweb_debug_final[319] -- Completed GET request for "/api/v2/monitor/aws/inspector" (HTTP 500)
..skip..
2025-09-17 14:41:07 [httpsd 1344 - 1758087667 info] fweb_debug_init[455] -- New GET request for "/api/v2/monitor/aws/inspector" from "<FPX public IP>:49995"
2025-09-17 14:41:07 [httpsd 1344 - 1758087667 info] fweb_debug_init[457] -- User-Agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
2025-09-17 14:41:07 [httpsd 1344 - 1758087667 info] fweb_debug_init[459] -- Handler "api_monitor_v2-handler" assigned to request
2025-09-17 14:41:07 [httpsd 1344 - 1758087667 info] api_store_parameter[332] -- add API parameter 'vdom' (type=string)
2025-09-17 14:41:07 [httpsd 1344 - 1758087667 info] endpoint_process_req_vdom[1024] -- new API request (action='select',path='aws',name='inspector',vdom='root',user='admin')
2025-09-17 14:41:07 awsd get iam role fortigate-full-ted
2025-09-17 14:41:07 awsd get instance id i-<FPX Instance ID>
2025-09-17 14:41:07 awsd get region us-east-1
2025-09-17 14:41:07 awsd get vpc id vpc-<VPC ID>
..skip..
2025-09-17 14:41:37 [httpsd 1344 - 1758087697 debug] TimeoutHandler[18] -- FPX API Request: aws.inspector.(null)
2025-09-17 14:41:37 [httpsd 1344 - 1758087697 debug] TimeoutHandler[32] -- /bin/httpsd() [0x83535f]
/usr/lib/x86_64-linux-gnu/libc.so.6(+0x38e90) [0x7f1306086e90]
/usr/lib/x86_64-linux-gnu/libc.so.6(__recv+0x1c) [0x7f1306148f5c]
/bin/httpsd() [0x1c1020a]
/bin/httpsd() [0x1507712]
/bin/httpsd() [0x4cf3c4]
/bin/httpsd() [0x4d0ab0]
/bin/httpsd() [0x4d0b6b]
/bin/httpsd() [0x804b32]
/bin/httpsd() [0x7c0244]
/bin/httpsd() [0x7c0899]
/bin/httpsd() [0x7c29d2]
/bin/httpsd() [0x7c4429]
/bin/httpsd() [0x76bf69]
/bin/httpsd(ap_run_handler+0x4a) [0x93a4ea]
/bin/httpsd(ap_invoke_handler+0xc6) [0x93ad46]
/bin/httpsd() [0x982b89]
/bin/httpsd(ap_process_request+0x21) [0x982dd1]
/bin/httpsd() [0x97aeff]
/bin/httpsd(ap_run_process_connection+0x4a) [0x93ed4a]
/bin/httpsd() [0x954977]
/bin/httpsd() [0x954c46]
/bin/httpsd() [0x954e34]
/bin/httpsd() [0x95546d]
/bin/httpsd(ap_run_mpm+0x61) [0x9506f1]
/bin/httpsd() [0x950226]
/bin/httpsd() [0x44e70f]
/bin/httpsd() [0x454618]
/bin/httpsd() [0x454c3b]
/bin/httpsd() [0x4575bf]
/bin/httpsd() [0x457fae]
/usr/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0xeb) [0x7f1306071deb]
/bin/httpsd() [0x449bda]
This delay issue appears in the following scenarios:
- Policy & Objects -> Addresses (AWS).
- Policy & Objects -> Addresses (JSON API Connector).
- Policy & Objects -> Addresses -> Dynamic Address (AWS) -> View Matched Addresses.
- Policy & Objects -> Addresses -> Dynamic Address (JSON API Connector) -> View Matched Addresses.
- Policy & Objects -> Policy -> Dynamic Address (AWS) -> View Matched Addresses.
- Policy & Objects -> Policy -> Dynamic Address (JSON API Connector) -> View Matched Addresses.
To resolve the delay issue, follow these steps:
- Upgrade to v7.4.11 or later, or v7.6.
- Make the AWS Inspector endpoint (inspector.<region>.amazonaws.com) reachable as a workaround.
Note:
This issue is specific to FortiProxy v7.4. In FortiProxy v7.6 and FortiOS v7.4 v7.6, even if the AWS Inspector API query is unreachable, the delay does not occur.
|
