Troubleshooting Edge SWG (ProxySG) forwarding host failed health checks.

Products

• ISG Proxy
• ProxySG Software - SGOS

Issue/Introduction

Forwarding host has been added on the Edge SWG (ProxySG) and health check shows failed state. 

A forwarding host health check is a TCP handshake test (SYN, SYN/ACK, ACK) between the Edge SWG (ProxySG) and the target forwarding host.

For Forwarding host health checks, the proxy attempts to establish a TCP connection to verify that the upstream service is reachable and responding. In a packet capture, this appears as traffic originating from the Proxy's IP addressed to the Forwarding Server's IP.

What to Look For

TCP Handshake: You should see a standard three-way handshake.

• • SYN from Proxy to Forwarding Host.
  • SYN/ACK from Forwarding Host to Proxy.
  • ACK from Proxy to Forwarding Host.

Resolution

To isolate health check traffic for a specific forwarding host, use the following filter syntax (Replace x.x.x.x with the Forwarding Server's IP address.):

host x.x.x.x

To capture this traffic specifically while troubleshooting:

1. Navigate to Administration > Service Information > Packet Captures and apply the host filter.
2. Start the capture.
3. Navigate to Administration > Health Checks & Monitoring > Health Checks.
4. Locate the specific forwarding host and click the Perform Health Check icon in the Action column.
5. Stop and download the capture for analysis.

In the packet capture verify if you see completed TCP handshake (SYN, SYN/ACK, ACK). If not, verify the local firewall to make sure traffic is allowed and nothing else is blocking communication within local network. Alternatively verify that forwarding host is up and running, access list allows the communication from the proxy and the host is listening on the configured port.