https://community.dynatrace.com/t5/Troubleshooting/Firewall-Constraints-and-allowlisting-for-Synthetic-Monitoring/ta-p/213876 <H2>Summary</H2> <DIV> <DIV class="paragraph-in-scc-markdown-text ___1ngh792 ftgm304 f1iaxwol">Dynatrace Synthetic Monitoring may require additional firewall, proxy, and allowlisting configuration to ensure Browser Monitors and HTTP Monitors can successfully access your applications and return results to Dynatrace.</DIV> <DIV class="paragraph-in-scc-markdown-text ___1ngh792 ftgm304 f1iaxwol">Because Browser Monitors use the same data-ingestion technology as Real User Monitoring (RUM), you should also review and implement the RUM firewall requirements described <A class="fui-Link fai-bebop ___1v1lyro f2hkw1w f3rmtva f1ewtqcl f16muhyy f1k6fduh f1w7gpdv f1mo0ibp fjoy568 ff5ikls f1s184ao f1mk8lai fnbmjn9 f1o700av f13mvf36 f33ey8m f9n3di6 f1ids18y f1tx3yz7 feiuef2 f1eh06m1 f54796x fhgqx19 f1olyrje f1p93eir f1nev41a f132whgj f1v74mp6 f1tsf1ni fnq52rx f16zlvvm" tabindex="0" href="https://docs.dynatrace.com/docs/observe/digital-experience/web-applications/initial-setup/firewall-constraints-for-rum" rel="noopener noreferrer" data-tabster="{&quot;restorer&quot;:{&quot;type&quot;:1}}" target="_blank">here</A>.</DIV> <DIV class="paragraph-in-scc-markdown-text ___1ngh792 ftgm304 f1iaxwol">This article focuses on the additional network, connectivity, and allowlisting requirements specific to Synthetic Monitoring and provides troubleshooting guidance for common connectivity-related issues.</DIV> <DIV class="paragraph-in-scc-markdown-text ___1ngh792 ftgm304 f1iaxwol">&nbsp;</DIV> <DIV class="paragraph-in-scc-markdown-text ___1ngh792 ftgm304 f1iaxwol"><STRONG>Use this guide if your Browser Monitor or HTTP Monitor:</STRONG></DIV> <UL> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">Times out or fails to connect to the target application</LI> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">Returns connection refused or other network-related errors</LI> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">Fails authentication unexpectedly</LI> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">Works when tested manually but fails in Synthetic Monitoring</LI> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">Runs successfully but doesn't report results back to Dynatrace</LI> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">Fails only from specific public or private Synthetic locations</LI> </UL> <DIV class="paragraph-in-scc-markdown-text ___1ngh792 ftgm304 f1iaxwol">Common causes include:</DIV> <UL> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">Firewall restrictions</LI> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">Missing IP allowlisting</LI> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">User-Agent filtering</LI> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">Proxy configuration issues</LI> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">DNS resolution problems</LI> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">Network routing or outbound connectivity limitations</LI> <LI class="___ccc16d0 fje8fi8 f1ng9h0j f1bwykku f18jd3zf">ActiveGate connectivity or communication issues</LI> </UL> </DIV> <P><LI-WRAPPER></LI-WRAPPER></P> <P>&nbsp;</P> <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="5"></LI-TOC></P> <P>&nbsp;</P> <H2>Issues</H2> <P>&nbsp;</P> <H3>Synthetic monitors fail to reach an application</H3> <H4>&nbsp;</H4> <H4>Synthetic Monitor executes from a public location but fails to connect to an application</H4> <P>An affected synthetic monitor may show different failures, such as request timeouts, authentication failures, connection refusals, etc. The key is that the monitor is <U>permanently failing with the same outage.</U></P> <P>&nbsp;</P> <P>What can you do?<BR />Confirm the following with the relevant Application team:</P> <OL> <LI>Should the application be available outside your network?</LI> <LI>If so, are there any limitations?</LI> </OL> <P>We recommend allowing our traffic by either <A href="https://community.dynatrace.com/t5/Troubleshooting/Firewall-Constraints-and-allowlisting-for-Synthetic-Monitoring/ta-p/213876#toc-hId--582390901" target="_self">allowing access by User Agent string or IP address</A>.&nbsp;</P> <P>&nbsp;</P> <H4>Synthetic Monitor executes from a private location but fails to connect to an application</H4> <P>In addition to the checks for public locations, here are some helpful tests you can try from your private location.&nbsp;</P> <H4>&nbsp;</H4> <H5>Troubleshoot using Curl</H5> <P>Use this command to confirm whether the connection issue relates to Dynatrace or the machine.&nbsp;</P> <PRE>curl -vki &lt;url you're testing&gt;</PRE> <P>Or if you're using a proxy:</P> <PRE>curl -vki -U proxyUser:proxyPassword -x proxy:proxyPort &lt;url you're testing&gt; </PRE> <P>If the site is redirected to another page, you also need to add -L to follow redirects. For example,&nbsp;</P> <PRE>curl -vki -L &lt;url you're testing&gt;</PRE> <P>&nbsp;</P> <P><STRONG>What can you do if the result of the command fails?</STRONG><BR />If the curl command fails, the issue lies in the connection between the machine and the application you're testing. Here's what you can do to fix it:</P> <OL> <LI>Update your proxy or allow the IP access.</LI> </OL> <P><STRONG>If the result of the command is successful</STRONG></P> <OL> <LI>Check if the Dynatrace User-Agent string affects the behavior <OL> <LI>For HTTP Monitors, add&nbsp;-H "User-Agent: DynatraceSynthetic/1.267.13.20230518-162314"&nbsp; <PRE>curl -vki &lt;url you're testing&gt; -H "User-Agent: DynatraceSynthetic/1.267.13.20230518-162314"​</PRE> </LI> <LI>For Browser Monitors, add&nbsp;-H "User-Agent: <SPAN>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 RuxitSynthetic/1.0 v0 t0 cfeatureHash=7efgijmoqtvx caes=1 ccux=1 sia=1 smf=1</SPAN><SPAN><SPAN>"&nbsp;</SPAN></SPAN> <PRE>curl -vki &lt;url you're testing&gt; -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 RuxitSynthetic/1.0 v0 t0 cfeatureHash=7efgijmoqtvx caes=1 ccux=1 sia=1 smf=1"</PRE> </LI> </OL> </LI> </OL> <P class="lia-indent-padding-left-30px"><STRONG><BR />What can you do if the command's result fails?</STRONG> You should <A href="https://community.dynatrace.com/t5/Troubleshooting/Firewall-Constraints-and-allowlisting-for-Synthetic-Monitoring/ta-p/213876#toc-hId--636531925" target="_self">allow/ allowlist our User-Agent string on your Application/ Firewall.&nbsp;</A></P> <P class="lia-indent-padding-left-30px">&nbsp;</P> <H5>Troubleshoot using PowerShell</H5> <P>If you're working on Windows, you may only have the option of PowerShell instead of curl. You can use Invoke-WebRequest.&nbsp;</P> <P>Without proxy:</P> <PRE>Invoke-WebRequest -Uri "&lt;url you're testing&gt;"</PRE> <P>With proxy:</P> <PRE>Invoke-WebRequest -Proxy "&lt;proxy-url&gt;:&lt;proxy-port&gt;" -ProxyUseDefaultCredentials -Uri "&lt;url you're testing&gt;"</PRE> <P>With redirects following and printing raw response:</P> <PRE>Invoke-WebRequest -MaximumRedirection 10 -Uri "&lt;url you're testing&gt;" | Select-Object -Expand RawContent</PRE> <P>&nbsp;</P> <P><STRONG>What can you do if the result of the command fails</STRONG><BR />If the curl command fails, the issue lies in the connection between the machine and the application you're testing. Here's what you can do to fix it:</P> <OL> <LI>Update your proxy or allow the IP access.</LI> </OL> <P><STRONG>If the result of the command is successful</STRONG></P> <OL> <LI>Check if it's the Dynatrace User-Agent string by adding that header to the Invoke-WebRequest command <UL> <LI>For HTTP Monitors, add&nbsp;-H "User-Agent: DynatraceSynthetic/1.267.13.20230518-162314" <PRE>Invoke-WebRequest -Uri "&lt;url you're testing&gt;" -Headers @{"User-Agent"="DynatraceSynthetic/1.267.13.20230518-162314"}​</PRE> </LI> <LI>For Browser Monitors, add&nbsp;-H "User-Agent: <SPAN>Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 RuxitSynthetic/1.0 v0 t0 cfeatureHash=7efgijmoqtvx caes=1 ccux=1 sia=1 smf=1</SPAN><SPAN><SPAN>"&nbsp;</SPAN></SPAN> <PRE>Invoke-WebRequest -Uri "&lt;url you're testing&gt;" -Headers @{"User-Agent"="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36 RuxitSynthetic/1.0 v0 t0 cfeatureHash=7efgijmoqtvx caes=1 ccux=1 sia=1 smf=1"}</PRE> </LI> </UL> </LI> </OL> <P>&nbsp;</P> <P class="lia-indent-padding-left-30px"><STRONG>What can you do if the command's result fails? </STRONG>You should allow/ allowlist our <A href="https://community.dynatrace.com/t5/Troubleshooting/Firewall-Constraints-and-allowlisting-for-Synthetic-Monitoring/ta-p/213876#toc-hId--636531925" target="_self">User-Agent string on your Application/ Firewall.&nbsp;</A></P> <P class="lia-indent-padding-left-30px">&nbsp;</P> <H5>Troubleshoot using a Browser on the Synthetic ActiveGate</H5> <P>If it has a GUI, you can test Browser Monitors from your Synthetic ActiveGate. This is usually&nbsp;the case for Windows ActiveGates, so I'll focus on those.&nbsp;</P> <OL> <LI>Open a Chrome Browser on your Synthetic ActiveGate and navigate to the URL you're testing. <OL> <LI>If you can't reach it, the problem is that the machine itself can't reach the URL.<BR />Allow/ allowlist the IP or update your proxy settings.</LI> </OL> </LI> <LI>If you can access Dynatrace from the ActiveGate, <A href="https://www.dynatrace.com/support/help/platform-modules/digital-experience/synthetic-monitoring/browser-monitors/configure-browser-monitors#recorded-clickpath" target="_self">playback</A> the monitor in the Browser. <OL> <LI>If it fails, it may be the User Agent string. As mentioned above, you can confirm this using curl or PowerShell.&nbsp;</LI> </OL> </LI> <LI>Open the Browser that the ActiveGate uses to execute the monitors. The default path is&nbsp;C:\Program Files\dynatrace\synthetic\Chrome-bin\chrome.exe. <OL> <LI>If this fails, compare the difference in version to the Chrome Browser installed on the machine.&nbsp;</LI> </OL> </LI> <LI>Sometimes, the service user who starts Chrome doesn't have enough permissions to reach the site. Please do the following to check if that is the case:&nbsp; <OL> <LI>On the Synthetic ActiveGate, download and unzip PsExec <A href="https://docs.microsoft.com/en-us/sysinternals/downloads/psexec" target="_blank" rel="noopener">https://docs.microsoft.com/en-us/sysinternals/downloads/psexec</A></LI> <LI>Open a command prompt as administrator (Start -&gt; cmd.exe -&gt; Run as administrator) and navigate to the folder you extracted PSExec</LI> <LI>To start Chromium impersonating the "Local Service" user, run PsExec with the following command:&nbsp; <PRE>PsExec.exe -i -u "NT Authority\LocalService" "C:\Program Files\dynatrace\synthetic\Chrome-bin\chrome.exe"​</PRE> <P>(If you installed the synthetic location in a non-standard path, you'll need to adapt the path to chrome.exe)</P> </LI> <LI>Then navigate to the URL you're testing.&nbsp;<SPAN>If this fails, you may wish to try setting up <A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/general-information/synthetic-authentication#http-bm" target="_self">Kerberos authentication for your browser monitor</A> or <A href="https://community.dynatrace.com/t5/Troubleshooting/Firewall-Constraints-and-allowlisting-for-Synthetic-Monitoring/ta-p/213876#toc-hId--512414842" target="_self">logging in to the Dynatrace Synthetic service as a domain user.</A></SPAN></LI> </OL> </LI> </OL> <P>&nbsp;</P> <H3><SPAN>Synthetic Monitor data is not returned to, or seen by, Dynatrace</SPAN></H3> <H4><STRONG>For SaaS tenants </STRONG></H4> <OL> <LI><SPAN>Confirm that the monitor is enabled.</SPAN></LI> <LI><SPAN>Confirm that there are no maintenance windows during the data gap. This can be confirmed on the browser<A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/analysis-and-alerting/synthetic-details-for-browser-monitors#synthetic-details-for-browser-monitors" target="_self">&nbsp;monitor details page</A> or the <A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/analysis-and-alerting/synthetic-details-for-http-monitors-classic#metric-visualizations" target="_self">HTTP Monitors details page.</A></SPAN></LI> <LI><SPAN>If it's on a private location</SPAN> <OL> <LI><SPAN>Check for <A href="https://community.dynatrace.com/t5/Troubleshooting/How-to-check-Synthetic-Monitor-Websocket-errors-in-logs/ta-p/211647" target="_self">WebSocket errors in the logs</A>.&nbsp;</SPAN></LI> <LI><SPAN>Confirm that no Antivirus or anti-malware applications are running. If there are, try disabling them and restarting the Dynatrace Synthetic/ VUC service. If this resolves the issue, modify the Antivirus or anti-malware application to allow Chromium and the Synthetic module to run without interference. You can find suggestions for rules <A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/private-synthetic-locations/system-and-hardware-requirements-for-private-synthetic#operating-system-requirements" target="_self">here.</A></SPAN></LI> </OL> </LI> </OL> <P><SPAN>If you can't find a cause, open a chat or create a ticket.&nbsp;</SPAN></P> <P>&nbsp;</P> <H4><STRONG>For Managed tenants</STRONG></H4> <OL> <LI><SPAN>Confirm that the monitor is enabled.</SPAN></LI> <LI><SPAN>Confirm that there are no maintenance windows during the data gap. This can be confirmed on the browser<A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/analysis-and-alerting/synthetic-details-for-browser-monitors#synthetic-details-for-browser-monitors" target="_self">&nbsp;monitor details page</A> or the <A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/analysis-and-alerting/synthetic-details-for-http-monitors-classic#metric-visualizations" target="_self">HTTP Monitors details page.</A></SPAN></LI> <LI> <P>Confirm that<SPAN>&nbsp;</SPAN><A href="https://docs.dynatrace.com/managed/managed-cluster/basic-concepts/managed-deployment-scenarios#scenario-4-globally-distributed-high-availability-with-automatic-recovery" target="_blank" rel="nofollow noopener noreferrer">the Cluster ActiveGate URL is publicly available</A>. It can be limited to access from&nbsp;public location IP addresses if necessary.</P> <OL> <LI><SPAN>select the Test connection to URL button under Settings/Public endpoints in the Cluster Management Console.<BR />This tests four types of public connectivity to the Cluster ActiveGate: Synthetic, internal and external users for RUM, and external OneAgent comms.<BR /><BR /><STRONG>If Synthetic fails, the Cluster ActiveGate is not publicly available, </STRONG>and you'll need to update your&nbsp;Firewall or Load balancer settings to allow access. You can ignore this if you have limited access to specific IPs.&nbsp;&nbsp;</SPAN></LI> </OL> </LI> <LI> <P>Confirm that the<SPAN>&nbsp;</SPAN><A href="https://community.dynatrace.com/t5/Dynatrace-tips/Public-endpoint-for-the-Cluster-ActiveGate/m-p/202652" target="_blank" rel="nofollow noopener noreferrer">Synthetic endpoints</A><SPAN>&nbsp;</SPAN>are all open<BR />beacon/[uuid]<BR />Synthetic health checks /beacon/synthetic/[uuid]<BR />HTTP Monitors /beacon/synthetic/httpresults[uuid]<BR />screenshots /beacon/synthetic/screenshot/[uuid]<BR />Browser Monitors /beacon/synthetic/browser/[uuid]<BR />Multiprotocol monitors /beacon/synthetic/multi-protocol/[uuid] <BR />Credentials /beacon/synthetic/credentials/[uuid]</P> </LI> <LI>Run a health check. This can be run from anywhere if you're not limiting access to specific IPs.&nbsp; <PRE>https://&lt;Cluster AG Public Url&gt;:&lt;port&gt;/beacon/synthetic/&lt;environment UUID&gt;?healthcheck&amp;tenantId=&lt;environment UUID&gt;</PRE> <P>&nbsp;</P> <P>and the response should be JSON file like this</P> <PRE>{"ts":1680601930205,"activeGateId":nnnn,"activeGateVersion":"1.261.166.20230308-123141","activeGateWorkingMode":"MANAGED","tenantAvailable":false,"syntheticLicenseAvailable":false,"rumLicenseAvailable":false,"rumConfigRevision":-1,"imgAvailable":false,"hmResultsAvailable":false,"failureScreenshotInterval":3600000,"clusterVersion":"","clusterUUID":"","jsAgentVersion":"","protoVersion":1,"httpMonitorsResultsPath":"","screenshotsPath":"","mpmResultsAvailable":false,"credentialsPath":""}</PRE> <P><SPAN>If you can't find a cause, open a chat or create a ticket.&nbsp;</SPAN></P> </LI> </OL> <P>&nbsp;</P> <H2>Solutions</H2> <P>Once you've done the checks and determined the root cause of the problem, here are some possible solutions that you can apply</P> <P>&nbsp;</P> <H3>Allow/ Allowlist by User Agent string</H3> <P>Synthetic Monitors can be recognised by the User Agent string they add in the request headers. This string can be used in Firewalls, etc., to identify Synthetic traffic and allow it.&nbsp;</P> <P>For Browser monitors, we add&nbsp;</P> <PRE>RuxitSynthetic/1.0</PRE> <P>and some extra parameters after that. You can find the full list <A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/browser-monitors/configure-browser-monitors#expand--default-user-agent" target="_self">here</A>.</P> <P>For HTTP Monitors, we add&nbsp;</P> <PRE>DynatraceSynthetic/{version}</PRE> <P>The version changes with each release, so you may wish to use DynatraceSynthetic/instead. The complete list is<SPAN>&nbsp;<A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/http-monitors-classic/configure-http-monitors-classic#setup" target="_self">here</A>.</SPAN></P> <H3>&nbsp;</H3> <H3>Allow/ Allowlist location IPs</H3> <P>IPs can be used to identify Synthetic traffic and allow it to pass through Firewalls, etc.&nbsp;</P> <P>You can find the IPs used by our public locations using the Frequency and Locations page in the WebUI or the <A href="https://docs.dynatrace.com/docs/discover-dynatrace/references/dynatrace-api/environment-api/synthetic/synthetic-locations/get-all-locations" target="_self">Synthetic locations API—GET all locations&nbsp;API call.&nbsp;</A>Further details are available&nbsp;<A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/general-information/public-synthetic-locations#ip-addresses" target="_self">here.</A>&nbsp;<SPAN>These are individual IPs, so the subnet mask is&nbsp;</SPAN><CODE class="c-mrkdwn__code" data-stringify-type="code">/32</CODE><SPAN>&nbsp;for all of them.</SPAN></P> <P>&nbsp;</P> <P>We don't list private location IPs, but you can find them in the WebUI in Deployment Status&gt; ActiveGates. You can then filter for either the location you're interested in or all Synthetic ActiveGates and open each ActiveGate details tile to check the IP addresses.</P> <H3>&nbsp;</H3> <H3>Add/update Proxy configuration.</H3> <P>If you need to connect to your application through a proxy or bypass it, you may need to add some further configuration to your proxy to allow access from the machine/ location.</P> <P>If the necessary change has already been made to the proxy, we provide information on setting up ActiveGate to use different proxy connection scenarios <A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/private-synthetic-locations/setting-up-proxy-for-private-synthetic" target="_self">here</A>.</P> <P>In addition to this, if you need only to add the proxy settings for Monitors (both HTTP and Browser) or S3 (screenshot storage), you can&nbsp;add the following flags to ActiveGate Synthetic user.properties file</P> <UL> <LI>default Linux path:<SPAN>&nbsp;</SPAN><EM>/var/lib/dynatrace/synthetic/config/user.properties</EM></LI> <LI>default Windows path:&nbsp;C:\ProgramData\dynatrace\synthetic\config\<EM>user.properties</EM></LI> </UL> <PRE>com.vuc.proxy.s3.enabled=false com.vuc.proxy.monitor.enabled=true</PRE> <P>The above snippet would enable Monitors to use the proxy settings specified in custom.properties, but S3 would bypass the proxy and use a direct connection.&nbsp;</P> <P>There is no separate setting for Browser and HTTP Monitors; however, <A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/private-synthetic-locations/setting-up-proxy-for-private-synthetic#proxy-auto-configuration-pac-files" target="_self">Browser Monitors can use PAC files</A>, which can be used to achieve a different proxy for HTTP Monitors and Browser Monitors.&nbsp;</P> <P>&nbsp;</P> <H3>Log in to the Dynatrace Synthetic service as a domain user</H3> <P><STRONG>Note: </STRONG>this is usually needed for applications using Kerberos authentication. Before making this change, it would be good to try using the <A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/general-information/synthetic-authentication#http-bm" target="_self">Kerberos authetication</A> option.&nbsp;&nbsp;</P> <P>&nbsp;</P> <P>For applications that need to be opened in a Browser started by a domain user, you can update the user that the Dynatrace Synthetic service logs on as.</P> <P><STRONG>IMPORTANT:</STRONG> Dynatrace does not support this and must be re-configured every time the ActiveGate is updated. We recommend disabling auto-update for these ActiveGates, and a maintenance window to cover the update period, and re-configuring the log-on user.&nbsp;</P> <OL> <LI><SPAN>On the Synthetic ActiveGate, in Services, right-click on Dynatrace Synthetic service&gt; select properties&gt; select Login On tab. </SPAN></LI> <LI><SPAN>Change &nbsp;'Local Service' to a domain user, enter the password, and Save. </SPAN></LI> <LI><SPAN>Restart the Service.</SPAN></LI> </OL> <P><SPAN>To revert to using the Local Service user</SPAN></P> <OL> <LI><SPAN>On the Synthetic ActiveGate, in Services, right-click on Dynatrace Synthetic service&gt; select properties&gt; select Login On tab. </SPAN></LI> <LI><SPAN>Change the domain user to 'Local Service' with no password and Save. </SPAN></LI> <LI><SPAN>Restart the Service.</SPAN></LI> </OL> <P><SPAN>If this doesn't resolve the issue, open a support ticket.</SPAN></P> <P>&nbsp;</P> <H2 id="toc-hId-1971787789">What's Next</H2> <P>If none of the previous steps resolved the issue, open a chat or support ticket and provide</P> <UL> <LI>a description of the problem</LI> <LI>a link to the affected monitor</LI> <LI>the troubleshooting steps you have already completed and the outcome of each step</LI> </UL> <P>&nbsp;</P> <H3>Related reading</H3> <P><span class="lia-unicode-emoji" title=":open_book:">📖</span>&nbsp;&nbsp;<A class="" href="https://community.dynatrace.com/t5/Troubleshooting/Synthetic-Troubleshooting-Map/ta-p/250426" target="_blank" rel="noopener">Synthetic Troubleshooting Map</A></P> <P><span class="lia-unicode-emoji" title=":open_book:">📖</span>&nbsp; <A href="https://docs.dynatrace.com/docs/observe/digital-experience/synthetic-monitoring/private-synthetic-locations/setting-up-proxy-for-private-synthetic" target="_self">Set up a proxy for private synthetic monitoring</A></P> <P><span class="lia-unicode-emoji" title=":open_book:">📖</span>&nbsp; <A href="https://docs.dynatrace.com/docs/observe/digital-experience/web-applications/initial-setup/firewall-constraints-for-rum" target="_self">Firewall constraints for RUM</A></P> Wed, 19 Aug 2026 16:11:51 GMT HannahM 2026-08-19T16:11:51Z https://community.dynatrace.com/t5/Troubleshooting/Firewall-Constraints-and-allowlisting-for-Synthetic-Monitoring/ta-p/213876 <P><LI-TOC indent="15" liststyle="disc" maxheadinglevel="2"></LI-TOC></P> <DIV class="lia-message-template-content-zone"> <P>*<EM>Use a table of contents for longer articles.&nbsp;</EM></P> <H2>Summary</H2> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Short description of which part of the Dynatrace platform the article refers to and what kind of problem it will help resolve/ task it will describe.</EM></P> <P>&nbsp;</P> <H2>Problem</H2> <P><EM>*This is a mandatory section.</EM></P> <P><EM>Provide a precise description of the problem/ task to be described. Use anonymized screenshots, and include text for&nbsp;important messages, errors, or information that will help the customer find this article when searching.</EM></P> <P>&nbsp;</P> <H2>Troubleshooting steps</H2> <P><EM>*This section can be omitted as necessary.</EM></P> <P><EM>Explain what troubleshooting steps should be taken to ensure the problem matches this article.</EM></P> <P>&nbsp;</P> <H2>Resolution</H2> <P><EM>*This section can be omitted for articles that guide customers on ticket creation.</EM></P> <P><EM>Explain the solution or all possible solutions resulting from the troubleshooting steps.<BR /><BR /></EM></P> <H2>What's next</H2> <P><EM>*This is a mandatory section. Customers need a way to respond or follow up if they have questions.&nbsp;</EM></P> <P><EM>Explain what to do if the article did not help.&nbsp;</EM><EM>Note that there are multiple options available, including:</EM></P> <OL> <LI><EM><STRONG>Opening a support ticket</STRONG> - be as specific as possible about the information the customer should include in the ticket.&nbsp;</EM> If this article did not help, please open a support ticket, mention that this article was used and provide the following in the ticket: <UL> <LI>link to XYZ</LI> <LI>screenshot of XYZ</LI> <LI>information about XYZ</LI> </UL> </LI> <LI><EM><STRONG>Suggesting Product Idea</STRONG> - encourage the customer to suggest/ vote for a Product Idea explaining their business use case.</EM></LI> <LI><EM><STRONG>Explain this will change in the future</STRONG> - explain that this behaviour will change in a future release. (No product idea / support ticket needed)</EM></LI> <LI><EM><STRONG>Alternatives -</STRONG>&nbsp;any other actions or links to other articles that could move the customer forward.</EM></LI> </OL> <P>&nbsp;</P> <P><EM>*If it exists, link this article to the relevant troubleshooting map using the following guideline</EM></P> <H3>More articles can be found on the <A href="https://community.dynatrace.com/t5/Troubleshooting/" target="_self">XXX Troubleshooting Map</A></H3> </DIV> Wed, 19 Aug 2026 16:11:51 GMT https://community.dynatrace.com/t5/Troubleshooting/Firewall-Constraints-and-allowlisting-for-Synthetic-Monitoring/ta-p/213876 HannahM 2026-08-19T16:11:51Z https://community.dynatrace.com/t5/Troubleshooting/Firewall-Constraints-and-allowlisting-for-Synthetic-Monitoring/tac-p/214503#M248 <P>great write up, thank you for sharing this!&nbsp;</P> Thu, 08 Jun 2023 18:49:22 GMT https://community.dynatrace.com/t5/Troubleshooting/Firewall-Constraints-and-allowlisting-for-Synthetic-Monitoring/tac-p/214503#M248 ChadTurner 2023-06-08T18:49:22Z https://community.dynatrace.com/t5/Troubleshooting/Firewall-Constraints-and-allowlisting-for-Synthetic-Monitoring/tac-p/214511#M253 <P>Terrific Guide!!!! Thks for sharing this.</P> Thu, 08 Jun 2023 19:51:40 GMT https://community.dynatrace.com/t5/Troubleshooting/Firewall-Constraints-and-allowlisting-for-Synthetic-Monitoring/tac-p/214511#M253 DanielS 2023-06-08T19:51:40Z