| License Type | SaaS & On-Premise |
| Agent Mode | Assess & Protect |
| Main Product Category | Java Agent |
| Sub Category | Onboarding |
Issue
The Contrast agent has been deployed and your application is up and running. However your server hasn't appeared in the Contrast UI's Server list.
Cause
Are you sure the agent was installed correctly? Here's a checklist of common fixes for this issue:
- Did you add the JVM parameters to your container's startup file, run configuration or
JAVA_OPTSas was shown in installation documents? - Did you allocate any extra heap space to account for the agent?
- Did you see the Contrast messages in the console when you started up the server? What about server startup messages?
There are a few network-related reasons why your server wouldn't appear on the Contrast UI, even if Contrast was installed correctly. Assuming you've seen the Contrast and server's startup messages in your console on startup, consider the following options:
[1] Your network requires a HTTP proxy to access Contrast's site
[2] Your network firewall doesn't allow outbound HTTP connections to Contrast's site
[3] You're suffering from the Windows and Java7 IPv6 bug
Resolution
[1] If you need to configure an HTTP proxy to reach the Internet in your web browser, it's very likely Contrast will also require an HTTP proxy. To add an one off HTTP proxy, select "Advanced Configuration" and then "Use HTTP Proxy"in the Agent download screen. Fill out values for the HTTP proxy host and port. These values should be supplied by your network administrators. Finally, download and install Contrast as per the normal instructions.
[2] Work with your network administrators to allow the server on which the Agent is running to create outbound HTTP requests to the Contrast TeamServer from which you obtained said Agent. For SaaS users, this is app.contrastsecurity.com on port 443.
[3] Starting with Java 7, the behavior of the IP stack is to utilize IPv6 addresses if available. On Windows, this causes problems with Java machines attempting to make connections out and results in inexplicable "PermissionDenied" exceptions. To fix, this, add the following property to your JVM options:
-Djava.net.preferIPv4Stack=true
Further Debugging
The Contrast engine ships with a diagnostic tool that can be run by passing the "diagnostic" argument to contrast.jar. This may help you identify your problem area. The command would be run as so:
java -jar /path/to/contrast.jar diagnostic
A successful connection attempt will output:
[!] Attempting to connect to the Contrast TeamServer at https://app.contrastsecurity.com/Contrast (No proxy). [!] Attempting to resolve domain: app.contrastsecurity.com Resolved domain app.contrastsecurity.com to IP Address 52.200.215.12 [+] Client successfully resolved the DNS of the Contrast TeamServer. No proxy needed. [!] Issuing HTTP request to Contrast... Executing request... Reading response [200] Response size = 4209 Snippet: <!doctype html> <!--[if gt IE 8]><!--> <html class="no-js" i [+] Client can connect directly to the Contrast TeamServer. No proxy needed.
You can also customize the diagnostic test and quickly test out different proxy and NTLM configurations by setting the following System properties:
- -Dcontrast.api.proxy.host - the proxy hostname or IP address.
- -Dcontrast.api.proxy.port - the proxy port (usually 80 or 8080).
- -Dcontrast.api.proxy.auth_type - one of "none", "basic", "digest" or "ntlm".
- -Dcontrast.api.proxy.user - your proxy user name, if authentication is needed. For NTLM proxies, this is usually DOMAIN\username.
- -Dcontrast.api.proxy.pass - your proxy password, if authentication is needed.
- -Dcontrast.api.proxy.scheme - what protocol you're using (http/https)