Identifying a firewall or proxy server problem

If your software is unable to contact AvaTax, pretty much any API call you make will produce an error. So let’s begin by explaining how we can identify whether a connection problem exists.

First, please visit the AvaTax API server from your desktop computer or mobile phone. Try both of these two URLs, one for Sandbox and one for Production:

Sandbox Environment: https://sandbox-rest.avatax.com
Production Environment: https://rest.avatax.com

If your connection is working correctly, you should see a web page similar to the following:

If you can’t see this page on your desktop computer at work, but you can see this web page from a mobile phone on the public Internet, you may have a networking issue. There’s a chance that your office has a firewall or proxy server that enforces some limits on your network connectivity. Contact your corporate IT department for more information.

Other common problems

Table 1. Common problems table
PROBLEM TYPE	STEPS TO DIAGNOSE
Routing Problems	Do your routers have the latest software? Have they been rebooted recently, or are there too many hops between your network and the outside world? If your network is using a direct connection with a local Internet service provider, does your connection reset regularly? If the connection is permanent or business-class, does your ISP offer metrics to help you measure response time? If you have a more advanced network using Border Gateway Protocol routing, you would need to talk to your network engineering team. BGP issues are very challenging to review and are beyond the scope of this article. Due to security issues, Avalara's servers don’t respond to ping requests. This means that network traces from software like traceroute or tracert aren’t able to provide accurate route timings.
Authentication Problems	Try using the Ping API, or switch to using an AvaTax SDK, which has prebuilt and tested authentication code.
Firewall Problems	To use AvaTax, you must enable access to all IP addresses identified by these DNS names: Sandbox Environment: https://sandbox-rest.avatax.com Production Environment: https://rest.avatax.com AvaTax is a dynamic product and its IP addresses can change regularly. AvaTax doesn't support firewalls that filter on individual IP addresses.
Ethernet Problems	Check the quality of your wiring and the auto-negotiate settings on your Ethernet devices. Bad wiring or devices with mismatched speed settings are easy to overlook! You can run `netstat -s` on a windows machine or `ifconfig -a` on a Linux machine to detect whether an unusual number of bad packets are coming through your network. If you have a performance mismatch, try checking with your network administrator to see if the cabling can be improved.
Host Files / IP Address Hardcoding / DNS Caching	AvaTax doesn’t support hardcoded IP addresses or host files. To use AvaTax, you must resolve DNS names dynamically. Your DNS server should respect the DNS time-to-live (TTL) values; Avalara publishes DNS TTL values designed to permit our operations team to adjust our connectivity in response to changing network conditions.
Proxy Server Problems	AvaTax isn’t designed for environments using proxy servers. Proxy servers can cause latency and connectivity problems when calling high-performance APIs like AvaTax. If your company policy requires a proxy server, please consult your proxy provider for how to correctly configure the proxy to work with AvaTax.
DNS Time-To-Live	Avalara makes changes to our domain name system records periodically. Your software should ensure that you respect the DNS time-to-live values, and that your software periodically contacts DNS to update its name lookups. Some software, including some Java JRE versions, may need to be updated to ensure the "ttl" or "time-to-live" values are correctly handled. If you experience problems with occasional DNS changes, please check the documentation for your operating system, programming language, or development environment to ensure your software handles TTL values correctly.
Need SSL Certificate Verification	Some web clients (such as cURL for Windows) will require you to download the Avalara AvaTax SSL public keychain and install it into your client’s keychain repository. If the client program requests that you specifically accept and trust Avalara's web certificate, here's how to proceed: Go to VeriSign Root CA and follow the instructions. Save the file in your preferred directory, for example, "certs-ca-bundle.crt." Register that file following your standard certificate store process.

Troubleshooting AvaTax authentication issues