IssueTracker

I am looking to use the Web Security Scanner on a GCP project that uses Google's global load balancer. If only an IPv4 address is used the scanner works fine. However, we use both an IPv4 and IPv6 frontend on the load balancer. Having the additional IPv6 address causes the scanner to not work. The following error message is displayed:

"One of the starting URLs is mapped to an IP address that is not reserved as static for this project; please check its DNS settings and External IP addresses section."

Both the IPv4 and IPv6 addresses are global addresses, reserved and static. I am the verified owner of the domain. If I remove the IPv6 frontend from the load balancer and the AAAA DNS entry, the security scan works normally.

I expect the scan to work using both the IPv4 and IPv6 address.

Steps to reproduce:
- Create a GCP project that serves a web page behind a Global Load Balancer using a static, reserved IPv4 address. Ensure that there is an "A" DNS record and a valid SSL certificate.
- Run the Web Security Scanner using the root URL as a starting point (e.g. "https://example.com/"). Notice that the scan runs normally.
- Reserve a global static IPv6 address and create a corresponding AAAA record for the same hostname. Add this address as a load balancer frontend for the project. Verify that the web project is now accessible via both IPv4 and IPv6.
- Run the Web Security Scanner again and notice that it refuses to start. The aforementioned error message is displayed.
- Remove the AAAA DNS record and IPv6 frontend from the load balancer. Try running the Web Security Scanner again and notice that it works again.