--- title: Manage Proxy Connect using the admin console description: You can find background information on Proxy Connect in Restrict network access with Proxy Connect. component: pingoneaic page_id: pingoneaic:tenants:proxy-connect-ui canonical_url: https://docs.pingidentity.com/pingoneaic/tenants/proxy-connect-ui.html llms_txt: https://docs.pingidentity.com/pingoneaic/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md section_ids: prerequisite-actions-for-accessing-a-tenant-when-rulesets-are-configured: Prerequisite actions for accessing a tenant when rulesets are configured manage-proxy-connect-configuration: Manage Proxy Connect configuration make-pending-updates-to-proxy-connect-configuration: Make pending updates to Proxy Connect configuration update-the-proxy-connect-status: Update the Proxy Connect status update-the-http-header-ruleset: Update the HTTP header ruleset update-the-ip-ruleset: Update the IP ruleset apply-pending-updates-to-proxy-connect-configuration: Apply pending updates to Proxy Connect configuration --- # Manage Proxy Connect using the admin console You can find background information on Proxy Connect in [Restrict network access with Proxy Connect](proxy-connect.html). ## Prerequisite actions for accessing a tenant when rulesets are configured If you already have any HTTP header or IP rules configured for a tenant environment, you'll need to meet the requirements of the rules to access the tenant successfully. | | | | - | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | | The prerequisite actions aren't required if you [configured a proxy service to access your tenant](proxy-connect.html#allow-network-access-only-through-a-proxy-service) or if you [configured Secure Connect](proxy-connect.html#block-network-access-when-using-secure-connect) and can access your tenant from a private network. | 1. Consult with your team to find out what header rules are configured for the environment: 1. If header rules are configured, you need the name and value of a configured security header. 2. To access the tenant using a browser, configure a browser extension to add the security header to all browser requests. For example, the SimpleModifyHeaders extension lets you modify headers for [Chrome](https://chromewebstore.google.com/detail/simple-modify-headers/gjgiipmpldkpbdfjkgofildhapegmmic) and [Firefox](https://addons.mozilla.org/en-GB/firefox/addon/simple-modify-header/): ![simple modify headers configuration](_images/simple-modify-headers-configuration.png) 3. To access the tenant using the API, add the security header to all cURL requests using the format: `--header ': '` For example: `--header 'X-Security-Header: f1drybngmzqj5loposddd5p98z886jp9'` 2. Consult with your team to find out what IP rules are configured for the environment: 1. If IP rules are configured, your IP address needs to be in one of the configured CIDR ranges. To change your IP address, you might need to join your company's VPN, or your team might need to add your IP address to the IP rules configuration. 2. Run all browser and API requests from a configured IP address. ## Manage Proxy Connect configuration To manage Proxy Connect configuration: 1. (Optional) Complete the [Prerequisite actions for accessing a tenant when rulesets are configured](#prerequisite-actions-for-accessing-a-tenant-when-rulesets-are-configured). 2. In the Advanced Identity Cloud admin console, open the TENANT menu (upper right), then go to [icon: settings, set=material, size=inline] Tenant Settings > Global Settings > Network Security > Proxy Connect. 3. Update the Proxy Connect configuration as needed using the following links. Your updates are pending until you apply them in step 5. As soon as you make your first update, an update banner appears at the top of the page containing the message You have *n* update to apply. As you make additional updates, the message updates to reflect the total number of pending updates. 1. (Optional) [Update the Proxy Connect status](#update-the-proxy-connect-status) 2. (Optional) [Update the HTTP header ruleset](#update-the-http-header-ruleset) 3. (Optional) [Update the IP ruleset](#update-the-ip-ruleset) 4. When you've made all your updates: 1. The Proxy Connect status must align with your HTTP header and IP rulesets to form a workable configuration: * If you have the HTTP header or IP rulesets enabled, set the Proxy Connect status to Filtering. * If you don't have the HTTP header or IP rulesets enabled, set the Proxy Connect status to Open. 2. Make sure that you'll still have access to the tenant environment after your updates are applied. Refer to [Prerequisite actions for accessing a tenant when rulesets are configured](#prerequisite-actions-for-accessing-a-tenant-when-rulesets-are-configured). 5. [Apply your pending updates](#apply-pending-updates-to-proxy-connect-configuration). ## Make pending updates to Proxy Connect configuration The following sections provide granular instructions on how to update your Proxy Connect configuration. Any updates you make are pending until you apply them. For instructions on how to apply your pending updates, refer to [Apply pending updates to Proxy Connect configuration](#apply-pending-updates-to-proxy-connect-configuration). ### Update the Proxy Connect status 1. In the Advanced Identity Cloud admin console, open the TENANT menu (upper right), then go to [icon: settings, set=material, size=inline] Tenant Settings > Global Settings > Network Security > Proxy Connect. 2. Set the Proxy Connect Status for the tenant environment: * Open: The open status means that Proxy Connect isn't active. Traffic to your tenant environment's TLS load balancer is unrestricted. * Filtering: The filtering status means that Proxy Connect is active. Traffic to your tenant environment's TLS load balancer is restricted by any configured rules. | | | | - | ----------------------------------------------------- | | | A third status, Blocking, is reserved for future use. | ### Update the HTTP header ruleset 1. In the Advanced Identity Cloud admin console, open the TENANT menu (upper right), then go to [icon: settings, set=material, size=inline] Tenant Settings > Global Settings > Network Security > Proxy Connect. 2. In the Security Headers tab, configure the HTTP header rules you want to apply to the tenant environment: 1. Review any existing header rules that are listed in the table. 2. To add a new header rule, click New Security Header: 1. In the [icon: add, set=material, size=inline] Create Security Header modal, enter a Header Name and Value. For example, `X-Security-Header` and `f1drybngmzqj5loposddd5p98z886jp9`. 2. Click Save. 3. To delete an existing header rule, click its delete icon ([icon: delete, set=material, size=inline]), then click Delete in the Delete Security Header? modal. 4. Use the toggle in the upper right of the table to enable or disable the HTTP header ruleset: * When the toggle is enabled, all listed header rules are applied. * When the toggle is disabled, no header rules are applied. ### Update the IP ruleset 1. In the Advanced Identity Cloud admin console, open the TENANT menu (upper right), then go to [icon: settings, set=material, size=inline] Tenant Settings > Global Settings > Network Security > Proxy Connect. 2. In the IP Address Filtering tab, configure the IP rules you want to apply to the tenant environment: 1. Review any existing IP rules in the Accepted IP Addresses. 2. To add a new IP rule: 1. Click the Accepted IP Addresses field. 2. Enter an IP address or CIDR range. For example, `1.2.3.4/32`. 3. Click anywhere outside the field. 3. To delete an existing IP rule, click its delete icon ([icon: close, set=material, size=inline]). 4. Use the toggle below the Accepted IP Addresses field to enable or disable the IP ruleset: * When the toggle is enabled, all listed IP rules are applied. * When the toggle is disabled, no IP rules are applied. ## Apply pending updates to Proxy Connect configuration To apply pending updates: 1. Click the View Updates button in the update banner. 2. In the Pending Proxy Connect Updates modal, review the list of pending updates. 3. Click Apply *n* Updates. 4. In the confirmation modal, click Apply Now. Before application, your pending updates are validated to ensure that they form a workable configuration: * If your configuration updates pass validation, the ruleset configuration is updated in the environment's load balancer. This process can take up to 10 minutes to complete, during which time the update banner remains visible with the message Update in progress. * If any of your updates don't pass validation, you'll see one of these error messages: * The `unable to set proxy-connect to open as sub settings are enabled` error message indicates that you have set the Proxy Connect status to Open but still have the HTTP header or IP rulesets enabled. To fix this, either disable all HTTP header and IP rules or change the Proxy Connect status to Filtering. * The `unable to set proxy-connect to filtering as sub settings are not enabled` error message indicates that you have set the Proxy Connect status to Filtering but don't have the HTTP header or IP rulesets enabled. To fix this, either enable at least one HTTP header or IP rule or change the Proxy Connect status to Open.