PingOne Privilege

Configuring a private proxy

Private proxies act as a secure entry point, allowing PingOne Privilege to manage and audit access to your internal resources.

PingOne Privilege allows you to add a private proxy using a setup wizard or through Docker.

Configure a private proxy using the setup wizard

Before you begin

  • In the PingOne admin console, create an OIDC web application. For instructions, refer to Creating a web application in the PingOne documentation.

  • Before you add a private proxy, create a new Virtual Machine (VM) to deploy the proxy container. Ensure the VM meets the required specifications for optimal performance and connectivity:

    • CPU: 2 cores, sufficient for processing proxy operations efficiently.

    • RAM: 4 GB ensures smooth container operation.

    • Storage: 20 GB accommodates system files and application data.

    • Firewall Policy:

      • Outbound: Allow all traffic.

      • Inbound: Open ports 8680, and 8690 for application communication.

  • Supported Operating Systems:

    • RHEL / CentOS (RPM x86_64)

    • Debian / Ubuntu AMD64

    • Debian / Ubuntu ARM64

Steps

To add a private proxy using the setup wizard:

  1. In the PingOne Privilege admin console, go to Directory > Gateways.

  2. Click Add New, and then click Add via Wizard.

  3. Review the requirements for your VM, then click Next.

  4. Install Docker based on the official Docker installation guide for your OS.

  5. Verify Docker is running using the following command in your CLI:

    sudo docker ps

    If the command runs without errors, Docker is installed and running successfully.

  6. Select Private Proxy as your deployment mode. Click Next

  7. In the following Gateway Config wizard, ensure Private Proxy is selected.

  8. Enter a unique Proxy Cluster Name to identify the private proxy group.

  9. Enter the FQDN / Host IP of the server where the proxy will be installed.

  10. Click Next.

  11. (Optional): Click the Deploy RDP checkbox if you’re deploying a remote desktop.

  12. Create the environment file with the following commands:

    1. To create the directory, if not already present:

      sudo mkdir -p /var/lib/procyon

    2. To create the file and open it:

      sudo vi /var/lib/procyon/procyon-guest-agent.env

    3. Copy the generated content from your setup tasks and paste it inside the newly created file and save it.

    4. In the setup wizard, click Next.

  13. Select your operating system from the list. Click Show Instructions for the detailed steps for installing the package for your operating system.

  14. Click Finish.

Next steps

After adding the private proxy, go to the Gateways page in the admin console. Your new private proxy should be listed with a Verified status.

Configure a private proxy using Docker

Before you begin

  • In the PingOne admin console, create an OIDC web application. For instructions, refer to Creating a web application in the PingOne documentation.

  • Ensure the following inbound ports are open on the host where you will install the private proxy:

    • 22

    • 443

    • 3389

    • 8680

    • 8690

Steps

To add a private proxy through Docker:

  1. In the PingOne Privilege admin console, go to Directory > Gateways.

  2. Click Add New, and then click Add via Docker.

  3. Select Private Proxy.

  4. Enter a unique Cluster ID to identify this proxy group.

  5. Enter the Host IP of the server where the proxy will be installed.

  6. Click Get Docker Command.

  7. Click Copy Docker Command to copy the command to your clipboard.

  8. On your designated host within your on-premise network, run the copied Docker command you just copied.

    The proxy will start and automatically register with the Endpoint Controller.

The Endpoint Controller doesn’t have automatic visibility into on-premises network topology. After deploying the proxy, you must manually configure which resources are accessible through it.

Next steps

After adding the private proxy, go to the Gateways page in the admin console. Your new private proxy should be listed with a Verified status.