PingOne Privilege

Configuring a relay

Relays allow you to deploy in networks that don’t allow inbound connections from the internet. The relay, deployed as a Docker container, establishes a secure, egress-only connection to a PingOne Privilege gateway, enabling access to resources located within its private network.

PingOne Privilege allows you to add a relay using a setup wizard or through Docker.

Configure a relay using the setup wizard

Before you begin

  • In the PingOne admin console, create an OIDC web application. For instructions, refer to Creating a web application in the PingOne documentation.

  • Before you add a relay, create a new Virtual Machine (VM) to deploy the proxy container. Ensure the VM meets the required specifications for optimal performance and connectivity:

    • CPU: 2 cores, sufficient for processing proxy operations efficiently.

    • RAM: 4 GB ensures smooth container operation.

    • Storage: 20 GB accommodates system files and application data.

    • Firewall Policy:

      • Outbound: Allow all traffic.

  • Supported Operating Systems:

    • RHEL / CentOS (RPM x86_64)

    • Debian / Ubuntu AMD64

    • Debian / Ubuntu ARM64

Steps

To add a relay using the setup wizard:

  1. In the PingOne Privilege admin console, go to Directory > Gateways.

  2. Click Add New, and then click Add via Wizard.

  3. Review the requirements for your VM, then click Next.

  4. Install Docker based on the official Docker installation guide for your OS.

  5. Verify Docker is running using the following command in your CLI:

    sudo docker ps

    If the command runs without errors, Docker is installed and running successfully.

  6. Select Private Proxy as your deployment mode. Click Next

  7. In the following Gateway Config wizard, ensure Relay is selected.

  8. Enter a Relay Name to identify your relay.

  9. Enter the Host Name of the server where the relay will be installed.

  10. (Optional): Click the Deploy RDP checkbox to deploy a remote desktop.

  11. Click Next.

  12. Create the environment file with the following commands:

    1. To create the directory, if not already present:

      sudo mkdir -p /var/lib/procyon

    2. To create the file and open it:

      sudo vi /var/lib/procyon/procyon-guest-agent.env

    3. Copy the generated content from your setup tasks and paste it inside the newly created file and save it.

    4. In the setup wizard, click Next.

  13. Select your operating system from the list. Click Show Instructions for the detailed steps for installing the package for your operating system.

  14. Click Finish.

Configure a relay through Docker

Before you begin

  • In the PingOne admin console, create an OIDC web application. For instructions, refer to Creating a web application in the PingOne documentation.

  • Ensure the following inbound ports are open on the host where you will install the relay:

    • 22

    • 443

    • 3389

    • 8680

    • 8690

Steps

To add a relay through Docker:

  1. In the PingOne Privilege admin console, go to Directory > Gateways.

  2. Click Add New, and then click Add via Docker.

  3. Select Relay.

  4. Enter a unique Cluster ID to identify this relay group.

  5. Enter the Host Name of the server where the relay will be installed.

  6. Click Copy Docker Command to copy the command to your clipboard.

  7. On your designated host within your on-premise network, run the copied Docker command you just copied.

    Result: The relay starts and automatically registers with the Endpoint Controller.

The Endpoint Controller doesn’t have automatic visibility into on-premises network topology. After deploying the relay, you must manually configure which resources are accessible through it.

Next steps

After adding the relay, go to the Gateways page in the admin console. Your new relay should be listed with a Verified status.