--- title: "Configure explicit proxy domains" canonical: "https://docs.aryaka.com/space/KNOW/1329561624/Configure%20explicit%20proxy%20domains" format: markdown --- You can configure explicit proxy to your organization’s specifications in MyAryaka by completing the following configurations: Configure proxy domain. Specify your organization’s domain and map it (CNAME) to an Aryaka-provided domain. Configure identity management. If not already configured, set up an identity provider (IdP) to authenticate proxy connections using Basic or Kerberos. Configure authentication rules. Create access controls for explicit proxy traffic. Configure client traffic routing to proxy. Configure the proxy domain either using PAC files or through direct configuration, depending on the use case. Configure security rules. Define and apply security rules to each proxy domain to secure proxy traffic. This topic describes each of these configuration steps. Configure explicit proxy domain You can configure explicit proxies for your UZTNA regions, which allow users in the configured regions to access the internet from anywhere through Aryaka’s POPs. You must configure a UZTNA region before you create an explicit proxy. To add a region, contact Aryaka Support . To adjust the user count or enable features for a region, see the UZTNA regions topic. Complete the following procedures to add or edit an explicit proxy domain: To add an explicit proxy domain Log in to MyAryaka. The Home page appears. Click Universal ZTNA > Explicit Proxy in the left navigation pane. The Explicit Proxy page appears and displays all proxies that have been created for your organization. Click Create Proxy . The Create Proxy page appears. In the Basic Information pane, enter a name for the proxy, then click the Region drop-down list and select the region that the explicit proxy is for. In the Select POPs pane, click Add and select the POPs that you want this proxy to be connected to, then click Add Selected . Note that, based on your plan, you may incur additional charges if you select more than five POPs. In the Domains pane, click Add and enter one or more domains used to access the proxy, then click Add Selected . These domains should be identifiable and scoped within your organization. They must also be CNAMEd to the proxy domain provided by Aryaka (see step 8). Alternatively, you can directly use the Aryaka-provided proxy domain for access. Click Submit . The Explicit Proxy page appears and displays the details of your new proxy. Note the Aryaka domain provided in the Proxy Domain and Port pane. CNAME the proxy domains you provided in step 6 to this Aryaka domain. This process can take a few hours to take effect. Aryaka recommends that you complete the configurations included in the Additional Configuration pane to complete your explicit proxy configuration. These configurations are described throughout this topic. To edit an explicit proxy domain Log in to MyAryaka. The Home page appears. Click Universal ZTNA > Explicit Proxy in the left navigation pane. The Explicit Proxy page appears and displays all proxies that have been created for your organization. Click the name of the proxy you want to modify. The Explicit Proxy page displays the details of the selected proxy. In the Proxy Configuration section, click Manage Proxy . The Manage Proxy page appears in read-only mode. Click Edit . The page appears in edit mode. Modify the proxy configuration as needed. See steps 4–6 of the Add an explicit proxy procedure for details. Click Submit . The Explicit Proxy page displays the details of the updated proxy. Configure identity management Explicit proxy can use basic or Kerberos authentication. Therefore, you must have an IdP configured and enabled for one of these authentication types for end users to authenticate first while connecting to an explicit proxy domain. You are required to configure or adjust your IdP settings to support explicit proxy if any of the following conditions apply: You have not previously configured IdP for your organization. You configured IdP to use a SAML-based IdP. You previously configured IdP to use basic authentication (this means you configured an instance of Aryaka’s IdP, Active Directory, or LDAP), but you want to use Kerberos authentication for explicit proxy. If you have not configured IdP for your organization, or if you previously configured a SAML-based instance, complete one of the following procedures to set up this service to support explicit proxy using basic authentication: Configure AIM for Aryaka’s IdP Configure AIM for Active Directory Configure AIM for LDAP If you want to use Kerberos authentication for explicit proxy, complete the procedure in the Configure AIM for Active Directory topic. Configure authentication rules You can configure authentication rules so that your explicit proxy remote users are required to authenticate before they can connect to a proxy instance. By default, basic authentication is enforced for all explicit proxy traffic. If you want to use Kerberos, you can create an authentication rule to specify that Kerberos authentication should be enforced for all traffic of the selected proxy. Aryaka recommends authenticating explicit proxy traffic, but if you do not want traffic to be authenticated for a specific proxy, you can also create a rule to skip authentication. Complete the following procedures to add or edit authentication rules for explicit proxy: To add authentication rules for explicit proxy The following configuration cannot be completed until you have CNAMED your organization’s domain to the provided Aryaka domain. Log in to MyAryaka. The Home page appears. Click Universal ZTNA > Explicit Proxy in the left navigation pane. The Explicit Proxy page appears and displays all proxies that have been created for your organization. Click the name of the proxy you want to create an authentication rule for. The Explicit Proxy page displays the details of the selected proxy. In the Additional Configuration section, click Set Up Auth Rules on the Authentication Rules tile. The Authentication Rules page appears and displays a list of all configured authentication rules. Click the Edit icon. The page appears in edit mode. Click Add . The Add a Rule page appears. Enter a name for the rule, then click the Auth Type drop-down list and select one of the following authentication types: Basic—Use basic authentication. Kerberos—Use Kerberos authentication. Skip—Skip authentication. Note: Currently, authentication rules match all traffic. Aryaka plans to add the ability to include match criteria (source IPs and HTTP headers) for a rule, allowing you customize which traffic the authentication rule is applied to. Click Continue . The Authentication Rules pages appears and displays your rule in the list of authentication rules. To edit authentication rules for explicit proxy Log in to MyAryaka. The Home page appears. Click Universal ZTNA > Explicit Proxy in the left navigation pane. The Explicit Proxy page appears and displays all proxies that have been created for your organization. Click the name of the proxy you want to create an authentication rule for. The Explicit Proxy page displays the details of the selected proxy. In the Additional Configuration section, click Manage Auth Rules on the Authentication Rules tile. The Authentication Rules page appears and displays a list of all configured authentication rules. (Optional) Click Reorder . The displayed table now includes the Reorder column, which displays the following actions: Move Down—Move the selected rule down one row in the table. Move to Bottom—Move the selected rule to the bottom of the table. This rule is now evaluated last. Move Up—Move the selected rule up one row in the table. Move to Top—Move the selected rule to the top of the table. This rule is now evaluated first. Change Precedence—Use the Reorder dialog to enter a new precedence value for the selected rule. For example, if your rule list contains five rules and you want the selected rule to be evaluated third, enter 3 in the Reorder dialog, then click Update . Click the Edit icon. The page appears in edit mode. Edit authentication rules as needed: Click the Edit icon in the Action column of the rule you want to edit. The < ruleName > page appears and you can modify the rule as needed, then click Submit . Click the Add Below icon in the Action column of the rule you want to edit. A new blank rule is added below the selected rule, which you can configure as needed. Click the Options icon in the Action column of the rule you want to edit and select one of the following options: Clone —Adds a new rule with the same match criteria as the cloned rule. The new rule is added to the rule table directly after the rule it was cloned from. Enable/Disable— Renders the rule active (enabled) or inactive (disabled). Disabled rules still appear in the list of authentication rules, but they are not applied to traffic and can be reenabled later.  Delete —Removes the rule from the list of authentication rules. To add a new rule, complete steps 7–8 of the Add an authentication rule for explicit proxy procedure. Click Submit . The Authentication Rules page displays your updated rules. Configure client traffic routing to proxy When using explicit proxy, the internet browser must be instructed on how to route traffic to the proxy server. You can do this by directly pushing the proxy URL to your client machines or using a PAC file. PAC files define the specific domains for which browser-based traffic should be routed to Aryaka POPs for inspection. If you use a PAC file, you can either create and store the PAC file locally or you can host your PAC files with Aryaka. See the Explicit proxy topic for more details on PAC files. Complete the following procedures to add or edit PAC files: To add a PAC file for explicit proxy Log in to MyAryaka. The Home page appears. Click Universal ZTNA > Explicit Proxy in the left navigation pane. The Explicit Proxy page appears and displays all proxies that have been created for your organization. Click the name of the proxy you want to configure a PAC file for. The Explicit Proxy page displays the details of the selected proxy. In the Additional Configuration section, click Set Up PAC File on the PAC Files tile. The PAC Files page appears and displays a list of your configured PAC files for the selected proxy. Click Add . The Add a File page appears. In the File Details pane, enter a unique name for the file and, optionally, a description for the file. (Optional) If you do not want this PAC file to be active, click the Activate toggle to turn it to the OFF position. PAC files are active by default. Active files receive a download URL that you can use; inactive files cannot be downloaded and used. In the File Content pane, select one of the following toggles: Upload file—Use the Upload PAC File field to upload the file you want to use. Note that you can download a PAC file template that you can use as an example. Create file—Use the text editor to edit the sample code to create your own PAC file. Click Submit . The PAC Files page displays your file in the list of PAC files. To edit PAC files for explicit proxy Log in to MyAryaka. The Home page appears. Click Universal ZTNA > Explicit Proxy in the left navigation pane. The Explicit Proxy page appears and displays all proxies that have been created for your organization. Click the name of the proxy you want to configure a PAC file for. The Explicit Proxy page displays the details of the selected proxy. In the Additional Configuration section, click Manage PAC File on the PAC Files tile. The PAC Files page appears and displays a list of your configured PAC files for the selected proxy. Click the name of the file you want to edit. The < PACfileName > page appears. (Optional) Click the Download icon to save the PAC file locally. (Optional) Click the Delete icon to remove the PAC file. Click the Edit icon and modify the PAC file as needed, then click Submit : In the File Details pane, edit the name or description of the file. Click the Activate toggle to enable or disable the file. In the File Content pane, click Replace File to upload or create a new PAC file. (Optional) To restore a previous version of the PAC file, click the Restore icon in the Actions column of the file version you want to restore. A dialog displays differences between the current PAC file and the selected version. Click Restore to confirm this change. Configure security rules You can apply security rules from the following Aryaka security engines to explicit proxy traffic: SWG NGFW LAN-Side Basic IPS Advanced IPS Tenant Restriction SaaS Apps Access Control Anti-Malware See the Configure site-level security features topic for details on security rule tables and rule evaluation order. Complete the following procedure to add or edit security rulesets for explicit proxy: To configure security rules for explicit proxy The following configuration cannot be completed until you have CNAMED your organization’s domain to the provided Aryaka domain. Log in to MyAryaka. The Home page appears. Click Universal ZTNA > Explicit Proxy in the left navigation pane. The Explicit Proxy page appears and displays all proxies that have been created for your organization. Click the name of the proxy you want to create a security rule for. The Explicit Proxy page displays the details of the selected proxy. In the Additional Configuration section, click Set Up Security Rules on the Security Rules tile. The Explicit Proxy > Security page appears and displays a tile for each security engine that you can configure rules for. Click Manage Rules in the tile for the security engine that you want to configure a rule for. The < securityEngine > page appears and displays a list of security rules configured for the proxy. Click Add on the rule table. The page displays a Details pane and a Match Criteria pane. In the Details pane, enter a name for your rule, then click the  Actions  drop-down list and select one of the following actions to take when a condition of the rule is met: Permit—Traffic is allowed to pass through. Drop—Traffic is blocked. Log Only—Traffic is allowed to pass through and is logged. Note: These actions are different for some security engines. Select the security engine you want to view actions for on the Security engine rulesets page for additional details.  In the Match Criteria pane, complete the following procedure for each of the criterion you want to include in the rule:  Click the  Condition  drop-down list and select a condition for the criterion. Complete one of the following procedures to add match criteria: Type a criterion into the appropriate field and hit Enter. The criterion is added. Click the  Add icon. The Add < criterion > dialog appears. Depending on the type of match criteria selected, do one of the following: Click one or more entities you want to include as match criteria for the rule. The selected entities are highlighted in green and display a check. Click  Add Selected . The page displays the selected entities for each criterion.  Enter one or more entities you want to include as match criteria for the rule. Click  Add Selected . The page displays the selected entities for each criterion.  Click  Continue . The < securityEngine > page appears with the rule you added included in the rule table. Do one of the following: Click Save as Draft to save a draft of the security rules. Click  Submit . You are prompted to select one of the following options: Activate Later or Activate Now . See Activate configuration updates for details. When your update is activated, the rules you added are saved. (Optional) Repeat steps 6–11 to configure additional security rules as needed. After you have configured all required security rules for the proxy, click the Power icons to turn on the security engines you created rules for. To edit security rules for explicit proxy Log in to MyAryaka. The Home page appears. Click Universal ZTNA > Explicit Proxy in the left navigation pane. The Explicit Proxy page appears and displays all proxies that have been created for your organization. Click the name of the proxy you want to edit security rules for. The Explicit Proxy page displays the details of the selected proxy. In the Additional Configuration section, click Manage Security Rules on the Security Rules tile. The Explicit Proxy > Security page appears and displays a tile for each security engine that you can configure rules for. Click Manage Rules in the tile for the security engine that you want to edit rules for. The < securityEngine > page appears and displays a list of security rules configured for the proxy. Click the  Edit  icon. The page appears in edit mode. Use the following options to modify rules as needed: Edit—Displays the match criteria in edit mode. Add, edit, or remove entities from any of the match criteria. Complete step 8 of the  Configure security rules for explicit proxy  procedure to add or edit the entities included in a criterion, then click Continue . Add Below—Adds a new blank rule below the selected rule. More Options > Clone—Adds a new rule with the same match criteria as the cloned rule. The new rule is added to the rule table directly after the rule it was cloned from. More Options > Disable—Renders the rule inactive, but does not remove it from the rule table. The rule can be reenabled later.  More Options > Delete—Removes the rule from the site's rule table.  Do one of the following: Click Save as Draft to save a draft of the security rules. Click  Submit . You are prompted to select one of the following options: Activate Later or Activate Now . See Activate configuration updates for details. When your update is activated, the changes to the rules are saved. In this topic Related topics Explicit proxy