Configure the Appliance in Explicit Proxy Mode - Netskope Technical Documentation

In the explicit proxy mode, the appliance acts as a proxy server or integrates with the existing proxy servers in the network to serve as the explicit proxy for the cloud app domains. You can make the appliance an explicit proxy server using the following methods.

Configure the proxy hostname and port
Configure the PAC file

Configure the Proxy Hostname and Port

All the network traffic is sent directly to the appliance on a specific port. To configure the proxy hostname and port.

Enable the explicit proxy mode on the appliance, run:
```
set dataplane proxy-mode explicit enable true
```
Configure the default IP address that the appliance uses to listen to the client traffic. This address is the first address configured on the inbound interface.
```
set dataplane proxy-listener-ip 172.16.1.10
```
In appliance version 58 and higher, run the following command.
```
set dataplane proxy-listener-interface dp1
```
(Optional) Specify the TCP port for the explicit proxy. If not specified, the default port is 8080.
```
set dataplane proxy-mode explicit listener-port <port>
```
Starting with Appliance version 121.0.0, you can specify up to 5 ports, separated by commas. The following is an example of specifying multiple ports for explicit proxy:
```
set dataplane proxy-mode explicit listener-port 8888,1000,8080,2002,4500
```

Configure the PAC File

You can direct all the cloud app traffic to the appliance while other traffic can go through your existing proxy server. To do this, the appliance needs to be configured to access the contents of the existing PAC file.

The appliance can be configured in the following two ways:

Use Merged PAC File – The appliance downloads the existing PAC file and in turn hosts a modified PAC file that redirects cloud app traffic to the appliance’s proxy server and retains the PAC file rules for all other traffic.

Use Custom PAC File – Host your customized PAC file directly on the appliance to redirect cloud app traffic to the appliance’s proxy server and all other traffic to your existing proxy server.

Use Merged PAC File

If you want to direct the cloud app traffic to the appliance and the web traffic to your existing proxy server, configure the merged PAC file server on the appliance.

Open an nsshell and enter the command configure.
Set the IP address to host the merged PAC file server on the appliance. If not provided, the IP address of the DNS server is used if it is configured:
```
set dataplane pac-server listener-ip <PAC server IP>
```
In appliance version 58 and higher, run the following command.
```
set dataplane pac-server listener-interface <PAC server interface>
```
Set the TCP port to host the merged PAC file server on the appliance:
```
set dataplane pac-server listener-port <PAC server port>
```

Set the URL of the existing PAC file server:

set dataplane pac-server url http://wpad.yourdomain.com/wpad.dat

Enable the PAC file server:
```
set dataplane pac-server enable true
```
Save the configuration:
```
save
```
The PAC file will be hosted at http://<PAC server IP>:<pac-server-port>/wpad.dat and http://<PAC server IP>:<pac-server-port> /proxy.pac.
Enable the explicit proxy mode for the appliance by doing the following:
```
set dataplane proxy-mode explicit enable true
```
Optionally, specify the fully-qualified domain name that resolves to the IP configured for the appliance. This host name will be used in the merged PAC file. If this setting is not provided, the appliance IP will be present in the merged PAC file.
```
set dataplane pac-server explicit-proxy-hostname <vaproxy.yourdomain.com>
```
Optionally specify the TCP port for hosting the appliance explicit proxy. The default port used by the appliance is 8080.
```
set dataplane proxy-mode explicit listener-port <explicit proxy port>
```
Save the configuration.
```
save
```

Use a Custom PAC File

If you want to host your customized PAC file directly on the appliance.

Open an nsshell and enter the command configure.
Set the IP address to host the merged PAC file server on the appliance. If not provided, the IP address of the DNS server is used if it is configured:
```
set dataplane pac-server listener-ip <PAC server IP>
```
In appliance version 58 and higher, run the following command.
```
set dataplane pac-server listener-interface <PAC server interface>
```
Set the TCP port to host the merged PAC file server on the appliance:
```
set dataplane pac-server listener-port <PAC server port>
```
Paste the contents of the PAC file server:
```
set dataplane pac-server custom-pac
```
Enable the PAC file server:
```
set dataplane pac-server enable true
```
Save the configuration:
```
save
```
The PAC file will be hosted at http://<PAC server IP>:<pac-server-port>/wpad.dat and http://<PAC server IP>:<pac-server-port> /proxy.pac.
Enable the explicit proxy mode for the appliance by doing the following:
```
set dataplane proxy-mode explicit enable true
```
Optionally, specify the fully-qualified domain name that resolves to the IP configured for the appliance. This host name will be used in the merged PAC file. If this setting is not provided, the appliance IP will be present in the merged PAC file.
```
set dataplane pac-server hostname <vaproxy.yourdomain.com>
```
Optionally specify the TCP port for hosting the appliance explicit proxy. The default port used by the appliance is 8080.
```
set dataplane proxy-mode explicit listener-port <explicit proxy port>
```
Save the configuration.
```
save
```

Configuring an Explicit Proxy Chain

In explicit proxy mode, the appliance can work with other explicit proxy server in the network to load balance the network traffic. The appliance sends HTTP requests to the third-party proxy server to establish an explicit proxy chain. When the connection between the appliance and the third-party proxy server is successful, a tunnel is established to send and receive client requests that are trying to reach the cloud apps.

If you want to create an explicit proxy chain between the appliance and your existing third-party proxy server, run:

set dataplane explicit-proxy-chaining hostname <hostname or IP address>
set dataplane explicit-proxy-chaining port <port>
set dataplane explicit-proxy-chaining enable true

Enable SAML Authentication on the DPoP Appliance

Configure the proxy hostname and port
Configure the PAC file

Configure the Proxy Hostname and Port

All the network traffic is sent directly to the appliance on a specific port. To configure the proxy hostname and port.

Enable the explicit proxy mode on the appliance, run:
```
set dataplane proxy-mode explicit enable true
```
Configure the default IP address that the appliance uses to listen to the client traffic. This address is the first address configured on the inbound interface.
```
set dataplane proxy-listener-ip 172.16.1.10
```
In appliance version 58 and higher, run the following command.
```
set dataplane proxy-listener-interface dp1
```
(Optional) Specify the TCP port for the explicit proxy. If not specified, the default port is 8080.
```
set dataplane proxy-mode explicit listener-port <port>
```
Starting with Appliance version 121.0.0, you can specify up to 5 ports, separated by commas. The following is an example of specifying multiple ports for explicit proxy:
```
set dataplane proxy-mode explicit listener-port 8888,1000,8080,2002,4500
```

Configure the PAC File

The appliance can be configured in the following two ways:

Use Custom PAC File – Host your customized PAC file directly on the appliance to redirect cloud app traffic to the appliance’s proxy server and all other traffic to your existing proxy server.

Use Merged PAC File

If you want to direct the cloud app traffic to the appliance and the web traffic to your existing proxy server, configure the merged PAC file server on the appliance.

Open an nsshell and enter the command configure.
Set the IP address to host the merged PAC file server on the appliance. If not provided, the IP address of the DNS server is used if it is configured:
```
set dataplane pac-server listener-ip <PAC server IP>
```
In appliance version 58 and higher, run the following command.
```
set dataplane pac-server listener-interface <PAC server interface>
```
Set the TCP port to host the merged PAC file server on the appliance:
```
set dataplane pac-server listener-port <PAC server port>
```

Set the URL of the existing PAC file server:

set dataplane pac-server url http://wpad.yourdomain.com/wpad.dat

Enable the PAC file server:
```
set dataplane pac-server enable true
```
Save the configuration:
```
save
```
The PAC file will be hosted at http://<PAC server IP>:<pac-server-port>/wpad.dat and http://<PAC server IP>:<pac-server-port> /proxy.pac.
Enable the explicit proxy mode for the appliance by doing the following:
```
set dataplane proxy-mode explicit enable true
```
Optionally, specify the fully-qualified domain name that resolves to the IP configured for the appliance. This host name will be used in the merged PAC file. If this setting is not provided, the appliance IP will be present in the merged PAC file.
```
set dataplane pac-server explicit-proxy-hostname <vaproxy.yourdomain.com>
```
Optionally specify the TCP port for hosting the appliance explicit proxy. The default port used by the appliance is 8080.
```
set dataplane proxy-mode explicit listener-port <explicit proxy port>
```
Save the configuration.
```
save
```

Use a Custom PAC File

If you want to host your customized PAC file directly on the appliance.

Open an nsshell and enter the command configure.
Set the IP address to host the merged PAC file server on the appliance. If not provided, the IP address of the DNS server is used if it is configured:
```
set dataplane pac-server listener-ip <PAC server IP>
```
In appliance version 58 and higher, run the following command.
```
set dataplane pac-server listener-interface <PAC server interface>
```
Set the TCP port to host the merged PAC file server on the appliance:
```
set dataplane pac-server listener-port <PAC server port>
```
Paste the contents of the PAC file server:
```
set dataplane pac-server custom-pac
```
Enable the PAC file server:
```
set dataplane pac-server enable true
```
Save the configuration:
```
save
```
The PAC file will be hosted at http://<PAC server IP>:<pac-server-port>/wpad.dat and http://<PAC server IP>:<pac-server-port> /proxy.pac.
Enable the explicit proxy mode for the appliance by doing the following:
```
set dataplane proxy-mode explicit enable true
```
Optionally, specify the fully-qualified domain name that resolves to the IP configured for the appliance. This host name will be used in the merged PAC file. If this setting is not provided, the appliance IP will be present in the merged PAC file.
```
set dataplane pac-server hostname <vaproxy.yourdomain.com>
```
Optionally specify the TCP port for hosting the appliance explicit proxy. The default port used by the appliance is 8080.
```
set dataplane proxy-mode explicit listener-port <explicit proxy port>
```
Save the configuration.
```
save
```

Configuring an Explicit Proxy Chain

If you want to create an explicit proxy chain between the appliance and your existing third-party proxy server, run:

set dataplane explicit-proxy-chaining hostname <hostname or IP address>
set dataplane explicit-proxy-chaining port <port>
set dataplane explicit-proxy-chaining enable true

Enable SAML Authentication on the DPoP Appliance