--- schema_version: "1" id: ba7c61921f69d9a6456f78494e8a96c779fedf40cdf080cdd88de4bc381f1ecf title: Connect the Agent Through a Proxy Server collection: mulesoft version: current locale: en-us portal_url: https://docs.salesforce.com/mulesoft/current/en-us/runtime-manager/rtm-agent-proxy-config.md canonical_url: https://docs.mulesoft.com/runtime-manager/rtm-agent-proxy-config source_site: docs.mulesoft.com content_type: documentation content_hash: 38ffe189fcd993ea8c2188c9948718d70f5e8a8718f5b363287ee7d079195695 description: MuleSoft Documentation Site latest: true --- --- product: Runtime Manager keywords: agent, runtime manager, mule, esb, servers, monitor, notifications, external systems, third party, get status, metrics --- # Connect the Agent Through a Proxy Server > For the full documentation index, see: https://docs.mulesoft.com/llms.txt [![logo hybrid active](/mulesoft/current/en-us/_/img/icons/hybrid-cloud.svg "Hybrid")Hybrid](deployment-strategies#hybrid-deployments)[ ![logo server active](/mulesoft/current/en-us/_/img/icons/server-cloud.svg "Anypoint Platform PCE")Private Cloud Edition](deployment-strategies#anypoint-platform-private-cloud-edition) > [!NOTE] Where possible, we changed noninclusive terms to align with our company value of Equality. > We maintained certain terms to avoid any effect on customer implementations. If your Mule runtime engine runs inside a firewall that restricts external communication through a proxy server, you can configure the Runtime Manager agent to route traffic through the proxy server to Runtime Manager. The Runtime Manager agent supports the basic access and Kerberos v5 (via SPNEGO) authentication schemes for proxied communication. ## Configure the Agent to Connect Through a Proxy Server To configure the agent to connect through a proxy server, you must: - Run the `amc_setup` command to create the `$MULE_HOME/conf/mule-agent.yml` file. - Set up your proxy server configuration in the `$MULE_HOME/conf/wrapper.conf` file. ### Run amc\_setup to Create mule-agent.yml If you have previously installed the Runtime Manager agent and want to change the configuration to use a proxy, you can add the proxy configuration to the `mule-agent.yml` file. To configure the proxy server connection: 1. If you want to encrypt passwords in the `mule-agent.yml` file, set the `AGENT_VAR_master_password` environment variable to the main password: `export AGENT_VAR_master_password=myPassword` 2. Run this command: For basic authentication, the -P parameter sets up the authenticated proxy. ```console $MULE_HOME/bin/amc_setup -H token server-name -P proxy-host proxy-port proxy-user proxy-password ``` For Kerberos authentication, use the new parameter to specify that this protocol will be used along with the configuration file paths. ```console $MULE_HOME/bin/amc_setup -H token server-name -P proxy-host proxy-port proxy-user proxy-password --use-kerberos-proxy krb5-configuration-path jaas-configuration-path ``` If the proxy server doesn’t require authentication, omit _proxy-user_ and _proxy-password_. These options are required when using Kerberos authentication via _\--use-kerberos-proxy_. - **amc\_setup -P parameters:** _proxy-host_ Specifies the hostname of the desired proxy server: for example, `proxy.acme.com`. Do not include `http://` or `https://` in the hostname. _proxy-port_ Specifies the port of the desired proxy server. _proxy-user_ Optionally specifies the user with which to authenticate against the proxy, if required. _proxy-password_ Optionally specifies the password for the authentication _proxy-user_, if required. - **amc\_setup --use-kerberos-proxy parameters:** _krb5-configuration-path_ Specifies the file path to the `krb5.conf` file, which is required to communicate with the Kerberos KDC. This is Kerberos flavor-dependent. See the [MIT Kerceros Documentation](https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html) for reference on the MIT implementation, which is the standard in most UNIX and Windows systems. _jaas-configuration-path_ Specifies the file path to the JAAS login configuration file, which is required to login to the Kerberos KDC. See [JAAS Login Configuration File](https://docs.oracle.com/javase/8/docs/technotes/guides/security/jgss/tutorials/LoginConfigFile.html) for a reference on this file format. This example configures the agent to work with a proxy server (`acme.proxy.com`) and specifies a Runtime Manager token: ```console amc_setup -H myToken myMuleServer -P acme.proxy.com 443 ``` This example configures the agent to work with a proxy server that requires authentication: ```console amc_setup -H myToken myMuleServer -P acme.proxy.com 443 internalAdmin Ins1d3V0icePassword ``` ### Set Up Proxy Server Configuration in the wrapper.conf File To specify proxy server configuration in the `$MULE_HOME/conf/wrapper.conf` file, add your proxy server information to the following properties: - `wrapper.java.additional.=-Danypoint.platform.proxy_host={hostname}` - `wrapper.java.additional.=-Danypoint.platform.proxy_port={port}` - `wrapper.java.additional.=-Danypoint.platform.proxy_username={username}` - `wrapper.java.additional.=-Danypoint.platform.proxy_password={password}` > [!IMPORTANT] These are additional parameters to pass to Java when it is launched. The element > refers to the number of additional parameters in the configuration. It is indicated with an > integer number counting up from `1` and must follow a sequence without any gaps. ## Verify That the Proxy Server Does Not Modify the Runtime Manager Certificate To ensure that your firewall or proxy does not intercept or modify the Runtime Manager certificate, run one of the following commands, depending on the version of your Runtime Manager agent. The commands run a probe to determine whether the firewall or proxy is tampering with the certificate. - Agent versions 1.12.0 and later, and 2.2.0 and later: ```console echo -e "GET / HTTP/1.0\r\n" | openssl s_client -connect runtime-manager.anypoint.mulesoft.com:443 -ign_eof ``` The output of this command should include the following information: ```console -----END CERTIFICATE----- subject=/C=US/ST=California/L=San Francisco/O=salesforce.com, inc./CN=runtime-manager.anypoint.mulesoft.com issuer=/C=US/O=DigiCert Inc/CN=DigiCert TLS RSA SHA256 2020 CA1 ``` If the expected information does not appear in the output, contact your networking team with the `openssl` command’s output. ## Known Issues
IssueDescription

SE-8011

Agent setup returns 407 Proxy Authentication Required when passing proxy information during setup.

## See Also - [Encrypt Passwords in an Existing mule-agent.yml File](https://docs.mulesoft.com/runtime-manager/installing-and-configuring-runtime-manager-agent#encrypt_password) - [How to troubleshoot communication issues between the Mule Runtime Agent and the OnPrem server](https://help.salesforce.com/s/articleView?id=001116969&type=1).