Moving a Staging ArcGIS Server to the DMZ?

Question

I am trying to move my EDN Arcgis Server with all the mapservices and caches to the DMZ ..

The move is from our intranet to the DMZ to provide access to mapservices to outside world using the internet port 80 or 8080.. Everything is fine when we try accessing applications and mapservices from within our network to this box in the DMZ!!

When it comes to external access it cannot access any ??

I have tried a similar setup using windows xp box in the DMZ! Both internal and external machines can access and works well.. This should account for Network configuration correctness, hopefully..

I am wondering if it has to do with ArcGIS Server on Windows 7 ?? Am I missing something wrt settings with ArcGIS Server or IIS ??

Answer 1

This is going to be a long post. Let's start by making some assumptions that will help us in understanding and hopefully solve your problem.

Once we have ruled out network configuration we can focus on ArcGIS.

You said that you have a server in your intranet (let's forget it is running ESRI software for the moment and just focus on the network setup). Let its ip address be 192.168.1.10 with a netmask of 255.255.255.0 and its name be arcserver.

You would tipically access its services from a url like the following:

 http://192.168.1.10/some/url

or

 http://192.168.1.10:8080/some/url

depending on port configuration (for brevity I will not use port 8080 anymore).

We also gather from your email that this is working and for the moment we assume you only use ip addresses, not names, to consume your server's services.

Now you would like to move this server to the DMZ for the purpose of publishing its services on the internet. This requires that the server's networking be reconfigured. Let's suppose thet your DMZ has a 192.168.2.0/24 addressing scheme.

This means that after connecting the server into the dmz its ip address would become 192.168.2.20 with a netmask of 255.255.255.0. The default gateway has to change too and in your DMZ it is 192.168.2.254 so you configure your server accordingly. I also assume that you disconnected the server from any other network and left only one configured network interface enabled: that connecting to the DMZ.

Now, supposing that cabling is correct and that the configuration has been applied, you should be able to reach your server from your intranet with a url like:

 http://192.168.2.20/some/url

if this works it means we got all the basic networking setup ok. Now the tricky part: accessing your server from the internet.

In most cases this requires that the following actions have been carried out:

1. that you established a NAT on your firewall between the 192.168.2.20 private address and a public ip address that you must have on the firewall. Let's say the the public ip address is X.Y.K.Z . If the firewall has a dynamic ip address take note of the current ip address.

2. you configured your firewall to allow incoming traffic on the external ip address X.Y.K.Z to port 80 or 8080 of the ip address 192.168.2.20 (which is the ip address of the arcgis server in the dmz)

Please note that to complicate matters even more the two steps might have to be carried out in different order depending on your firewall vendor.

Anyway, after your firewall configuration has been modified so that the ip address 192.168.2.20 is accessible from the internet as X.Y.K.Z, call up somebody from outside your private intranet (wife at home would be perfect) and ask her to type this into the browser's address bar:

http://X.Y.K.Z/some/url

(again add the 8080 port as required). It should work and display whatever content you have published on your server.

If you have a dynamic ip address the ip address WILL change whenever the firewall reconnects to your ISP. You want a static public ip address if you want to publish resources reliably on the internet.

If it doesn't work the probable culprit is in the firewall (the network firewall, not the server's firewall which I am sure you have disabled by now). I might be able to help you more if you provide more details on your network setup.

Bootnote: I would lose all the ? and ! in your question, they make us anxious ;-).

Answer 2

Sounds like you need a Reverse Proxy in your setup (based on assumptions as do not administer your network)

"Two Web servers are used in this system architecture: a reverse proxy Web server and the ArcGIS Server Web server. The reverse proxy Web server hides information about the ArcGIS Server Web server running on the internal LAN, such as its real virtual directory names and host name and IP address, from external Internet clients such as Web browsers, Web services clients, and ArcGIS Desktop or Custom ArcEngine applications using Internet connections. The reverse proxy Web server is typically located in a perimeter network also known as a DMZ, demilitarized zone, or screened subnet. Inside the DMZ, the reverse proxy Web server receives incoming HTTP requests from the Internet, usually through an external firewall that restricts traffic to a known port, typically port 80, and redirects them to the ArcGIS Server Web server in the internal LAN through a port in the internal firewall, unknown to the outside world. "

http://support.esri.com/en/knowledgebase/techarticles/detail/32634