0

In my organization there is an installation of ArcGIS Server that is linked with an Enterprise geodatabase (PostgreSQL) in a DMZ for editing only over the web.

However, we have another installation of ArcGIS Server that is linked with an Enterprise geodatabase (SQLServer) for internal use only. The main data of the organization are stored in the internal SQLServer, and its not accessible from the web.

We use some automatization tools to copy edited data from PostgreSQL to SQLServer and vice versa, but the desynchronization is becoming a problem.

The DMZ was designed to prevent putting our data at risk. However, we know there is many organizationd that don't really care about that, and are not afraid to expose their main database through the web.

We would like to study the possibility to let ArcGIS Server to have read and write access to our main database over the web and at the same time removing the DMZ.

What could be the issues of doing such change in our organization? Is there some way to attenuate the risks if such risks exist?

  • If ArcGIS server has read write to a database that alone doesn't expose it to the web. To expose tables to the web a Feature Access services, and map services with Feature Access and WFS enabled are required. If you leave these services wide open then yes, there is a risk of exposure. If you authenticate the services, then they are not accessible. If internally there is a concern that records will be added, deleted or updated then uncheck these capabilities. The DMZ can be used for access to the services and the endpoint for the ArcGIS server can not be set to be externalized only internal. – enolan Jun 18 at 12:45
  • Thank you for your comment! Can you elaborate on your last sentence: "The DMZ can be used for access to the services and the endpoint for the ArcGIS server can not be set to be externalized only internal." – Below the Radar Jun 18 at 12:58
  • 1
    VIPs (virtual IP addresses) that are configured through DMZs can be internal or external. If the ArcGIS server is setup to sit behind the DMZ (as a member) then external access to the VIP can be "blocked" and only internal access allowed. I.e. if someone outside of your network tries to access VIP/arcgis/rest/services, then they will get a page can't display message. The folks that are administering the DMZ on your network should be able to configure this. – enolan Jun 18 at 13:06
  • Computer security is an extremely broad topic, and mixing in heterogeneous bidirectional data distribution through a DMZ doesn't make the task any easier. Your IT support staff may be able to give a better picture of what is possible and what is recommended. – Vince Jun 18 at 13:16
  • @Vince you are right, that's an IT job essentially, but as the specialist of the ArcGIS Server component, I just want to gather some basic notions to be able to follow them as much as possible (or maybe bring some suggestions if needed). – Below the Radar Jun 18 at 13:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.