My organization is trying to get our web maps up and running. I have created a simple web map service on our in house ArcGIS server, using the Arcgis flexviewer that is visible locally, works great, and is visible on arcgis.com.

We have a 2 server set up where Server A is our internal server that everyone in the company stores their data on. this is the machine we have our install of ArcGIS 10.1 for server on. It is not public, and for internal staff use only.Server B on the other hand is off site and set up by a company that hosts our website to specifically host our web maps. It is in a DMZ and set up to get through our company firewall. It is just a simple web server running IIS 7 and has the ArcGIS Web Adaptor installed .They, like me, have no experience in setting something like this up so I'm learning as much as I can along the way..

We have our flex map up and running [here] which is great. What is not so great is the error that is popping up when the flex map is opened. It looks like my data, which consists of a a few poly lines, some points and some labels, are not making it over to Server B from Server A. I guess my real question is what do I need to do to get the data from Server A show up in my flex app on server B.

If anyone can shed some light on this that would be great.

  • where is the data? btw pls edit the original question with responses
    – Brad Nesom
    Apr 24, 2013 at 22:05
  • The data resides on GIS server on site. What do you mean "pls edit the original question with responses" I don't understand. I'm new to stack exchange.
    – cl3
    Apr 24, 2013 at 22:40
  • 1
    @cl3, Brad literally means to click the edit link at the bottom-left of your post (share, edit, flag) and modify the post slightly to work-in your answer to his question. As a bonus, this will also keep your thread toward the top of the active list. :)
    – elrobis
    Apr 24, 2013 at 22:55

2 Answers 2


[overhauled answer to address the OP's comments]

@cl3, nice job getting your mapping application in the public web scope. When I run your app with Fiddler open, I do see that it's trying to fetch a crossdomain.xml policy file.

In the root of your web scope (i.e. whatever resolves exclusively to nwrpdc2012.com), create a file there named crossdomain.xml, and inside it paste the following block:

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
    <site-control permitted-cross-domain-policies="all"/>
    <allow-access-from domain="*"/>
    <allow-http-request-headers-from domain="*" headers="*"/>

If your problem goes away, read up on crossdomain policy files and decide if you want to make it more restrictive. Obviously this one is very tolerant of off-domain requests.

  • Unfortunately I already have that 'crossdomain.xml' file in C:\inetpub\wwwroot. But I still get the error. any idea what else could be causing it?
    – cl3
    Apr 25, 2013 at 21:53
  • @cl3, Fiddler is showing a 500-range error, specifically 502 (in contrast to a 404 file not found), which suggests there is actually something wrong at the service level.. when I use the Fiddler inspector, it tells me [Fiddler] DNS Lookup for "nwrpdc2012" failed. No such host is known. ...what is nwrpdc2012? As this is not in the map's domain/url. Is it another server that is involved?
    – elrobis
    Apr 25, 2013 at 22:02
  • Yes nwrppdc2012 is our internal server where we store our company data and have our installation of ArcGIS for Server. I tried to clarify my original posted question above to explain a little better.
    – cl3
    Apr 26, 2013 at 14:56
  • Hey there @cl3, I tried hitting your site again and it's still throwing the same error. My guess is your Flex app is on one system (or at least a system with a different domain name), and your GIS Server is on another system (or again, behind a different domain). Which ever system that corresponds to nwrppdc2012 is the one needing the crossdomain.xml, not the one with the flex app. You should put the policy file in the root of the web scope for nwrppdc2012, or at the very least, in the same directory as whatever resources your flex app is requesting. Does this make sense?
    – elrobis
    Apr 26, 2013 at 20:02
  • Yeah that make sense. I still think I am missing a few pieces of this puzzle. Thanks for trying to lend me a hand with this. I really appreciate it.
    – cl3
    Apr 26, 2013 at 20:58

IF you don't plan on securing your REST services from the outside world:

  • Place your flexviewer 'app' (folder) on your internal web root. This will create a path to your viewer. ie http:\mydomain.com\flexViewer where flexViewer is sitting in your webroot.

This will enable your viewer to be accessible through your webserver. There is nothing to this step, unsure why you are having issues here (if you indeed are). Your flex viewer will call your AGS server from inside your domain.

  • On your DMZ, using a proxy outside of your firewall instead of your webserver, keeping your web server AND AGS inside, is a great start to securing your system.

  • We use nginx, but apache is also very, very easy. You want mod_proxy module. You will add five lines to your apache httpd (or referenced proxy) conf file:

    ServerName www.myDomain.com #your domain registered on your proxy
    ProxyRequests Off #for normal proxy (you are using reverse)
    ProxyPreserveHost On
    ProxyPass / #internal webserver IP
    ProxyPassReverse /


Believe it or not, this is all that is required to configure a basic reverse proxy. (Disclaimer I am not a security guy!)

  • Set your firewalls accordingly on all servers, to allow access between WWW-AGS servers.

This setup creates a basic setup that works for most uses: PROXY <--> ///firewall/// <--> AGS-WWW

I probably missed something - anyone? The process should be really easy, if you have a working flexViewer talking to and consuming Arc Services already!

If you need your REST services secured, you've got a bit more work to do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.