topic Re: Can not access my ArcGIS server externally in ArcGIS Enterprise Questions

Can not access my ArcGIS server externally

Chang-HengYang — Thu, 23 Feb 2017 22:48:14 GMT

I am trying to access my GIS server outside the server itself. But, I have trouble and tried to solve this problem by different solutions.

The background of my server

I have Windows 2012 Server x64 with SQL Server 2012.

I'm also using IIS 8 as a web server on the same machine.

I've installed ArcGIS for Server 10.3.1 and only used the "register folder" to store feature class in the file geodatabase.

I do not use the Web Adaptor. The Authentication Tier (security) inside the ArcGIS manager is "GIS Server"

I can access the url ("http://stateparkmap.okstate.edu:6080/arcgis/rest/services") inside the server. However, I can not access the url externally by browsers (IE, Chrome and Firefox) either by wifi or ethernet. In addition, I have disabled the proxy for these browsers. The message show "resource is online but is not responding to connection" on IE or "Failed to load resource: net::ERR_CONNECTION_TIMED_OUT" on Chrome.

I have installed the DNS server to bind the ip address with the domain (stateparkmap.okstate.edu). In addiiton, I can access to the http://stateparkmap.okstate.edu/index.html outside the server.

Could you share your precious opinions for this problem?

Thanks,

Hank

Re: Can not access my ArcGIS server externally

RebeccaStrauch__GISP — Thu, 23 Feb 2017 22:57:01 GMT

Drop the ":6080" which is for internal purposes, that is directly to the machine. For IIS, it should us port 80 which is assumed typically (for non secure). But I see if I put in

http://stateparkmap.okstate.edu/arcgis/rest/services

it prompts for a log in, so you really want to get https put in place (and SSL cert). which uses 6443 internally, and 443 in IIS.

Re: Can not access my ArcGIS server externally

JonathanQuinn — Fri, 24 Feb 2017 01:18:07 GMT

In addition to Rebecca Strauch, GISP‌ comments on dropping 6080, (you likely don't expose 6080 outside of your network), it appears that you have Windows Authentication enabled on the web site, given the 401 that's returned when reaching your services URL. Even going as far back as simply the hostname and domain returns the 401, (http://stateparkmap.okstate.edu), again, indicating you have Windows Authentication enabled on the web site. If you plan to provide people external to your network access to your services, you should not enable Windows Authentication on the external endpoints. If you want IWA internally, register another web adaptor and configure it with IWA.

Re: Can not access my ArcGIS server externally

Chang-HengYang — Fri, 24 Feb 2017 18:22:10 GMT

Hi Rebecca,

I appreciate your opinions. I followed your instructions and accessed the website (http://stateparkmap.okstate.edu/arcgis/rest/services). Then I used my username and password. The message was shown on the screen "404 - File or directory not found." Do I need to install the server files into the Application (binding with "http://stateparkmap.okstate.edu") folder rather than the default path"C:\Program Files\".

The physical path for the Application is in the D:\App_Test.

Could anyone provide your insights?

Thanks,

Hank

Re: Can not access my ArcGIS server externally

ScottFierro2 — Fri, 24 Feb 2017 19:02:23 GMT

So I agree with both Rebecca Strauch, GISP‌ and Jonathan Quinn‌ I am trying to wrap my head around where the real issue lies but it feels like IIS.

You said you can get to http://stateparkmap.okstate.edu:6080/arcgis/rest/services which means your name is being resolved correctly otherwise you'd fail and only have access over http://<ServerName>:6080/arcgis/rest/services However as they mentioned 6080 is your internal exposed port for direct connections.

Accessing either http://stateparkmap.okstate.edu/index.html or http://stateparkmap.okstate.edu/arcgis/rest/services both trigger the IWA login prompts.

So starting with IIS and working backwards if you go into IIS for stateparkmap.okstate.edu and go into your Authentication it would need to look like this (which is what Jonathan Quinn‌) is referencing

It seems as though your current configuration has "Windows Authentication" set as "Enabled"

If for some reason once you ensure this is how the site is configured the next thing to try would be on the right side of IIS for the site you can browse so if you choose " Browse localhost on *:80 (http)" what are you getting?

Re: Can not access my ArcGIS server externally

JonathanQuinn — Fri, 24 Feb 2017 19:30:11 GMT

Do you have the web adaptor installed? If so, have you installed it in the Default Web Site or your new web site? Your Default Web Site is stopped so if you're using the Web Adaptor you'll need to check where you installed it and reinstall it in your stateparkmap.okstate.edu website if it's not installed there.

Re: Can not access my ArcGIS server externally

Chang-HengYang — Fri, 24 Feb 2017 20:11:36 GMT

Hi Scott,

I appreciate your all precious opinions. My original setting for the Window Authentication was Enabled. But now is "Disabled". The setting for the Anonymous Authentication is "Enabled" and "Application pool identity".

The permission for the Application (App_Test) was also shown below. I also set the permission for the IIS_IUERS (But not including "Everyone").

In addition, I could see the content in the index.html when clicking the "*:80 (http)".

However, I still can not access the rest server site externally(http://stateparkmap.okstate.edu/arcgis/rest/services ).

Thanks,

Hank

Re: Can not access my ArcGIS server externally

Chang-HengYang — Fri, 24 Feb 2017 20:13:53 GMT

Hi Jonathan,

I appreciate your opinions. I do not install the web adaptor. My default web site is stopped.

Thanks,

Hank

Re: Can not access my ArcGIS server externally

JonathanQuinn — Fri, 24 Feb 2017 20:41:25 GMT

So it appears that IIS is working on HTTP and HTTPS without any authentication challenges, which was the first hurdle. Now you need to decide what you want in the front of the Server. The Web Adaptor is essentially a reverse proxy/load balancer. This sends traffic from 80/443 to 6080/6443. You can also use your own reverse proxy to send traffic from 80/443 to 6080/6443. Currently, it doesn't seem like you have anything in place to connect your front end web server to your back end ArcGIS Server. You've also exposed the Server directories, (it appears some install files and directories), to the public. This is a pretty big problem. I strongly suggest you disable directory browsing on the

stateparkmap.okstate.edu Web Site, delete the ArcGISServer directory from your inetpub folder, and work with your IT staff on best practices for web servers.

Re: Can not access my ArcGIS server externally

RebeccaStrauch__GISP — Mon, 27 Feb 2017 17:29:22 GMT

I would have to agree with Jonathan Quinn statement:

I strongly suggest you disable directory browsing on the
stateparkmap.okstate.edu Web Site, delete the ArcGISServer directory from your inetpub folder, and work with your IT staff on best practices for web servers.

or contact esri tech support. They could help more with the specifics of you setup.

When hitting your http://stateparkmap.okstate.edu/arcgis/rest/services site, the first time I was prompted for the authentication (with http, i.e. not a secure connection) and I cancelled.

Re: Can not access my ArcGIS server externally

Chang-HengYang — Tue, 21 Mar 2017 15:54:51 GMT

Hi all,

I appreciate your all valuable in this issue. The solution is to create the new rule in the inbound Rules in the "Windows Firewall with Advanced Security". The rule is to add the inbound rule to allow the ports such as 6443 and 6080 open to the public.

Now, the public can access the ArcGIS REST Services Directory externally (the link below). Now, my question is that I tried to access the REST Services Directory by the link below without the port "6080" like "http://stateparkmap.okstate.edu/arcgis/rest/" with the setting in the Reverse Proxy rule. However, I keep having the error message listed below.

Could you all please share valuable opinions to address this issue?

Thanks,

Hank

The link:

http://stateparkmap.okstate.edu:6080/arcgis/rest/

The error message

Re: Can not access my ArcGIS server externally

JonathanQuinn — Tue, 21 Mar 2017 18:51:50 GMT

My suggestion is again, to disable public access to your internal network until you have an understanding of web servers.

More helpfully, though, don't use the reverse proxy rules within IIS. Install the Web Adaptor on the machine that's publicly accessible to the internet and register it with ArcGIS Server.

You'll still need to disable Windows Authentication on the web server.