topic Re: External ArcGIS Server Services in AGO Web Maps/External Applications in ArcGIS Enterprise Questions

External ArcGIS Server Services in AGO Web Maps/External Applications

KristinJ — Thu, 17 May 2018 23:12:28 GMT

I have a story map that is hosted on one of our external web servers here https://maps.hillsboro-oregon.gov/LandUseGallery/index.html; it currently uses AGO-hosted services and I’d like to redirect the web maps used in the app to services from another external web server in the DMZ where we’ve installed ArcGIS Server 10.3.1. On the external ArcGIS Server we’ve enabled SSL and the server has a CA signed cert, and it’s configured to pass traffic on both HTTP and HTTPS. I am able to add secured https services to ArcGIS Online from our external ArcServer, add them to a web map and they’re visible when I’m on our internal network, but the services are not visible outside our network. If I add one to a web map that’s available to everyone when I try to load the web map outside our network it just times out eventually. If I look in the console when viewing the web map on our network I’m getting a 400 error for the service coming from the external ArcServer. I believe the solution to my issue as far as replacing the services in our external story map is to install the web adaptor with our Maps site on our external web server, correct? I’m also wondering if there’s anything additional to be done (configuration in IIS, or?) on the DMZ server where ArcGIS Server is installed?

Re: External ArcGIS Server Services in AGO Web Maps/External Applications

BillFox — Fri, 18 May 2018 15:31:31 GMT

Is that just happening with the edge web browser?

Re: External ArcGIS Server Services in AGO Web Maps/External Applications

KristinJ — Fri, 18 May 2018 15:38:17 GMT

No, in Chrome and in Firefox. Don't usually use Edge, so I have not tested outside our network using Edge yet.

Re: External ArcGIS Server Services in AGO Web Maps/External Applications

BillFox — Fri, 18 May 2018 16:22:43 GMT

Is this the url that is not working for you?

Land Use Gallery - City of Hillsboro, Oregon

Re: External ArcGIS Server Services in AGO Web Maps/External Applications

BillFox — Fri, 18 May 2018 16:23:54 GMT

https://maps.hillsboro-oregon.gov/LandUseGallery/index.html

Re: External ArcGIS Server Services in AGO Web Maps/External Applications

RandallWilliams — Fri, 18 May 2018 16:26:28 GMT

It would be helpful to see your how the traffic flows. I believe I found your external GIS server by looking at the traffic from Hillsboro Maps , but I don't want to advertise the URL in a public forum like this. If the URL associated with the story map referenced as Hillsboro Maps is the server you're referring to, it doesn't appear that HTTPS is enabled, but that's just based on what I observe from here.

Re: External ArcGIS Server Services in AGO Web Maps/External Applications

KristinJ — Fri, 18 May 2018 16:39:36 GMT

This is working externally, because currently the services used in the web maps in the app are hosted on AGO. I would like to replace these with services form the external ArcServer.

Re: External ArcGIS Server Services in AGO Web Maps/External Applications

KristinJ — Fri, 18 May 2018 16:42:12 GMT

The services used in the Hillsboro Maps application are coming from the external ArcGIS server. That external ArcGIS server is enabled to pass traffic on both HTTP and HTTPS. The services used in the Hillsboro Maps application is using are HTTP at present.

With regard to how the traffic flows, can you expand on your question please? Thanks.

Re: External ArcGIS Server Services in AGO Web Maps/External Applications

BillFox — Fri, 18 May 2018 16:50:13 GMT

Re: External ArcGIS Server Services in AGO Web Maps/External Applications

RandallWilliams — Fri, 18 May 2018 16:52:09 GMT

OK. I can reach the services directory for the web server providing maps for the Hillsboro Maps application from my office over port 6080, but not 6443 - and not over 80 or 443 either. I think that's the issue, since story maps require HTTPS these days. My guess is that you have port forwarding configured at the router level to forward traffic internally on port 6080, but not 6443. Personally, I'd keep the GIS Server internal, install the web adaptor on the DMZ machine, and allow the web adaptor machines IP access to the GIS Server on ports 6080/6443.

An Important Message About Web Security and Story Maps

Re: External ArcGIS Server Services in AGO Web Maps/External Applications

KristinJ — Fri, 18 May 2018 17:35:37 GMT

Yup, I'm aware of the fact that story maps require HTTPS services these days, and the services that I've added into a web map in AGO to test (which are coming form the external ArcGIS server in the DMZ) are HTTPS - but they're not visible outside the network. Likely as you note above because of the port forwarding configuration. But exposing 6443 would not be a best practice, thus the web adaptor, correct?

For the Hillsboro Maps application the web adaptor is installed for the aerial photo service which is on an internal ArcServer. But it uses other services from the DMZ ArcServer on 6080. I will confirm with network folks that "port forwarding is configured at the router level to forward traffic internally on port 6080, but not 6443". Thanks for the suggestions!

Re: External ArcGIS Server Services in AGO Web Maps/External Applications

RandallWilliams — Fri, 18 May 2018 17:40:22 GMT

Correct, using the web adaptor instead of exposing the GIS Server on ports 6080/6443 is best practice.