topic Re: Enterprise deployment with different external/internal domains in ArcGIS Enterprise Questions

Re: Enterprise deployment with different external/internal domains

vijaybadugu — Tue, 13 Jun 2023 16:47:41 GMT

I have Question regarding configuration of DMZ with Single machine Deployment, we have been struggling to configure reverse proxy for ArcGIS Enterprise. We recently Upgraded the Enterprise to 11.1. All components are on Same Windows Server (2 WA's, Server, Data store and Portal) Federated IWA. We have Configured the load balancer on DMZ Server and opened the 443 to route the traffic from DMZ . Here is the Our requirement, Suppose User or member accessed the URL from External, It should route from the DMZ (Split DNS). If user accessed from Internal network, it should hit Direct server (IWA) instead of Routing From DMZ. Is this Possible ? If yes, How I need to configure those ? Please help us .

Re: Enterprise deployment with different external/internal domains

LanceCole — Wed, 14 Jun 2023 15:22:53 GMT

@vijaybadugu,

I can emphasize your struggles.

You will want to place the IIS server in your DMZ along with both of your web adapters. The web adapters will serve as a reverse proxy forwarding portal.external.com to portalserver.internal.domain:7443. This does require the 443 to be open on your external firewall and 7443 to be open on your internal firewall.

A split DNS is required where your portal.external.com IP is sent to your DMZ IIS IP via a NAT through your external firewall and internal DNS is sent directly to your DMZ IP for portal.external.com. Please keep in mind all traffic for your portal web adapter can only utilize one URL - portal.external.com for both internal and external usage.

You will also need a public verifiable CA certificate for your external domain that will be used for your portal. For example - portal.external.com. If you have an internal CA you will need to add the authentication roots to the ArcGIS portal and server. Alternatively, you can copy the self-signed certificates to each system.

One configuration change is needed in Portal Administrator Directory. Navigate to Home > System > Properties and set {“WebContextURL”:”https://portal.external.com/portal”}

There is a video on YouTube detailing this process but I cannot find the link at the moment.

I highly recommend reaching out to ESRI Support, they have a great team and are very helpful.

Re: Enterprise deployment with different external/internal domains

vijaybadugu — Tue, 13 Jun 2023 18:46:57 GMT

Thanks for your suggestions on our struggles. I am a developer and not sure about Network side configurations. We configured load balancer and webcontextURL as you mentioned in your post. Whenever we access the site from internal network, it is going to route from the DMZ and it shouldn't. DNS Split does most of the functionality. The problem here is, don't have any documentation or Video to understand and configure which suites for our organization. I have already contacted the ESRI Support team regarding the same, But, They were saying, it is out of scope for them.

Re: Enterprise deployment with different external/internal domains

LanceCole — Tue, 13 Jun 2023 19:31:29 GMT

Take a look at these videos:

https://www.youtube.com/watch?v=wvLlzqa1-BA

https://www.youtube.com/watch?v=lMl4hTX8rGs

Re: Enterprise deployment with different external/internal domains

vijaybadugu — Tue, 13 Jun 2023 20:57:38 GMT

I didn't find anything related to DMZ configurations. these videos contains installation process and configurations.

Re: Enterprise deployment with different external/internal domains

Marc_Graham — Wed, 14 Jun 2023 02:50:50 GMT

Does this diagram help explain? You need internal and external web adaptors. These all need to be registered with portal and server using their machine names to allow multiple web adaptors. You then set the webcontexturls in portal and server to the proper url.

https://enterprise.arcgis.com/en/web-adaptor/latest/install/iis/configure-multiple-arcgis-web-adaptors.htm

Re: Enterprise deployment with different external/internal domains

vijaybadugu — Wed, 14 Jun 2023 13:23:32 GMT

We have configured AZURE AD for authenticate SAML for internal and external. is that best practice to go farward

Re: Enterprise deployment with different external/internal domains

A_Wyn_Jones — Wed, 14 Jun 2023 15:00:32 GMT

Hi Lance,

Not sure if what you typed was a Typo but thought it's worth clarifying your great post.

It's WebContextUrl not "Content"

The documentation for which is here: https://enterprise.arcgis.com/en/portal/latest/administer/windows/using-a-reverse-proxy-server-with-portal-for-arcgis.htm#:~:text=WebContextURL%20property

Re: Enterprise deployment with different external/internal domains

LanceCole — Wed, 14 Jun 2023 15:25:00 GMT

Thanks, Typo on my part. Corrected.

Re: Enterprise deployment with different external/internal domains

Marc_Graham — Wed, 14 Jun 2023 21:28:23 GMT

Yes that is good practice.