How does collaboration actually communicate from Portal to AGOL?

[GWaltersOZ]

Hi,

we have set up Portal to ArcGIS Online collaboration so we understand that it communicates between the two however, we do not understand how it does it.

Our internal server is behind a firewall. The services themselves cannot be reached publicly, so could someone describe the ports etc. that are actually used to send the sync packets please?

This is vital for us to present to our security team. Otherwise it is being viewed as some dark magic and can't be trusted.

Thanks,

Gareth

[JayantaPoddar]

Please check if  Architecting the ArcGIS System: Best Practices and How distributed collaboration works  provides some relevant information.

Frequently asked questions about distributed collaboration may answer some of your questions like

When collaborating between ArcGIS Enterprise and ArcGIS Online, what changes are required to my network's firewall?

In this configuration, all communication is initiated by the ArcGIS Enterprise portal. As such, network firewall rules must support outbound communication over port 443.

[GWaltersOZ]

Thanks @JayantaPoddar  for the note.  I am trying to get something more than the port 443 comment if there is any.

For example, what does it actually send across? Is it just blocks of JSON in each message? Is the data encrypted in the send?

We understand how our applications use API's to send data but this syncing process is not something I seen much about. It is important for our security teams to understand so they know we are sending data securely between the two systems.

[JayantaPoddar]

Please get in touch with the Esri Technical Support. They should be able to guide you through the process.

[KrishnaVenattu]

@GWaltersOZ, 

Did you get to the bottom of this? I'm trying to set up the NSG/firewall rules between ArcGIS Portal in DMZ with internal ArcGIS Enterprise (both on v11.1)  for using distributed collaboration. Though this talks about  out bound access for communication between enterprises via 443 but not detailed enough to create the firewall rules.  Any additional info would be really useful. Thanks 

[GWaltersOZ]

HI @KrishnaVenattu ,

No. The support tech talked about how to set it up. Sorry I couldn't give you any more details.