External ArcGIS Server Services in AGO Web Maps/External Applications

[KristinJ]

I have a story map that is hosted on one of our external web servers here https://maps.hillsboro-oregon.gov/LandUseGallery/index.html; it currently uses AGO-hosted services and I’d like to redirect the web maps used in the app to services from another external web server in the DMZ where we’ve installed ArcGIS Server 10.3.1.  On the external ArcGIS Server we’ve enabled SSL and the server has a CA signed cert, and it’s configured to pass traffic on both HTTP and HTTPS.  I am able to add secured https services to ArcGIS Online from our external ArcServer, add them to a web map and they’re visible when I’m on our internal network, but the services are not visible outside our network.  If I add one to a web map that’s available to everyone when I try to load the web map outside our network it just times out eventually.  If I look in the console when viewing the web map on our network I’m getting a 400 error for the service coming from the external ArcServer.  I believe the solution to my issue as far as replacing the services in our external story map is to install the web adaptor with our Maps site on our external web server, correct?  I’m also wondering if there’s anything additional to be done (configuration in IIS, or?) on the DMZ server where ArcGIS Server is installed?  

[KristinJ]

Yup, I'm aware of the fact that story maps require HTTPS services these days, and the services that I've added into a web map in AGO to test (which are coming form the external ArcGIS server in the DMZ) are HTTPS - but they're not visible outside the network.  Likely as you note above because of the port forwarding configuration.  But exposing 6443 would not be a best practice, thus the web adaptor, correct?

For the Hillsboro Maps application the web adaptor is installed for the aerial photo service which is on an internal ArcServer.  But it uses other services from the DMZ ArcServer on 6080.  I will confirm with network folks that "port forwarding is configured at the router level to forward traffic internally on port 6080, but not 6443".  Thanks for the suggestions!

[RandallWilliams]

Correct, using the web adaptor instead of exposing the GIS Server on ports 6080/6443 is best practice.