External ArcGIS Server Services in AGO Web Maps/External Applications

[KristinJ]

I have a story map that is hosted on one of our external web servers here https://maps.hillsboro-oregon.gov/LandUseGallery/index.html; it currently uses AGO-hosted services and I’d like to redirect the web maps used in the app to services from another external web server in the DMZ where we’ve installed ArcGIS Server 10.3.1.  On the external ArcGIS Server we’ve enabled SSL and the server has a CA signed cert, and it’s configured to pass traffic on both HTTP and HTTPS.  I am able to add secured https services to ArcGIS Online from our external ArcServer, add them to a web map and they’re visible when I’m on our internal network, but the services are not visible outside our network.  If I add one to a web map that’s available to everyone when I try to load the web map outside our network it just times out eventually.  If I look in the console when viewing the web map on our network I’m getting a 400 error for the service coming from the external ArcServer.  I believe the solution to my issue as far as replacing the services in our external story map is to install the web adaptor with our Maps site on our external web server, correct?  I’m also wondering if there’s anything additional to be done (configuration in IIS, or?) on the DMZ server where ArcGIS Server is installed?  

[BillFox]

Is that just happening with the edge web browser?

[KristinJ]

No, in Chrome and in Firefox.  Don't usually use Edge, so I have not tested outside our network using Edge yet.  

[BillFox]

Is this the url that is not working for you?

Land Use Gallery - City of Hillsboro, Oregon 

[BillFox]

https://maps.hillsboro-oregon.gov/LandUseGallery/index.html  

[KristinJ]

This is working externally, because currently the services used in the web maps in the app are hosted on AGO.  I would like to replace these with services form the external ArcServer.

[BillFox]

[RandallWilliams]

It would be helpful to see your how the traffic flows. I believe I found your external GIS server by looking at the traffic from Hillsboro Maps , but I don't want to advertise the URL in a public forum like this. If the URL associated with the story map referenced as Hillsboro Maps is the server you're referring to, it doesn't appear that HTTPS is enabled, but that's just based on what I observe from here. 

[KristinJ]

The services used in the Hillsboro Maps application are coming from the external ArcGIS server.  That external ArcGIS server is enabled to pass traffic on both HTTP and HTTPS.  The services used in the Hillsboro Maps application is using are HTTP at present.

With regard to how the traffic flows, can you expand on your question please?  Thanks.

[RandallWilliams]

OK. I can reach the services directory for the web server providing maps for the Hillsboro Maps application from my office over port 6080, but not 6443 - and not over 80 or 443 either. I think that's the issue, since story maps require HTTPS these days. My guess is that you have port forwarding configured at the router level to forward traffic internally on port 6080, but not 6443. Personally, I'd keep the GIS Server internal, install the web adaptor on the DMZ machine, and allow the web adaptor machines IP access to the GIS Server on ports 6080/6443. 

An Important Message About Web Security and Story Maps