How to configure ArcGIS Server and Portal with Webadaptor behind ReverseProxy?

[DirkHoffmeister]

Hi, 

we have a single machine deployment and want to easily use the new web mapping applications (and maybe extent them later). Own services must be secured due to copyright issues by the own Portal, so AGOL is not an option.

This all runs on a virtual machine with WinServer and IIS. 

I have installed 

ArcGIS Server 10.5.1 federated by Portal

ArcGIS Portal 10.5.1 

WebAdaptor (arcgis) configured for both above 

All SSL certificates are running and Reverse Proxy Server is working

Now, Webapplication from the Portal with content from ArcGIS online is running on a different webserver, but I cannot add services from ArcGISServer to Portal and thus to any webapplication. Likewise, I want to use specific services without Portal in small web applications. Thus, I need somehow to get the rest connection but this is currently hidden in the company network. 

What to do? What might be wrong? 

EDIT: Do I need two Webadaptors and two reverse Proxy forwarding, as internally in the company everything is working?

Kind regards. 

[JonathanQuinn]

By setting a Web Context URL, you're telling Server to always send back that URL when clients reach the REST endpoint.  The behavior you see is expected.  Is https://argissrv.domain.com/arcgissrv only resolvable outside of your network? Does it work externally and not internally?

[DirkHoffmeister]

It works internally and externally not fully. 

[DirkHoffmeister]

What seems to be weired is the listing under Server Admin Directory > system > webadaptor > KEY : 

URL:	https://ARCGIS/arcgissrv
Machine name:	ARCGIS

Is that correct? Or should be something like https://arcgis.domain.com/arcgissrv ? 

[JonathanQuinn]

Is "arcgis" your machine name?  The web adaptor will list the URL you used to register the web adaptor with the Server, but Server will still use the web context URL, (which I assume in your configuration will forward requests to the web adaptor).

[DirkHoffmeister]

Ok. Does the Reverse Proxy of the server need to forward to the Webadaptor adress (https://arcgis.subdomain.domain.com/arcgissrv/rest/services) or the internal one (https://arcgis.subdomain.domain.com:6443/arcgis/rest/services) ? 

[JonathanQuinn]

The only time you're required to use a web adaptor is if you want to use IWA.  You can go from the reverse proxy straight to the Server over 6443/6080 if you're not planning to use IWA.

[DirkHoffmeister]

So should I deinstall the Webadaptor of the Server? 

[ChadKopplin]

Is this issue still open?  If so, we have a webadaptor, with a Federated Arcgis Server/Portal.  We imported an SSL cert on the webadaptor (to both the root and the site), then we imported the same Cert to the Portal, both the root/intermediate.  This was fine to pull our map services, but we were not able to use the process services in portal like "Generate".  We had to import the cert onto the ArcGIS Server Manager as well, then we were able to have a clear path all the way through.  Also, we had to create a cert with the CN = <the server name>, and the Subject Alternative names = <qualified URL name>

                              = <fully server name>

                              = <short server name>

I hope this helps.

Chad