Connecting to ArcGIS Monitor 2023 through IIS

[EsriEvan]

With ArcGIS Monitor Server 2023, a reverse proxy may be used to present a more standard URL to users, mask the private ports (30080, 30443), or even handle SSL termination. This article will explain how to quickly configure IIS to handle these cases with a simple configuration. 

Install IIS URL Rewrite and ARR

IIS should already be enabled through the Windows Server Manager. To act as a reverse proxy, the URL Rewrite and Application Request Routing (ARR) extensions for IIS must be added. They may be downloaded and installed from Microsoft at the following locations:

URL Rewrite : The Official Microsoft IIS Site

Application Request Routing : The Official Microsoft IIS Site

Configure a URL Rewrite Rule

In IIS, a URL rewrite rule may be configured to forward traffic from IIS to ArcGIS Monitor.

1. Click Start and type inetmgr to open the IIS manager

2. Choose the Default Web Site, then Add Rules 

3. Choose  Reverse Proxy to open the rules dialog

4. Under Inbound Rules, define the address and port to which incoming requests should be forwarded.

In the case below, the target ArcGIS Monitor Server resides on the same machine as IIS, so localhost will work. However, if they are separated, use the FQDN of the ArcGIS Monitor Server machine.

Port 30080 may be used for both HTTP and HTTPS as long as Enable SSL Offloading is checked (this ultimately assumes HTTPS is configured at IIS and with a certificate) and will encrypt traffic from the user to IIS using its certificate.

Enable HTTPS

When choosing to offload SSL at IIS, HTTPS should be enabled along with a trusted certificate.

1. Choose the Default Web Site, then Bindings... to open Site Bindings dialog

2. Choose Add to add a new Site Binding

3. Select Type as https and choose the relevant SSL certificate available to IIS. A certificate may need to be provisioned if needed.

Update ArcGIS Monitor Web Context URL

The ensure proper URL generation for all workflows, update the ArcGIS Monitor Web Context URL to match the new path through IIS:

1. As an administrator, log into ArcGIS Monitor

2. Navigate to Administration

3. Under Server > Server Configuration Settings, choose Edit

4. Update the Web Context URL to match the new path through IIS

5. Restart ArcGIS Monitor for the changes to take effect

Validate Results

With this configuration in place, ArcGIS Monitor Server should now resolve over HTTPS without the need to enter the port!

[VHolubec]

Thank you @EsriEvan works great for Monitor and Agent installation as well!

[KillianPatchell]

Hi @EsriEvan,

Thanks for sharing. This has allowed us to access ArcGIS Monitor server without including the port. However, we have an agent deployed and when we connect to the Monitor server from the agent, without the port, it gets registered but it shows as disconnected. Thus, we can't monitor any components available from the agent.

Do you know if this is known and if there is a workaround for this?

[RobertAkroyd1]

@KillianPatchell and @EsriEvan  I have exactly the same issue and have raised a support case for it.  Sounds like Agents always connect to Monitor Server on 30443, and if that is the case I am going to suggest an enhancement request to make all comms between agent and monitor server operate on the same URL/port that the agent is registered with monitor server on.

[EsriEvan]

Hi all,

We've been taking a look at this and will provide more guidance soon. The underlying cause is Agent x Server communication is primarily WebSocket based, after registration occurs. This requires some additional handling for reverse proxies. I will update the blog soon with the remedy for this situation.

Additionally, the dev team is working to remove the WebSocket dependency for the next minor release, which will simplify reverse proxy configuration.

Thank you for your patience

[DavidHoy]

Hi @EsriEvan 
any update on a potential workaround if ARR is used to reverse proxy the AM Server?

[LanceKirby2]

Hey @EsriEvan any updates?

[KillianPatchell]

Hi @EsriEvan Was the websocket dependency removed in 2023.2? If not, any update on when this will be addressed?

Thanks,

Killian

[DanMallett]

@EsriEvan i'm trying to do the same using nginx on linux.  Do you have an example for nginx?

I've tried something along these lines:

    location / {
        proxy_pass http://127.0.0.1:30443;
    }

and updating the WebContextURL in ArcGIS Monitor admin but it doesn't seem to ever work for me.

[EsriEvan]

Hi all,

My apologies for the late reply to this thread! The WS dependency was ultimately replaced at 2023.3 with a traditional RESTful protocol. Issues related to this should resolve themselves as part of the upgrade.

[EsriEvan]

Hi @DanMallett ,

I am not familiar with nginx configuration, but it seems the URL provided may be mismatching the protocol with the port.

HTTP --> 30080

HTTPS --> 30443

[GrantSmith122]

Hello, so I followed this walkthrough exactly, but I'm receiving a 404 error when I enter my new url into the web browser. Monitor Server 2023.2.0 is installed on the same machine as IIS, and I've updated my Web Context URL to https://[url]/arcgis. The 404 error results when I input that directly into the web browser, although using https://fqdn/arcgis still works great.

Does anyone know why I would get a 404 error?

[GrantSmith122]

Following up on my previous post...we had a URL redirect set up on a load balancer that was pushing traffic from https://[url]/arcgis/monitor/ to the machine....we backed that off to just /arcgis and everything is working now!

[AYUSHYADAV]

Hi @EsriEvan ,

Thanks, this works perfectly with the ArcGIS monitor on Windows. I just wanted to know if you have similar kind of steps for ArcGIS monitor on Linux OS.

Thanks

Ayush

[MariuszZ_EPL]

Hi,

After the above configuration I had: HTTP Error 502.3 - Bad Gateway
I changed the rule:
Pattern = ^arcgis/(.*)
Rewrite URL= https://localhost:30443/arcgis/{R:1}
in C:\inetpub\wwwroot I added the \arcgis directory
and added a redirection to Web Context URL in DefaulfSite to increase IIS security (I have just site "arcgis" on IIS)
Now the redirect work as expected.

[CaseyBurns]

Hi @MariuszZ_EPL , I'm seeing the same Bad Gateway error. Trying to follow your steps, it feels like there may be some steps that I'm missing or that were left out in your explanation.

I completely understand and have implemented everything up through your URL Rewrite specifications. I've tried using your instructions but no luck and it feels like I may just be misunderstanding your instructions after the URL Rewrite settings. Can you elaborate further?

Thanks and appreciate the information!!!

[RanaDas]

Hi @MariuszZ_EPL 

I was facing the same issue. But got it resolved after multiple trial and errors. You can refer the below steps, these worked for me on both 2023 and 2024 versions of ArcGIS Monitor.

1. Install the URL Rewrite Module
2. Install Application Request Routing (ARR)
3. Re-launch IIS manager, if required
4. Enable Proxy in ARR:
   • In IIS Manager, click on the server node in the left panel to select the server (not the individual site).
   • Double-click on Application Request Routing Cache in the middle panel.
   • Click on Server Proxy Settings… in the right panel.
   • Check Enable proxy.
   • Click Apply to save changes.
5. Set Up URL Rewrite for Reverse Proxy
   • Select the Default Site.
   • Open URL Rewrite Module.
   • Click on Add Rule(s)… in the right panel.
   • Choose Blank Rule and click OK.
6. Configure the Rule:
   • Name: Set a name, like ProxyToMonitor.
   • Set Requested URL to Matches the Pattern.
   • Set Using to Regular Expressions.
   • In the Pattern field, enter ^arcgis(/.*)?$. This pattern matches /arcgis and anything following it.
   • Set Action Type to Rewrite.
   • In Rewrite URL, enter https://machineB.domain.com:30443/arcgis{R:1}.
   • Set Append Query String to True to forward any query parameters from the original request.
7. Click Apply on the right side to save the rule.
8. Set  WebContext URL on ArcGIS Monitor Admin Window "https://machineA.domain.com/arcgis/"
9. Go to https://machineA.domain.com/arcgis/ in a browser, and IIS should now proxy requests to https://machineB.domain.com:30443/arcgis transparently.