Connecting to ArcGIS Monitor 2023 through IIS

[EsriEvan]

With ArcGIS Monitor Server 2023, a reverse proxy may be used to present a more standard URL to users, mask the private ports (30080, 30443), or even handle SSL termination. This article will explain how to quickly configure IIS to handle these cases with a simple configuration. 

Install IIS URL Rewrite and ARR

IIS should already be enabled through the Windows Server Manager. To act as a reverse proxy, the URL Rewrite and Application Request Routing (ARR) extensions for IIS must be added. They may be downloaded and installed from Microsoft at the following locations:

URL Rewrite : The Official Microsoft IIS Site

Application Request Routing : The Official Microsoft IIS Site

Configure a URL Rewrite Rule

In IIS, a URL rewrite rule may be configured to forward traffic from IIS to ArcGIS Monitor.

1. Click Start and type inetmgr to open the IIS manager

2. Choose the Default Web Site, then Add Rules 

3. Choose  Reverse Proxy to open the rules dialog

4. Under Inbound Rules, define the address and port to which incoming requests should be forwarded.

In the case below, the target ArcGIS Monitor Server resides on the same machine as IIS, so localhost will work. However, if they are separated, use the FQDN of the ArcGIS Monitor Server machine.

Port 30080 may be used for both HTTP and HTTPS as long as Enable SSL Offloading is checked (this ultimately assumes HTTPS is configured at IIS and with a certificate) and will encrypt traffic from the user to IIS using its certificate.

Enable HTTPS

When choosing to offload SSL at IIS, HTTPS should be enabled along with a trusted certificate.

1. Choose the Default Web Site, then Bindings... to open Site Bindings dialog

2. Choose Add to add a new Site Binding

3. Select Type as https and choose the relevant SSL certificate available to IIS. A certificate may need to be provisioned if needed.

Update ArcGIS Monitor Web Context URL

The ensure proper URL generation for all workflows, update the ArcGIS Monitor Web Context URL to match the new path through IIS:

1. As an administrator, log into ArcGIS Monitor

2. Navigate to Administration

3. Under Server > Server Configuration Settings, choose Edit

4. Update the Web Context URL to match the new path through IIS

5. Restart ArcGIS Monitor for the changes to take effect

Validate Results

With this configuration in place, ArcGIS Monitor Server should now resolve over HTTPS without the need to enter the port!

[VHolubec]

Thank you @EsriEvan works great for Monitor and Agent installation as well!

[KillianPatchell]

Hi @EsriEvan,

Thanks for sharing. This has allowed us to access ArcGIS Monitor server without including the port. However, we have an agent deployed and when we connect to the Monitor server from the agent, without the port, it gets registered but it shows as disconnected. Thus, we can't monitor any components available from the agent.

Do you know if this is known and if there is a workaround for this?

[RobertAkroyd1]

@KillianPatchell and @EsriEvan  I have exactly the same issue and have raised a support case for it.  Sounds like Agents always connect to Monitor Server on 30443, and if that is the case I am going to suggest an enhancement request to make all comms between agent and monitor server operate on the same URL/port that the agent is registered with monitor server on.

[EsriEvan]

Hi all,

We've been taking a look at this and will provide more guidance soon. The underlying cause is Agent x Server communication is primarily WebSocket based, after registration occurs. This requires some additional handling for reverse proxies. I will update the blog soon with the remedy for this situation.

Additionally, the dev team is working to remove the WebSocket dependency for the next minor release, which will simplify reverse proxy configuration.

Thank you for your patience

[DavidHoy]

Hi @EsriEvan 
any update on a potential workaround if ARR is used to reverse proxy the AM Server?

[LanceKirby2]

Hey @EsriEvan any updates?

[KillianPatchell]

Hi @EsriEvan Was the websocket dependency removed in 2023.2? If not, any update on when this will be addressed?

Thanks,

Killian

[DanMallett]

@EsriEvan i'm trying to do the same using nginx on linux.  Do you have an example for nginx?

I've tried something along these lines:

    location / {
        proxy_pass http://127.0.0.1:30443;
    }

and updating the WebContextURL in ArcGIS Monitor admin but it doesn't seem to ever work for me.

[EsriEvan]

Hi all,

My apologies for the late reply to this thread! The WS dependency was ultimately replaced at 2023.3 with a traditional RESTful protocol. Issues related to this should resolve themselves as part of the upgrade.

[EsriEvan]

Hi @DanMallett ,

I am not familiar with nginx configuration, but it seems the URL provided may be mismatching the protocol with the port.

HTTP --> 30080

HTTPS --> 30443

[GrantSmith122]

Hello, so I followed this walkthrough exactly, but I'm receiving a 404 error when I enter my new url into the web browser. Monitor Server 2023.2.0 is installed on the same machine as IIS, and I've updated my Web Context URL to https://[url]/arcgis. The 404 error results when I input that directly into the web browser, although using https://fqdn/arcgis still works great.

Does anyone know why I would get a 404 error?

[GrantSmith122]

Following up on my previous post...we had a URL redirect set up on a load balancer that was pushing traffic from https://[url]/arcgis/monitor/ to the machine....we backed that off to just /arcgis and everything is working now!

[AYUSHYADAV]

Hi @EsriEvan ,

Thanks, this works perfectly with the ArcGIS monitor on Windows. I just wanted to know if you have similar kind of steps for ArcGIS monitor on Linux OS.

Thanks

Ayush

[MariuszZ_EPL]

Hi,

After the above configuration I had: HTTP Error 502.3 - Bad Gateway
I changed the rule:
Pattern = ^arcgis/(.*)
Rewrite URL= https://localhost:30443/arcgis/{R:1}
in C:\inetpub\wwwroot I added the \arcgis directory
and added a redirection to Web Context URL in DefaulfSite to increase IIS security (I have just site "arcgis" on IIS)
Now the redirect work as expected.

[CaseyBurns]

Hi @MariuszZ_EPL , I'm seeing the same Bad Gateway error. Trying to follow your steps, it feels like there may be some steps that I'm missing or that were left out in your explanation.

I completely understand and have implemented everything up through your URL Rewrite specifications. I've tried using your instructions but no luck and it feels like I may just be misunderstanding your instructions after the URL Rewrite settings. Can you elaborate further?

Thanks and appreciate the information!!!