Configuring firewalls with AR System servers

A firewall is a security system that acts as a protective boundary between a network and the outside world. You can connect to an AR System serverthrough a firewall without using a portmapper. 

In the following figure, the Developer Studioclient connects to a specific port of the AR System server:

FirewallWithARSystem.png

When the user makes a request to theAR System server, the response is sent on the same TCP connection that made the request. For more information about setting ports, see System requirements.

To enable communication through the firewall, you must configure the AR System serverand the client to communicate on the correct ports:

  • AR System server

    - The AR Systemadministrator assigns a specific port number in the Server TCP/IP Port box as described in Assigning TCP port numbers to AR System servers.

  • Client - In Mid Tier, the administrator or user configures the server settings on the Mid Tierconfiguration page.
    In Distributed Server Option, the administrator configures the server list accessed from the login window. These configurations inform the clients about the location on the firewall through which they can connect to theAR System server.
    If you configure the servers to run on specific TCP ports, you must also make corresponding configurations on the clients.

    The specifics of the firewall configuration vary from one manufacturer to another. Ask the network and security professionals at your company for more information.

    Port 111 is used for portmapper. This port can be blocked for requests coming through the firewall. The rule affects internal requests because Register-With-Portmapper: T is the default configuration setting of the portmapper. See the discussion in Configuring-a-server-to-use-plug-ins. See also Assigning TCP port numbers to AR System servers. 

Best practice

When a firewall or a load balancer exists between clients and the AR System server, you must set the TCP "keep alive" value.  The operating system of the host AR System servermaintains the keep-alive socket (not the client). Make sure that the keep-alive value on the firewall or load balancer is at least as long as or longer than the keep-alive value on the largest host server of all AR System servers connected to the firewall or load balancer.

 

Tip: For faster searching, add an asterisk to the end of your partial query. Example: cert*