Home
TeamSite
OD going through four firewalls - anyone else encountered issues?
claudiag
To answer the big question right away: no, we can't remove the firewalls.
Just as an offhand question, I wanted to see if anyone else had any experience with OD deploying through this many firewalls. We're having some problems, but can't figure out why, and we're in the classic "Firewall guys think it's the app, app guys think it's the firewall" situation.
Basically the connection is being made, OD is seeing it on the receiving end, but no data is going through. The users just see their deployments disappearing into a black hole and are not happy about it. To add to the fun, the issue is intermittent - there's no rhyme or reason as to why it's happening. There's no consistency on time of day, number of users, network issues, etc.
We've talked them down to two firewalls for some testing, but experienced the same problem. When deploying internally, with no firewalls, the issue does not occur. Obviously (to us, anyway) the multiple firewalls are the issue.
If anyone's had any experience with OD passing through multiple firewalls, I'd love to hear it, positive or negative. Any data would help at this point.
Release: TS & OD 7.2.0 (yep, 0)
Environment: Windows
Find more posts tagged with
Comments
nipper
I have done it successfully before. An old client has internal firewalls so you had to have requests to open ports between servers. Once it was running I never had an issue.
Since it often works and sometimes doesn't, you are going to have trouble. An all or nothing would be easy to check with telnet. You may need to set up a script (that you can write) to see if you can connect to the receiver and run it once every couple seconds. May have to do that on the receiver to connect to the sender as well, I have seen cases where traffic was configured to go one way through a firewall but the return ACK was dropped.
What OS ? Just use PERL LWP to open port 20014 on the opposite server.
claudiag
It's all windows unfortunately, which makes this tougher to troubleshoot. And yeah, all or nothing is easy, at least then you can identify "yes it works" or "no it doesn't". It's the intermittent gremlins that will drive you to drink!
Thanks for the idea! I'll see if we can do something with that.
claudiag
Just thought I'd update this with the solution we got from Autonomy engineering.
After trying a bunch of things, it looks like setting pathRegistryChecking="yes" on the in odrcvr.xml did the trick, at least so far. I had done that on the base side, but not on the receiver.
The odrcvr.xml should have pathRegistryChecking set to yes to avoid any Concurrency Management issues related to resource contention