cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Showing results for 
Search instead for 
Did you mean: 

Split DNS-reverse proxy setup with Windchill 11 M020 clustered solution

Split DNS-reverse proxy setup with Windchill 11 M020 clustered solution

Hi,

 

We are trying to implement split DNS-reverse proxy setup with Windchill 11 M020 clustered solution but it's not working for external users through DMZ, receiving "service unvailable" error for Windchill page. This works perfectly fine from inside our network.

 

Seems like there are some changes implemeted with new Apache/Tomcat that comes with Windchill 11 that could be case but not sure exactly what.

 

The exact setup worked with Windchill 10.1 M050. 

 

Please share If anyone has implemented this with Windchill 11 OR any thoughts/suggestions on this will be really helpful.

 

Regards,

Rajiv

5 REPLIES 5

Re: Split DNS-reverse proxy setup with Windchill 11 M020 clustered solution

This is resolved. We had to run below command after navigating to Windchill_11.0\Windchill\tomcat

ant -f config.xml configureConnectors -DajpAddress=""

 

The issue was due to the address="127.0.0.1" in the tomcat for port 8010 is hard coded in the server.xml file of tomcat embedded with windchill which doesn't allow remote Apache (DMZ) connection to happen through AJP.

 

Highlighted

Re: Split DNS-reverse proxy setup with Windchill 11 M020 clustered solution

Be aware that changing the AJP address to something other than 127.0.0.1 means that anything that can access the given address and port can send AJP messages to Tomcat, complete wiith an asserted user name, and have them accepted by Windchill.

 

That means it is important to lock down what has access to that address and port.  Using 127.0.0.1 does just that, of course, locking it down to the server in question, but that clearly doesn't work for configurations where you require AJP access by another host.

Re: Split DNS-reverse proxy setup with Windchill 11 M020 clustered solution

Thanks for your feedback.  Any request from outside our network cannot send AJP mesages directly as it has to go through our DMZ server where remote Apache is configured.

 

Regards,

Rajiv

Re: Split DNS-reverse proxy setup with Windchill 11 M020 clustered solution

 

You'll also want to be sure that AJP requests cannot originate from other machines within your network -- apart from those you specifically have locked down and intend such traffic to arise from.

Re: Split DNS-reverse proxy setup with Windchill 11 M020 clustered solution

The application URL will always direct request to Windchill host or DMZ (in case of external users). I do not see AJP request coming from other machines. Can you please explain this case?

 

Regards,

Rajiv