XI Integration Builder Security

Question

We need to access to XI Integration Builder and XI System Landscape Directory for internet use. In our system landscape the users currently access, for instance, the portal by an iisproxy and access SRM by an ITS wgate. The server with iisproxy and the wgate is the only one visible in the internet. When we try to access the Integration Builder using an internet connection we cannot access it because we are trying to connect directly with XI server port 50000. For security measures it is not possible to access XI server directly from the internet, iisproxy server must be used.
Our question: is it possible to configure the XI internet access considering the described system landscape?

Answer 1

Hi Kirk,
What you can (and proberbly should) do is setup a local adapter engine (local J2EE installation) inside your DMZ (where the proxy is located). The internet server can than access your local adapter engine directl (preferably via HTTPS). The connection between you integration server (XI) and the local adapter engine must be opened through all firewalls (again you might want to use HTTTPS).
You can maintain the local adapter engine through the integration server, but servers on the internet can only access the local adapter engine.
You also might want some extra security using username/password or client certificates on the local adapter engine in the DMZ.
In my opinion using an ITS or a reverse proxy is making things to complicated.
Hopes this helps,
Christiaan Schaake.