DSC Deployment ArcGIS Server, Portal, and DataStore Incoming Ports

[JMiles99]

Hi guys
I am using the 4.2.1 DSC Deployment ArcGIS Module in an Azure environment where the NSG Incoming Ports are locked down to those documented. I am deploying an 11.1 HA environment and the process failed for the event where machine 2 was joining the Site. A request was sent out on the documented Port e.g. 6443 etc. to see if the site admin URL was available. The response comes back on another undocumented Port that I have blocked. I opened all port comms between the machine pairs and the process worked. The issue only occurs during a DSC deployment and affects Server, Data Store & Portal.
Can somebody please tell me what the incoming port number is used during this process?

[cameronkroeker]

Hi @JMiles99,

By default, PowerShell DSC uses port 5985 for WinRM HTTP to connect to target nodes. If -UseSSL is passed in with the InvokeArcGISConfiguration command then it will use port 5986 for WinRM HTTPS.

https://learn.microsoft.com/en-us/troubleshoot/windows-client/system-management-components/configure-winrm-for-https#more-information

Here is a diagram for list of ports used by ArcGIS Enterprise:

https://enterprise.arcgis.com/en/system-requirements/latest/windows/pdf/ports-enterprise-deploy-dgm.pdf

Thanks,
Cameron K.

[JMiles99]

Thanks Cameron for your prompt response.

What I found was that the text below had me and others assuming that WinRM communications is only between the orchestrating node and each target node. With our restricted environment we specified the source for the inbound WinRM rule on each target machine as the orchestrating machine. What we found is that WinRM also comms runs between machine pairs only during the federation stage.

"WinRM HTTPS must be enabled on the orchestrating node (the machine where Invoke-ArcGISConfiguration command is executed from), and all target nodes within the deployment."_