Securing Your Network with Firewalls and Ports

This section provides information about how the distributed architecture in Commerce Server enhances the security of the deployment. The enterprise deployment provides separate environments (run-time and design-time) for external site visitors and internal business users. These separate environments help create a level of security because the two user segments are isolated—they access the site and its resources on different servers separated by a firewall.

Additionally, each environment includes separate Web and data tiers. This helps create another level of security because the presentation services are isolated from the database services.

You help secure the database content during site deployment by using the staging server to update the run-time databases. This deployment approach helps prevent direct exposure of the design-time database server to the run-time environment and its associated external clients.

Firewall settings on Windows Sever 2003 and Windows Server 2008 must be set to allow traffic to pass through TCP/IP ports without being blocked. The firewall is on by default under Windows Server 2008 so you must run the process to unblock the required ports prior to using Commerce Server in a live environment. The unblocking of firewall ports is done automatically during the installation of Commerce Server 2009 on Windows Server 2008.

Firewalls

On the firewalls used in the enterprise deployment, you open only specific ports for network communication and discard requests received on all other ports. This topic lists the ports that you must open on the following firewalls:

• External firewall

• Internal firewall

• Corporate firewall

In this topic, inbound refers to the direction from which incoming client requests, such as those from external site visitors, access your deployment. Outbound refers to the direction in which your deployment sends data externally, beyond the deployment: for example, outbound to the Internet.

External Firewall

The external firewall that separates the deployment from the Internet makes sure that the only types of network traffic allowed into the deployment are requests for the retail Web site: incoming requests received on TCP port 80 and TCP port 443. The system discards requests received on any other port.

The following table lists the ports that you must open on the external firewall that separates your deployment from the Internet.

Internal Firewall

To prevent site visitors from accessing sensitive data on the database servers directly, the enterprise deployment uses a second firewall that separates the Web tier from the data tier in the run-time environment. This second firewall lets only specific types of internal communication pass between the Web and database servers, and helps protect the database resources from malicious Internet users who manage to compromise the Web tier.

The following table lists the ports that you must open on the internal firewall that separates the Web tier from the data tier.

Corporate Firewall

The third firewall separates the deployment from the corporate network and helps isolate the corporate network from any security risks in the retail deployment. The types of network communication that pass through this firewall depend on the architecture and requirements of the specific corporation or business.

The following table lists some example ports that you might open on the corporate firewall that separates your deployment from your corporate network.

Important Note:
Do not enable SQL port 1433 for the corporate firewall. If you enable this port, business users can bypass all business management security and directly access the computer that is running SQL Server.

Ports

The following tables list inbound and outbound ports for the Web tier, the data tier, and the development, test, and data tier.

See Also

Other Resources

Configuring Network Settings for the Enterprise Deployment

Configuring the Commerce Server Network