Proxy forwarding
You can install an HTTP forward proxy server that supports HTTP Connect in the DMZ. The BlackBerry Connectivity Node remains inside the corporate network. In this configuration, only the BlackBerry Connectivity Node is reachable from the DMZ proxy instead of exposing multiple app servers to the DMZ. BlackBerry Dynamics apps make an HTTP Connect request to the DMZ proxy and request a connection to the BlackBerry Connectivity Node. The DMZ proxy then makes the connection to the BlackBerry Connectivity Node. When it is connected to the BlackBerry Connectivity Node, the BlackBerry Dynamics app establishes a TLS connection and authenticates to the BlackBerry Proxy.
You can configure one DMZ proxy for multiple BlackBerry Connectivity Node instances, or configure a unique DMZ proxy for each BlackBerry Connectivity Node instance. You must provide the FQDN of the DMZ proxy in the BlackBerry UEM management console for each BlackBerry Connectivity Node.
- You don't need to port forward directly from the edge network to the internal corporate network as with the port forwarding option. You can set up a DMZ. The web proxy in the DMZ connects to the BlackBerry Connectivity Node servers in the internal corporate network.
- The internal BlackBerry Connectivity Node address is not exposed to the internet as it is in the port forwarding option.
BlackBerry Dynamics apps make an HTTP Connect request to the DMZ proxy and request a connection to BlackBerry Connectivity Node. The DMZ proxy then makes the connection to the BlackBerry Connectivity Node. When connected to the BlackBerry Connectivity Node, the BlackBerry Dynamics app establishes a TLS connection and authenticates to the BlackBerry Proxy.
- Support the HTTP Connect method
- Be able to communicate with the BlackBerry Proxy server via TCP port 17533
- Be able to resolve the BlackBerry Proxy server's hostname
- Allow an inbound port (this port is arbitrary)
- Have a publicly resolvable DNS hostname