Proxy forwarding

You can install an HTTP forward proxy server that supports HTTP Connect in the DMZ. The

BlackBerry Connectivity Node

remains inside the corporate network. In this configuration, only the

BlackBerry Connectivity Node

is reachable from the DMZ proxy instead of exposing multiple app servers to the DMZ.

BlackBerry Dynamics

apps make an HTTP Connect request to the DMZ proxy and request a connection to the

BlackBerry Connectivity Node

. The DMZ proxy then makes the connection to the

BlackBerry Connectivity Node

. When it is connected to the

BlackBerry Connectivity Node

, the

BlackBerry Dynamics

app establishes a TLS connection and authenticates to the

BlackBerry Proxy

.

You can configure one DMZ proxy for multiple

BlackBerry Connectivity Node

instances, or configure a unique DMZ proxy for each

BlackBerry Connectivity Node

instance. You must provide the FQDN of the DMZ proxy in the

BlackBerry UEM

management console for each

BlackBerry Connectivity Node

.

The benefits of this approach are:

You don't need to port forward directly from the edge network to the internal corporate network as with the port forwarding option. You can set up a DMZ. The web proxy in the DMZ connects to the
BlackBerry Connectivity Node
servers in the internal corporate network.
The internal
BlackBerry Connectivity Node
address is not exposed to the internet as it is in the port forwarding option.

BlackBerry Dynamics

apps make an HTTP Connect request to the DMZ proxy and request a connection to

BlackBerry Connectivity Node

. The DMZ proxy then makes the connection to the

BlackBerry Connectivity Node

. When connected to the

BlackBerry Connectivity Node

, the

BlackBerry Dynamics

app establishes a TLS connection and authenticates to the

BlackBerry Proxy

.

Forward proxy servers used for

Direct Connect

must meet the following requirements:

Support the HTTP Connect method
Be able to communicate with the
BlackBerry Proxy
server via TCP port 17533
Be able to resolve the
BlackBerry Proxy
server's hostname
Allow an inbound port (this port is arbitrary)
Have a publicly resolvable DNS hostname