Firewall Configuration Using Programs instead of Ports

server administration XI Server Discussion
1

Moved from a post in Webi as it’s more of an admin question.

We use the regular Windows firewall on our BI4.1 server and rather than configure via ports we have defined a number of inbound rules based on programs. This was the way it was done in our XI 3.1 system.

It all works but client tools suffer a sizeable delay on connection, about 5 minutes, though they still eventually work once connected. So for example start up Universe Design Tool and the login window appears, chose system and enter password and it then takes 5 minutes to start. On a whim I disabled the firewall on the server and found this resolved the issue, so what am I missing with the current firewall configuration. We have rules for each of the following defined:

CMS - %ProgramFiles% (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\CMS.exe
ConnectionServer - %ProgramFiles% (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\ConnectionServer.exe
ConnectionServer 32 - %ProgramFiles% (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win32_x86\ConnectionServer32.exe
Explorer - %ProgramFiles% (x86)\SAP BusinessObjects\Explorer14.0\jre\bin\java.exe
FileServer - %ProgramFiles% (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\fileserver.exe
Tomcat - %ProgramFiles% (x86)\SAP BusinessObjects\tomcat\bin\tomcat7.exe
WI Report Server - %ProgramFiles% (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\WIReportServer.exe

DanDensley :uk: (BOB member since 2009-05-12)

2

In the fine tradition I’ve developed of answering my own questions :). The extra rule was required for the SAP Java VM Runtime Binary under:

%ProgramFiles% (x86)\SAP BusinessObjects\SAP BusinessObjects Enterprise XI 4.0\win64_x64\sapjvm\bin\java.exe

All now a lot quicker. If anyone can enlighten me on why things still worked after about 5 minutes without this rule that would be helpful, and if anyone has any feelings on using a program based approach rather than ports for firewall configuration again that would be appreciated.

DanDensley :uk: (BOB member since 2009-05-12)