9.4 Web server port hardening

[RexDeus9]

Hi,

Just a process question I'm dealing with. With the task of deploying a new 9.4 platform, I'm currently dealing with a Network Security guy who wants to harden the server ports BEFORE the Mit-Tier server gets deployed. Shouldn't this step be done AFTER the deployment, when you can clearly analyze ALL the ports involved.

The install keeps failing because some ports are not made available.

Anyone experienced this? input appreciated!

Rex

[SASKiwi]

For a new SAS installation, typically a TCP port list is created containing all the required ports and server network flows. If this is done correctly it shouldn't matter whether you harden before or after installation as all the firewall rules should align with your SAS servers' network traffic.

If there are any additional installation-specific port requirements, these should be part of your implementation plan.  

[RexDeus9]

"A TCP port list is created", by who'm? The general port list offered by SAS is not even available in one coherent document.

[SASKiwi]

By the team implementing the installation. This doc is a good starting point, but obviously it will depend on what products and SAS architecture you are using.

[Sajid01]

Typically SAS servers are a part of the corporate intranet behind firewalls and accessible from within the intranet.

Typically users cannot physically log into the servers. Typically https configuration takes post installation of mid tier.

With this being the fact, hardening the ports is a broad statement and depends upon what your "network guy" wants to do.. 
The best approach will be to approach SAS Tech Support with  details of what your "network guy" wants to do.