Securing the BI platform
Your deployment will not work if the Server Intelligence Agent (SIA) and Central Management Server
(CMS) cannot communicate with each other. Ensure that your firewall ports are configured to allow communication between all SIAs and all CMSs in the cluster.
7.14.1.6 Job server child processes communicate with the data tier and the CMS
Most job servers create a child process to handle a task such as generating a report. The job server creates one or more child processes. Each child process has its own Request Port.
By default, a job server will dynamically select a Request Port for each child process. You can specify a range of port numbers that the job server can select from.
All child processes communicate with the CMS. If this communication crosses a firewall, you must:
• Specify the range of port numbers that the job server can select from by adding the -re questJSChildPorts<lowestport>
-<highestport> and -requestPort<port> parameters to the server's command line. Note that the port range should be large enough to allow the maximum number of child process as specified by -maxJobs.
• Open the specified port range on the firewall.
Many child processes communicate with the data tier. For example, a child process might connect to a reporting database, extract data, and calculate values for a report. If the job server child process communicates with the data tier across a firewall, you must:
• Open a communicate path on the firewall from any port on the job server machine to the database listen port on the database server machine.
Related Topics
•
Command lines overview
7.14.2 Communication between BI platform components
BI platform components, such as browser clients, rich clients, servers, and the SDK hosted in the web application server, communicate with each other across the network during typical workflows. You must understand these workflows to deploy SAP BusinessObjects products across different subnets that are separated by a firewall.
174 2012-12-12
Securing the BI platform
7.14.2.1 Requirements for communication between BI platform components
Deployments of BI platform must conform to these general requirements.
1.
Every server must be able to initiate communication with every other BI platform server on that server's Request Port.
2.
The CMS uses two ports. Every BI platform server, rich client, and the web application server that hosts the SDK must be able to initiate communication with the Central Management Server (CMS) on both of its ports.
3.
Every job server child process must be able to communicate with the CMS.
4.
Thick clients must be able to initiate communication with the Request Port of the Input and Output
File Repository Servers
5.
If auditing is enabled for thick clients and web applications they must be able to initiate communication with the Request Port of the Adaptive Processing Servers that hosts the Client Auditing Proxy
Service.
6.
In general, the web application server that hosts the SDK must be able to communicate with the
Request Port of every BI platform server.
Note:
The web application server only needs to communicate with BI platform servers that are used in the deployment. For example, if Crystal Reports is not being used, the web application server does not need to communicate with the Crystal Reports Cache Servers.
7.
Job Servers use the port numbers that are specified with the -requestJSChildPorts <port
range>
command. If no range is specified in the command line, the servers use random port numbers. To allow a job server to communicate with a CMS, FTP, or mail server on another machine open all of the ports in the range specified by -requestJSChildPorts on your firewall.
8.
The CMS must be able to communicate with the CMS database listen port.
9.
The Connection Server, most Job Server child process, and every system database and auditing
Processing Server must be able to initiate communication with the reporting database listen port.
Related Topics
•
BI platform port requirements
175
7.14.2.2 BI platform port requirements
This section lists the communication ports used by BI platform servers, thick clients, the web application server hosting the SDK, and third-party software applications. If you deploy BI platform with firewalls, you can use this information to open the minimum number of ports in those firewalls.
2012-12-12
Securing the BI platform
7.14.2.2.1 Port Requirements for BI platform applications
This table lists the servers and port numbers used by BI platform applications.
Product
Client Application
Associated Servers Server Port Requirements
Crystal Reports
SAP Crystal
Reports
2011 designer
CMS
Input FRS
Output FRS
Crystal Reports 2011 Report
Application Server (RAS)
Crystal Reports 2011 Processing Server
Crystal Reports Cache Server
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
Output FRS Request Port
Crystal Reports 2011 Report Application Server Request Port
Crystal Reports 2011 Processing
Server Request Port
Crystal Reports Cache Server Request
Port
Crystal Reports
SAP Crystal
Reports for
Enterprise designer
CMS
Input FRS
Output FRS
Crystal Reports Processing
Server
Crystal Reports Cache Server
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
Output FRS Request Port
Crystal Reports Processing Server
Request Port
Crystal Reports Cache Server Request
Port
176 2012-12-12
Securing the BI platform
Product
Client Application
Associated Servers Server Port Requirements
Dashboards
SAP BusinessObjects
Dashboards
CMS
Input FRS
Output FRS
Web Services provider application (dswsbobje.war) that hosts the Dashboards, Live
Office, and QaaWS web services required for certain data source connections
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
Output FRS Request Port
HTTP port (80 by default)
Live Office
Live Office
Client
Web Services provider application (dswsbobje.war) that hosts the Live Office web service
HTTP port (80 by default)
BI platform
BI platform
BI platform
SAP BusinessObjects
Web Intelligence Desktop
Universe design tool
Business
View Manager
CMS
Input FRS
CMS
Input FRS
Connection Server
CMS
Input FRS
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
Connection Server port
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
177 2012-12-12
Securing the BI platform
Product
Client Application
Associated Servers Server Port Requirements
BI platform
BI platform
Central Configuration
Manager
(CCM)
Report Conversion Tool
CMS
Server Intelligence Agent
(SIA)
CMS
Input FRS
The following ports must be open to allow CCM to manage remote BI platform servers:
CMS Name Server Port (6400 by default)
CMS Request Port
The following ports must be open to allow CCM to manage remote SIA processes:
Microsoft Directory Services (TCP port
445)
NetBIOS Session Service (TCP port
139)
NetBIOS Datagram Service (UDP port
138)
NetBIOS Name Service (UDP port 137)
DNS (TCP/UDP port 53)
(Note that some ports listed above may not be required. Consult your Windows administrator).
BI platform
)
Server Intelligence Agent
(SIA
Every BI platform server including the CMS
SIA Request Port (6410 by default)
CMS Name Server Port (6400 by default)
CMS Request Port
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
178 2012-12-12
Securing the BI platform
179
Product
Client Application
Associated Servers Server Port Requirements
BI platform
Repository
Diagnostic
Tool
CMS
Input FRS
Output FRS
CMS Name Server Port (6400 by default)
CMS Request Port
Input FRS Request Port
Output FRS Request Port
BI platform
BI platform
SDK hosted in the web application server
All BI platform servers required by the deployed products.
For example, communication with the Crystal Reports 2011
Processing Server Request
Port is required if the SDK is retrieving and interacting with
Crystal reports from the CMS.
CMS Name Server Port (6400 by default)
CMS Request Port
Request Port for each server that is required. For example, the Crystal Reports 2011 Processing Server Request
Port.
BI platform
Web Services provider
(dswsbob je.war
)
All BI platform servers required by the products accessing the web services.
For example, communication with the Dashboards Cache and Processing Server Request Ports is required if SAP
BusinessObjects Dashboards is accessing Enterprise data source connections through the Web Services provider.
CMS Name Server Port (6400 by default)
CMS Request Port
Request Port for each server that is required. For example, the Dashboards
Cache Server and Dashboards Processing Server Request Ports.
BI platform
SAP BusinessObjects
Analysis, edition for
OLAP
CMS
Adaptive Processing Server hosting the Multi-Dimensional
Analysis Service
Input FRS
Output FRS
CMS Name Server Port (6400 by default)
CMS Request Port
Adaptive Processing Server Request
Port
Input FRS Request Port
Output FRS Request Port
2012-12-12
Securing the BI platform
7.14.2.2.2 Port requirements for third-party applications
This table lists third-party software used by SAP Business Objects products. It includes specific examples from some software vendors, but different vendors will have different port requirements.
Third-party application
SAP Business Objects component that uses the thirdparty product
Third-party application port requirement
Description
CMS System
Database
CMS Auditing
Database
Central Management
Server (CMS)
Central Management
Server (CMS)
Database server listen port
Database server listen port
The CMS is the only server that communicates with the
CMS system database.
The CMS is the only server that communicates with the
CMS auditing database.
Reporting
Database
Email server
Connection Server
Every Job Server child process
Every Processing
Server
Database server listen port
These servers retrieve information from the reporting database.
web application server
All SAP Business Objects web services and web applications including BI launch pad and CMC
HTTP port and HTTPS port.
For example, on Tomcat the default HTTP port is
8080 and the default
HTTPS port is 443.
The HTTPS port is only required if secure HTTP communication is used.
FTP server Every Job Server
FTP In (port 21)
FTP Out (port 22)
The Job Servers use the FTP ports to allow send to FTP.
Every Job Server SMTP (port 25)
The Job Servers use the
SMTP port to allow send to
email.
180 2012-12-12
