Home Page › Forums › BizTalk 2004 – BizTalk 2010 › Securely exposing BizTalk Web Services to the internet › Re: Securely exposing BizTalk Web Services to the internet
Seems like an expensive way of doing this. You are effectively using the external Biztalk server as a reverse proxy server. There are cheaper options. You mention ISA Server, this functions as both a firewall and a reverse proxy server. Although there are other options for a reverse proxy e.g. Apache.
With a reverse proxy you do not need any service specific logic in the DMZ, just a refernce to the internal web service. You allow ports 80 and 443 from the internet to the reverse proxy on the outermost firewall and ports 80 and 443 from the reverse proxy to the Biztalk Server on the inner firewall. The reverse proxy can implement various security measures to filter requests
You will have issues using SSL (port 443) thru a reverse proxy as you will need to deploy the certificate with the private key on the reverse proxy server. You could always use WS-Security and message level security on port 80 but this will require the use of the WCF adapter and remote client support.