nested web tiers

Baz2024

Hi,
Can 1 nav 2017 web tier talk to another nav 2017 web tier? I need to setup a web tier in our dmz, but want to have it talk to an internal navapp tier server rather than connecting direct to the db server.

Thanks,
Baz

markborges

Well... What do you mean by "want to have it talk to an internal navapp tier server"...? Do you want to integrate the two systems on a business logic level, or, what is the context behind?

Baz2024

Hi Mark,

So we have a standard 3 tier setup at present - the db server, the nav tiers and the client app - all working in the company network ok. We have a requirement to now allow a 3rd party to connect via odata to Nav. If this was coming from inside the network, we would just setup a new web tier and point them at that. As they are external, my options are either to let the 3rd party connect to our external IP on a dedicated port that we then NAT through the firewall to hit the internal nav tier; or to setup a new nav tier in the dmz that multiple 3rd parties could access. If doing the dmz route, I was thinking it would be more secure if the 3rd party accessed the dmz tier, and that then passed the data queries through the internal tiers and on to the db server, rather than having the dmz server talk directly to the db server. Does that clarify it?

Thanks

markborges

It does clarify yes, but unfortunately I'm not very familiar with complex NAV three-tier setups.... I was reading this flyer about NAV 3-tier structure:

https://www.icepts.com/wp-content/uploads/dlm_uploads/2016/02/How-Microsoft-Dynamics-NAV-works.pdf

And it does mention that you can have multiple instance of the core components (RTC client, NAV Server and DB Server)

I remember a few of my implementations where they would have many users, so they would do some sort of load balancing by having multiple NAV Servers available.

So, in my mind, if you had a NAV Server tier dedicated for the external access, on the DMZ or somewhere else inside your network, so long as it has the access needed for the DB server (assuming the DB server is sitting in another server), this could give you the protection you may be looking for.