If you have not already done so, install Enterprise Portal on the Web server in the perimeter network. For more information about installing Enterprise Portal, see "Install Enterprise Portal and Role Centers" in the Microsoft Dynamics AX Installation guide.

This section describes how to configure ports in the perimeter network and the internal network so users can access the appropriate Microsoft Dynamics AX information using Enterprise Portal. Table 1 at the end of this section provides a complete list of ports and the associated direction, connection, and connection type information.

Figure 2: A request for an Enterprise Portal page

A request is processed as follows:

1. By default, the Enterprise Portal Web server receives the request from the firewall on TCP port 80 (or 443, if your Web server is configured for Secure Sockets Layer [SSL] encryption). The firewall therefore must have port 80 or 443 open for incoming Internet requests. All outbound traffic is permitted, which means that all ports are open for traffic going from the perimeter network to the Internet.

2. After the Web server receives the request, it sends the request to the perimeter domain controller on UDP port 53 to verify whether the user is an external or internal user.

3. The perimeter domain controller and the internal domain controller communicate by using various ports, as shown in Table 1 at the end of this section.

4. The perimeter domain controller identifies the user and then returns the request to the Web server on UDP port 53.

5. The Web server authenticates the user and then sends the request to the AOS on TCP port 2712. The Web server and the AOS communicate by using the Business Connector proxy account.

6. The AOS communicates with the Microsoft Dynamics AX SQL Server database on port 1433.

7. After the AOS retrieves the necessary data from the database, it returns the request to the Web server on the default TCP port, 2712.

8. The Web server completes the request by sending the page to port 80 or 443.

Table 1: Ports for a traditional perimeter network to support Enterprise Portal

If necessary, use Telnet or Netmon to verify these ports. For more information about configuring firewall ports, see How to configure a firewall for domains and trusts.

Complete this procedure to ensure that the domain controllers can communicate with each other.

1. Log on to the internal domain controller by using an account that is a member of the domain administrators group.

2. Open DNS ( Start> Programs> Administrative Tools).

3. In the DNS console, expand the local name server.

4. Expand Forward Lookup Zones, right-click the domain name, and then click Properties.

5. Click the Zone Transferstab.

6. Select Allow Zone Transfers, and then select Only to the Following Servers.

7. Enter the IP address for the perimeter network domain controller, and then click Add.

8. Click OK, and then restart the DNS server.

9. Repeat this procedure for the perimeter domain controller.

Complete this procedure to ensure that the domain controllers know each other's fully qualified domain names.

1. Log on to the internal domain controller by using an account that is a member of the Domain Administrators group.

2. Open DNS( Start> Programs> Administrative Tools).

3. In the DNS console, expand the local name server.

4. Right-click Forward Lookup Zones, click New Zone, and then click Next.

5. On the Zone typepage, select Secondary zone, and then click Next.

6. On the Zone Namepage, enter the fully qualified domain name of the perimeter network, and then click Next.

7. Enter the IP address for the perimeter domain controller, and then click Next.

8. Click Finishto complete the wizard, and then restart the DNS server.

9. Repeat this procedure for the perimeter domain controller.

Complete this procedure to set up the one-way trust between the internal domain controller and the perimeter domain controller.

1. Log on to the perimeter domain controller by using an account that is a member of the Domain Administrators group.

2. Open Active Directory Domains and Trusts ( Start> Programs> Administrative Tools).

3. In the console tree, right-click the domain name for the domain that you want to administer, and then click Properties.

4. Click the Trusttab.

5. Click New Trust, and then click Next.

6. On the Trust Namepage, enter the fully qualified domain name for the internal domain, and then click Next.

7. Select One Way: Outgoing, and then click Next.

8. Select Both this domain and the specified domain, and then click Next.

9. Enter the domain administrator credentials for the internal domain, select Domain Wide Authentication, and then click Next.

10. Click Nexttwice, and then click Yesto confirm outgoing trust.

11. Click Finish.

Important
The IIS server and the AOS cannot communicate unless the IIS server can resolve the AOS IP address and name by using an LMHosts file. You must create an LMHosts file to resolve NetBIOS names as described in the following section.