4) Company security and infrastructure
4.1 How does my company's IT security policy impact the EFET installation?
The EFETBox Software covers the communication and the matching of contracts with your counterparty. Since the communication is over the internet with a http/https protocol, some components have to have access to the outside world. Your counterparties have to communicate with the EFETBox components, the components have to communicate with a NTP service to synchronize their clocks. Access to the Ponton registry server is also advised. Please clarify all installation / infrastructure issues with your IT department so communication is not blocked. Some firewalls also automatically block IP addresses with heavy connect/close activities. So a Messenger under heavy load or rapidly testing a connection via the testadapter may block communications with certain firewalls.
Some strict policies may forbid to communicate via https in the local network, so you have to rate carefully which components to install where in your company's infrastructure. The GUI for the Messenger and the EFETBox is browser based, using JavaScript, so this feature has to be enabled in the browser to work with the software.
4.2 How does my counterparty's IT Security policy impact my EFETBox installation?
Your IP address must pass your counterparty's firewall. If your infrastructure has a proxy server cluster or dynamic IP resolution or any other mechanism which doesn't guarantee a static IP address for communications, the firewall of the counterparty may block communications if the newly assigned IP address is not known to them. If the counterparty has a secure listener, your certificate has to be installed in their secure listener, before communication can take place.
See also in the Messenger's and EFETBox's Installation/Configuration and Security Guide for further discussion of infrastructure/components.
4.3 What infrastructure should I provide for the EFETBox software?
The EFETBox Software needs:
* Internet access, port 80 (http) and 443 (https), ideally with a static IP (server)
* Access to a timeserver using NTP protocol
* Access to a fail-safe enterprise database system
* Access to a SMTP e-mail server for status mails / system mails
* Access to a fail-safe file system.
* Intranet access between the installed components, using http(80) and https(443)
* A server running the listener in the DMZ and the EfetBox/Messenger server in the local net.
* Access to Ponton's registry server, allowing http with webdav extensions.
4.4 What changes in infrastructure should be reported to the EFETBox+ Administration?
Here is a Document (Relevant Changes in IT infrastructure) to be handed out to the IT-Administration for a reference to when changes in the IT infrastructure should be reported to the EFETBox+ Administration.
