Shaun,

The safest way to configure this is to have Forms Portal installed inside the network and have a reverse proxy IIS server on the DMZ that acts as a bridge between the external users and the Forms Server. Simon Verrault has an excellent walkthrough here. It is for Web Access, but it should be easy enough to re-purpose for Forms.

The other option, which is more complex and risky, is to have two Forms Servers, one on the DMZ and one inside the network, and have them share the same database. The reason this is more complex and risky is that you'll need several firewall rules to make sure the Forms Server on the DMZ can talk to the Laserfiche Server, the License Manager, and the database server. Most competent IT people will give you a lot of pushback when you suggest this because it's against best practices to have DMZ services access assets inside the network. The reverse proxy approach is both very clean and virtually risk-free (or at least as risk-free as it can get with anything involving the Internet).

Thanks guys. I would like to keep as many ports closed on the internal server as possible, so if I go with the risky option, I wouldn't have to have external users working on the internal server. 

When I installed Forms Portal on the DMZ, I had to get some ports opened for Forms Config to see the Forms SQL database, so that's open. This DMZ already has Weblink so it already talks to the LF Server. 

My question is, if I go with the risky option (Forms Portal on DMZ, Forms Server on internal LF Server, both using same Database), how is that configured. As mentioned previously, there is no real written out steps for this. I saw that you need to disable the Forms Routing service on the DMZ and in config you need to point to the main Forms server (internal), and also change the web.config on the DMZ to point to the internal server. After a form submission to the Forms Portal, will the internal Forms server pick up the form submission and start the first item in the Business Process? Will it act as though someone submitted the form internally on the internal form server?

Ultimately the reverse proxy option is the best, but I believe I'm over my head with Simon's article. 

I find it hard to believe that nobody else out there hasn't done this with Forms Portal yet...or at least hasn't shared that they have. 

We have a client using Forms Portal on the DMZ and another Forms Server inside the network. Both Forms Routing Services are running. It works exactly as you describe: when an external user submits a form, it's routed to an internal user in a (mostly) seamless manner. It took a lot of fiddling and trial-and-error though.

You're right that the documentation on this is non-existent and it's very frustrating. Laserfiche really needs to publish some whitepapers describing their software configurations in enterprise scenarios. Expecting people to figure it out on their own is crazy, especially since the software is getting more complex with more moving parts with every release.

Hi Shawn,

To answer your initial questions:

1. You have to first open the appropriate ports (Sql Server, Laserfiche Server, Forms routing service), configure the DMZ Formsconfig; then disable DMZ Forms Routing Service.
2. If you meant whether the user on DMZ Forms can see process diagrams, yes.  Since you’re opening a port to the Sql Server, your DMZ Forms will also have access to the internal Forms database which stores business process diagrams.
3. No, since your DMZ Forms Server has access to the Sql Server, it can access the business process directly

For further configuration details, please see the white paper "Hosting Laserfiche Forms 10 in A Perimeter Network (DMZ)" here:

 https://support.laserfiche.com/GetFileRepositoryEntry.aspx?id=3481&mode=download

Thanks

Thank you Ling for creating the whitepaper, I'm sure it will help a lot of people. At a quick glance it looks great and to the point. I will give it a try and see how things go. Thanks again, and thank you Ege for your help as well. Hopefully I can finalize this project. 

We have a Form to be used in the Laserfiche app on phones and tablets which requires access from outside. Should we place the Laserfiche Mobile server 10.3 in the DMZ to point to the internal forms server? The app is able to logon to the forms but still receiving network errors. Could this be an issue of reverse lookup, and how to apply this to the endpoint addresses? The whitepaper only refers to the Forms server being in the DMZ and using two, one internal, one in DMZ. No references made to the mobile server. Is this an atypical scenario?