Ralph Peters' Personal Blog

Configure your Firewall for Blackberry Enterprise Server

nospam@example.com (Ralph Peters) — Thu, 21 May 2009 23:43:35 +0200

Port 3101 must be open for outbound initiated, bidirectional traffic to your SRP-Gateway. Thats the easy part. And because the BES is working, everbody is happy.

But, as described in the article here, the IP address of your SRP-Gateway could change. If you haven't properly configured your firewall, your Blackberry Enterprise Server will stop working because the firewall will block the traffic to the new IP-Address.

To avoid this, RIM has published a List of IP-Ranges, which could be used as SRP-Gateway IP in future. To avoid the list getting outdated, I provide a link to the related BTSC-article, hoping it will be updated when necessary.

So, if you configure your firewall, be sure to implement these IP addresses.

Which SRP-Gateway to use for Blackberry Enterprise Server?

nospam@example.com (Ralph Peters) — Thu, 21 May 2009 21:58:47 +0200

Somewhere in the past, there were only 3 possible addresses for the SRP-Gateway (NOC):

srp.na.blackberry.net (North America)
srp.eu.blackberry.net (Europe)
srp.ap.blackberry.net (AsiaPacific)

I'm not sure, but I think it was with Blackberry Enterprise Server 4.1 when RIM introduced country specific SRP-addresses like

srp.de.blackberry.net.

You can look up your countries SRP-address at RIM's SRP address lookup site

As you may find out sooner or later, the country specific addresses are only forwarding to one of the three SRP-gateways listed above.
For example, srp.de.blackberry.net resolves to the same address as srp.eu.blackberry.net.

So it seems that is doesn't really matter if you use a country specific SRP-address or not. I can only guess what RIM's intension was:

When the correct country SRP is used,
- RIM would be able to manage the traffic to the 3 NOCs (Network Operation Centers) for Load/Traffic Balancing
- RIM would be able to redirect traffic if an internet route is weak/disabled, or if a NOC fails (but DNS changes may take some time)
- in case RIM would build another NOC, the traffic could be routed to this NOC by DNS-change

I haven't done a complete research about which country-specific SRP is routed to which of the three NOCs, but I discovered one weird routing: spr.gb.blackberry.net is routed to North America - which is not really logical, because one of the three NOCs is located in GB/UK.

So, if you want to be sure about which NOC is used (and through which country you mail is routed) you have to use the address of one of the three NOCs. If you want to give RIM the maximum flexibility about the routing of SRP-Traffic, then use the country specific SRP.

If you configure you Blackberry Enterprise Server in an enterprise environment, you could also be interested in the article about Configure your Firewall for Blackberry Enterprise Server.

Start

nospam@example.com (Ralph Peters) — Thu, 21 May 2009 14:42:57 +0200

The first entry to my blog
Here I will try to share some interesting information about everything.