GlobalSCAPE DMZ Gateway v3.1, User Manual

Page: 5 / 60

5
Introduction to GlobalSCAPE DMZ Gateway
GlobalSCAPE
®
DMZ Gateway is designed to reside in the demilitarized zone and provide secure
communication with a server behind intranet firewalls without requiring any inbound firewall holes
between the internal network and the DMZ, and with no sensitive data stored in the DMZ, even
temporarily. DMZ Gateway supports connections from the server through the use of
Profiles (depending
on the license purchased).
How Does it Work?
Using EFT Server as an example of the server as illustrated below, when a Site is started, EFT Server
establishes an outbound connection to the DMZ Gateway (1). This proprietary, non-encrypted connection
is called the Peer Notification Channel (PNC). EFT Server and DMZ Gateway use the PNC to setup
subsequent communications between EFT Server and incoming client connections.
When a client (web browser, FTP client, etc.) connects to the DMZ Gateway (2) on the pre-approved
ports (21, 22, 80 443, etc.), DMZ Gateway creates a new “listener” (3), called an ephemeral port, and
gives this port and other relevant information to EFT Server over the PNC (4).
EFT Server then generates a new outbound connection (5) to the ephemeral port created by the DMZ
Gateway. Next, the DMZ Gateway "glues" the incoming client connection together with EFT Server’s new
connection (6), and from that point forward, the clien
t’s communications are streamed through the DMZ
Gateway to EFT Server over this connection (7).