Does Blackbaud Recommend Standard Firewall Settings for Blackbaud CRM?

Caroline Barnes

Recently, we’ve had some organizations reach out to us with questions about Blackbaud’s recommendations for firewall settings. Cary McDonald, our Senior Product Support Lead for Developer Solutions and technical guru, shared some helpful insight into what we can (and can’t) suggest in terms of your firewall configuration, and the reasoning behind it all:


Blackbaud CRM and BBIS are standard .Net based web applications that also communicate over standard web ports, 80 and 443. We strongly recommend using port 443 for all traffic to make sure all the traffic is encrypted and that industry best practices for securing web applications are implemented as well. As far as recommendations, that is about it. Web security should be handled by your security professionals that keep up with the rapidly changing environmental threats and their mitigation, and in most cases not by Blackbaud application specialists.


Most questions that have come up regarding firewall or connectivity recently center on enhanced security measures that are often implemented as firewall or load balancers add-on modules. In many cases, they provide protection by inspecting, caching, or filtering the content that web applications are sending between the web servers and the end users. Your organization will likely have very specific security policies that are required to be implemented, tested, documented, and remediated regarding the implementation of security for web applications. The tighter your organization’s security, the more likely you will run into an issue where a particular security measure blocks a specific Blackbaud CRM or BBIS process from working correctly.


Some examples of the issues that come up?

• 
  
• Application firewalls can strip out content that violates the rules that are configured to keep unwanted content from going in or out of the network.
  
• Caching or proxy servers keep copies of content to distribute to users (which helps make web servers more efficient) but sometimes this causes problems if the content is meant to be dynamic.
  
• Load balancers can try to optimize web server connections and not keep established connections on the same server. In some cases, it times the connections out. This can cause processes to fail when persistent connections are not configured.
  

Our support team is always available to help determine the area where a problem is occurring. We can assist with troubleshooting and provide direction to your security application vendor, if needed. In many cases, seeking support from your firewall or load balancer vendor will likely provide a faster resolution to your issue. With the multitude of security products in use today, Blackbaud Support is not trained on the various products or qualified to make specific recommendations regarding their configuration, but we will help as much as possible.