managing ssis behind a firewall

Just a comment for people who are experiencing problems.

We are managing our ssis servers from a subnet that is blocked off from our production network via a firewall as I'm sure many people do. The problem we were facing was that when we tried to connect to an ssis instance we could get to dcom through port 135 which BOL states should be open. What BOL does not say is that dcom then arbitrarily assigns a high numbered port for the management interface to connect to. This was not very desirable since we would have had to open a gaping hole in our firewall.

The solution we have come up with is in windows 2003 you can map a static port to a com server through a registry key.

First you must find the applicationid (guid) of MsDtsServer in the HKEY_CLASSES_ROOT\AppID\ registry hive. From what I can tell this is always {F38B7F09-979B-4241-80D9-2EADED02954F}.

You then need to specify a new REG_MULTI_SZ value named Endpoints with the value of ncacn_ip_tcp,0,<port number>. You can only set one port, not a range.

Now you should be able to restart SSIS and connect through the port you specified (you still need port 135 for dcom though).

The specific process is detailed in more in http://support.microsoft.com/default.aspx?scid=kb;en-us;Q312960

Let me know what you guys think, we haven't put this through the testing gauntlet yet

This was very helpful - wish MS provided this kind of answer. Thanks!