SOLUS 3 Firewall Exceptions

Please see below for new URLs that need to be whitelisted and an update to the SOLUS3 client that needs to happen before August 2021.

As ESS continue to progress through the programme of separation activities from Capita, a significant amount of work is required in the rebranding workstream to remove all references to the former owner. This is a formal requirement with a completion deadline as defined in the terms and conditions of the sale agreement.

One specific requirement is to change the service URL for the SOLUS3 platform.

• The old URL was http://s3dl.capitasolus.co.uk
• The new URL is http://s3dl.ess-solus.co.uk

What is the impact for users of SOLUS3?
The downloading of patches and updates via SOLUS3 may fail if the new URL is not approved for access via internet filtering systems. We are therefore recommending that you add the new URL http://s3dl.ess-solus.co.uk to your whitelist.

Once this has been added, downloads from SOLUS3 will continue to be processed as expected.

Following on from the above change to the new SOLUS3 Package Server URL another required change that forms part of the separation from Capita is required.  There is a URL change ESS need to implement, this time it is part of a minor update to the SOLUS3 application.  To ensure that schools continue to receive updates to their SIMS systems via SOLUS3 we advise that the following activities take place in the following order:

• Approve the following URL for access via your internet filtering systems:
  
  • http://s3ws.ess-solus.co.uk/packageserverservice.svc (the old URL was http://s3ws.capitasolus.co.uk/packageserverservice.svc)
• Once your firewalls have been updated, you are then advised to update SOLUS3 to version 3.12.59.5 which should be available by close of business 21st May 2021.  

When will I need to make the change by?
The new URL is live and available now, this means that as soon as the update to SOLUS3 is released, as long as users have added the new URL to their white list, SOLUS3 will continue to work as normal.  The old URL will remain in service until the end of August 2021.  Customers therefore have a four month window to ensure that internet filtering systems are updated with the new URL and the update to SOLUS3 can be applied.  The update to SOLUS3 will update the SOLUS3 service including each SOLUS3 Agent defined in the deployment environment.

What is the impact for users of SOLUS3?
The downloading of patches and updates via SOLUS3 may fail if the new URLs are not approved for access via internet filtering systems and the update to SOLUS3 not implemented. We are therefore recommending that you add the new URLs http://s3ws.ess-solus.co.uk/packageserverservice.svc to their whitelist before updating SOLUS3.

 External

For SOLUS3 to function correctly the below endpoints will need to be whitelisted.

Endpoints 

- http://s3dl.ess-solus.co.uk

- http://s3ws.ess-solus.co.uk/packageserverservice.svc

Ports

- TCP 80 (HTTP)

Internal

Ports

- SOLUS 3 Deployment Service - TCP 52965 (inbound and outbound)

- SOLUS 3 Agent - TCP 52966  (inbound and outbound)

- SOLUS 3 Agent Notifier UI - TCP 8739  (inbound and outbound)

Configuring the Windows Firewall for SOLUS³ Agent Communication

Workaround

1. Load the Group Policy Editor and navigate to the Windows Firewall node (http://technet.microsoft.com/en-us/l.../bb490626.aspx).

2. Open the Windows Firewall: Define port exceptions properties dialog.

 

IMPORTANT NOTE: Ensure that you access the Windows Firewall: Define port exceptions properties via the correct route. The correct route is Computer Configuration | Policies | Administrative Templates | Network | Network Connections | Windows Firewall | Domain Profile | Windows Firewall: Define inbound port exceptions.

 

3. Select the Enabled radio button.

4. In the Options panel, click the Show button to display the Show Contents dialog.

5. Add the following values:

IMPORTANT NOTE: Setting group policy port exceptions disables local port exceptions unless overridden in group policy. To do this, open the Windows Firewall: Allow local port exceptions properties dialog and select the Enabled radio button.

 

6. Click the OK button to close the Show Contents dialog.

7. Click the OK button to close the Windows Firewall: Define inbound port exceptions dialog.

8. Open the Windows Firewall: Allow inbound remote administration exception properties dialog.

 

IMPORTANT NOTE: Ensure that you access the Windows Firewall: Allow inbound remote administration exception properties via the correct route. The correct route is Computer Configuration | Policies | Administrative Templates | Network | Network Connections | Windows Firewall | Domain Profile | Windows Firewall: Allow inbound remote administration exception.

 

9. Select the Enabled radio button.

10. In the Options panel, enter * in the Allow unsolicited incoming messages from these IP addresses: field.

11. Click the OK button to close the Windows Firewall: Allow inbound remote administration exception dialog.

12. Open the Windows Firewall: Define inbound program exceptions dialog.

13. In the Options panel, click the Show button to display the Show Contents dialog.

14. Enter: C:\Windows\System32\wbem\unsecapp.exe:Enabled:.NET Proxy for DCOM (WMI).

15. Click the OK button to close the Windows Firewall: Define inbound program exceptions dialog.