Installation and Upgrade > Advanced Deployment Considerations > Network Configuration > Firewalls > Web Tier
  
Web Tier
It is increasingly common for systems to be configured with a web server tier separated from the Windchill application server. The servlet engine is still configured to run on the same server as Windchill. The Windchill installation files include the Apache-based web server named PTC HTTP Server and the Embedded Servlet Engine (which is based on Apache Tomcat). For details on configuring Windchill to work with a remote Apache web server, see Configuring Apache and Tomcat With Other Options.
In some situations, it may be ideal to configure a firewall between the web server tier and the Windchill application server. If this is the case, the web server must be capable of communicating with the following components:
LDAP server – default port 389
Servlet engine – default ports 8010-8018
In the default PTC HTTP Server and Embedded Servlet Engine configuration, these ports are used by the ajp13 protocol. There is a single port per Windchill method server running plus a range of ports. The port range allows for handling additional method servers as they are configured and is calculated based on the following logic:
wt.servlet.ajp.minPort property configures the minimum port number used. The default value is 8010.
The minimum number of ports available is 9 (which is the difference of wt.method.maxPort and wt.method.minPort properties) + 1 for an additional spare method server.
The port range is used to allocate AJP workers in the <httpserver_home>/conf/extra/workers.properties file. PTC HTTP Server communicates with Embedded Servlet Engine through these ports.