Does anybody have any experience with adding a WFE which is in a DMZ?

Trying to do this for a client and whilst the correct ports seem to be open, the install/config script dies on the step to provision the Distributed Cache.

All of the appropriate ports (22233 to 22236, inclusive) are open in the firewall and telnet tests indicated that they are working.

Trying a "user-cachecluster" yields an "ErrorCode:SubStatus:Failed to connect to hosts in the cluster" exception.

Trying "connect-afcacheclusterconfiguration" gives the same exception and "Get-AFCacheHostStatus" gives "ErrorCode:SubStatus:Cache host is not reachable." for each of the existing servers in the farm.

A literature search on these errors yields some results but nothing that has helped nor anything relevant to the scenario of adding a server in a DMZ.

In case it helps...


discusses using "Export-CacheClusterConfig" to confirm the config in case there is a rogue entry.

In this case, the new server I wish to add is missing and there does not appear to be any incorrect entries.

I started to go down the "rabbit hole" of trying to add it myself but then ran into other similar issues.

As you can expect, this is becoming quite stressful and urgent; any ideas/advice would be appreciated! Thanks in advance...

  • Are TCP-ports 22233-22236 openend in both directions? You might use WireShark or similar to see which connection gets blocked.
    – MHeld
    Mar 21, 2018 at 7:04
  • To add to this, this isn't a recommended config. Placing all SharePoint hosts in the internal network and using a Reverse Proxy in the DMZ is significantly more secure. But if there is a rogue entry when running Get-CacheHost, that's unlikely to be the specific cause, nor would that likely be a port issue.
    – user6024
    Mar 21, 2018 at 14:36
  • What install/config are you using AutoSPInstaller? Mar 22, 2018 at 9:19

1 Answer 1


Okay, to answer the follow up questions above:

1/. The client specifically requested this architecture. This was adding to an existing, working farm where the existing servers were in the same network zone.

2/. Bi-directional comms on ports 22233 to 22236, inclusive was provisioned/opened.

3/. I used the same AutoSPInstaller script (but with new server added, of course) as the original farm deploy.

The resolution was:

1/. As per https://technet.microsoft.com/en-us/library/jj717234.aspx, inbound ICMPv4 traffic was turned on.

2/. To be able to add a distributed cache service instance the new server needs access to be able to edit the registry on the cache host PC 2a/. Enable service “Remote Registry” 2b/. Enable windows firewall rule “Remote Service Management (NP-in)” 2c/. Allow port 445 inbound/outbound though firewall

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.