Dmz aa aioug

© Copyright 2015.Apps Associates LLC. 1
Demilitarized Zone in 12.2

KaliKishore Gomattam
Lead DBA Consultant – IMS @ Apps Associates
@kgomattam

Performance. Growth. Excellence.
• Global Reach, Broad Service Profile
• Founded in 2002, 600+ employees
• US, Europe, India, Middle East
• Service Offerings: Applications, CRM, Analytics, EPM, Cloud, Middleware,
Application Development, App & Infrastructure Managed Services
• Significant Investmentin R&D
• Cloud (IaaS, PaaS, SaaS)
• Business Process & SystemIntegration
• Analytics & Big Data
• Strategic Partnerships, Certifications, Credentials
• Oracle Platinum Partner, Oracle Specialized Across Our Portfolio of Services
• AWS Advanced Consulting Partner, Certified Managed Services Provider
• Microsoft Certified
• CMMI Level 3 & SSAE 16

Agenda
 Overview
 What is DMZ
 Why DMZ
 Different Ways to Setup
 High Level Steps to enable DMZ
 How does it defer from 12.1
 Best Practices

Question !!!
Why do we need to Expose Applications to Public
???

Risks
 As Organizations,expose their Oracle Applicationout of privatenetwork, via
HTTP/HTTPS, which will expose Oracle Applicationvia public network, which
has following risks.
 Entry point for attackers
 Security information can be hacked
 Expose internal Domain/network to external users.
 Application Vulnerability

Solution is DMZ
 DMZ will serve the purpose by restricting the access to applicationbiased on
type of users login (Internal/External)
 DMZ, which standsfor Demilitarized Zone consists of the portions of a
corporate network that are between the corporateintranet and the Internet.
The DMZ can be a simple one segment LAN or it can be broken down into
multipleregions.
 The main benefit of a properly-configuredDMZ is bettersecurity: in the event
of a security breach, only the area containedwithin the DMZ is exposed to
potentialdamage, while the corporate intranetremains somewhat protected.

DMZ with Oracle EBS
 When configuring Oracle E-Business Suite in a DMZ configuration,firewallsare
deployedat variouslevelsto ensure that only authorized traffic is allowed to
cross the firewall boundaries.
 The firewallsensure that if interruptionattemptsagainst machinesin the DMZ
are successful, the intrusion is containedwithin the DMZ, leavingthe
machines in the intranet unaffected.

DMZ Architecture
 Oracle Provides four different types of architectures as follows.
 DMZ Configuration With an External and Internal Application Tier
 DMZ Configuration With a Reverse Proxy and an External Application Tier
 DMZ Configuration With Internal and External Application Tiers in the Intranet
Sharing the Application Tier File System
 DMZ configuration with multiple Internal/External application tiers in the Intranet
and DMZ

DMZ Architecture (Type 1)
DMZ Configuration With an External and
Internal Application Tier
Internet
Internal users
Intranet
External users
HTTPS – 443
HTTP – 8000
WLS – 7001 / 7002
Node Manager – 5556 / 5557
ICMP
SSH – 22
SQLNET – 1521
HTTPS
HTTP
WLS
Node Manager
ICMP
SSH
SQLNET
SQLNET
Internal
External
DMZ External
Firewall

 Pros:
 Simple Configuration with external application tier configured in DMZ for external
users
 Internal users access internal application via intranet
 Restrict access to a limited set of Oracle Application Responsibilities for users
logging in via Internet
 Allow user access to only Oracle E-Business Suite Release 12 product that can be
deployed for Internet access
 Cons:
 Need to expose complete EBS Suite to external world
 Cannot share application tier file system between external and internal application
tier nodes.

DMZ Configuration With a Reverse Proxy and
an External Application Tier
Internet
Internal
users
Intranet
External
users
HTTPS
HTTP
WLS
Node Manager
ICMP
SSH
SQLNET
SQLNET
Internal
External
DMZ Internal
Firewall
DMZ External
Firewall
Reverse
Proxy
HTTPS – 443
HTTP – 8000
WLS – 7001 / 7002
ICMP
SSH – 22
SQLNET – 1521

 Pros:
 Mask external application tier details from external users with the use of reverse
proxy server
 Terminate SSL connections at the reverse proxy if required
 Implement URL firewall on the reverse proxy server to restrict access.
 Cons:
 Additional Server is required for reverse proxy
 Cannot share application tier file system between external and internal application
tier nodes.

DMZ Configuration With Internal and External Application Tiers
in the Intranet Sharing the Application Tier File System
Internet
Internal
users
Intranet
External
users
HTTPS
HTTP
SQLNET
DMZ Internal
Firewall
DMZ External
Firewall
External Load Balancer
WLS
Node Manager
ICMP
SSH
SQLNET
Internal
External
Internal
Load Balancer
HTTPS – 443
HTTP – 8000
WLS – 7001 / 7002
ICMP
SSH – 22
SQLNET – 1521

 Pros:
 Application file system can be shared among all nodes.
 Not required to open ports on firewall
 Load is balanced across multiple nodes
 Cons:
 Load Balancer is exposed to external world.

DMZ configuration with multiple Internal/External application
tiers in the Intranet and DMZ
Internet
Internal
users
Intranet
External
users
HTTPS
HTTP
SQLNET
DMZ Internal
Firewall
DMZ External
Firewall
External Load Balancer
WLS
Node Manager
ICMP
SSH
SQLNET
Internal
External
Internal
Load Balancer
HTTPS – 443
HTTP – 8000
WLS – 7001 / 7002
ICMP
SSH – 22
SQLNET – 1521

 Pros:
 Application file system can be shared among all nodes.
 Load is balanced across multiple nodes
 Cons:
 Load Balancer is exposed to external world
 Application tier file system between external and internal application tier nodes are
not Shared.

Application Access Flow
http://internal.mydomain.com
Private Network
EBS Instance
10.1.1.100

http://external.mydomain.com
Private NetworkPublic Network
Proxy Server EBS Instance
10.1.1.100
54.100.200.100

GlobalDNS
54.100.200.100 external.mydomain.com

10.1.1.100
54.100.200.100

Local DNS
GlobalDNS

10.1.1.100
54.100.200.100

Steps to enable DMZ
 To enable DMZ using any of the four prototypes, we need to perform some/all
of the below steps biased on which architecture we selected.
 Patches required for DMZ Configuration
 Clone External node using adcfgclone.pl (Run & Patch)
 Update Hierarchy TypeUpdate Node/Responsibility Trust Level
 Configure Reverse/Load Balancer Proxy (Conditional)
 Remove references to Internal Node(s) in mod_wl_ohs.conf (Only for 12.2.x)

Steps to enable DMZ
1. Patches required for DMZ Configuration
 R12.AD.C.Delta.4 and R12.TXK.C.Delta.4
Note: MOS Note 1617461.1 to apply the required patches. If an update patch for AD/TXK is
available, apply those instead of the minimum code level mentioned under Patch Number/Min
Code Level.

Steps to enable DMZ
2. Clone External node using adcfgclone.pl(Run & Patch)
 When prompted say “Yes” to add node
 Enable “Web Entry Point” and “Web Application Services”.
 Don’t enable “Batch Processing Services”

Steps to enable DMZ
3. Update HierarchyType
 Following user profiles are used to construct various URL’s in EBS

Steps to enable DMZ
 By default hierarchy type value for the profiles option is “Server type”

Steps to enable DMZ
 E-Biz environment for DMZ requires these profiles hierarchy set to “SERVRESP”
 Run “$FND_TOP/patch/115/sql/txkChangeProfH.sql SERVRESP” on run FileSystem
as apps user.

Steps to enable DMZ
4. Update Node/ResponsibilityTrust Level
 Oracle E-Biz has the capability to restrict access to a predefined set of
responsibilities base on the application tier server from which the user logs in.
 This capability is achieved by tagging application server with a trust level indicated
by the Node Trust Level (NODE_TRUST_LEVEL) server profile option.
 Option:
 Administrative: These servers are considered secure and provide access to
any and all Ebiz functions.
 Normal: Users logging in from normal servers have access to only a limited set
of responsibilities.
 External: These servers have access to an even smaller set of responsibilities.

Steps to enable DMZ
4. Update Node/ResponsibilityTrust Level

Steps to enable DMZ
5. Configure Reverse/Load Balancer Proxy (Conditional)
 Reverse Proxy server is configured in the front of the external application tier node
and it requires the Oracle E-Biz application tier nodes to be aware of the presence
of the reverse proxy server.
 Modify following parameters in the application tier context file for both run and
patch file system.

Steps to enable DMZ
6. Remove references to Internal Node(s) in mod_wl_ohs.conf (Only for 12.2.x)
 When node is added to an existing Ebiz instance, mod_wl_ohs.conf will have
references to both primary and secondary nodes.
 We need to remove these references to make sure, external nodes will not refer to
internal managed servers.

12.1.x Vs 12.2.x
12.1.x 12.2.x
Virtual Host Can Set while running adcfgclone
Cannot be set using adcfgclone,
need to configre OHS
SSL Supports till SHA-1 Supports SHA-2
SSH Does not require User Equivalence Requires User Equivalence
Apache No configuration Change required
Need to remove access to Internal
Node(s) in mod_wl_ohs.conf

Best Practices
 Identify the network flow
 Preserve isolationas much as possible
 Practice good vulnerabilitymanagement
 Make sure there is no way to directly request yourweb server, bypassing
security filtering layers
 Audit your equipment's
 Follow security best practices
 Monitor, monitor, monitor

Connect with Us
Web: www.appsassociates.com
Email: kalikishore.gomattam@appsassociates.com
YouTube: www.youtube.com/user/AppsAssociates
LinkedIn: www.us.linkedin.com/company/apps-associates
Twitter: @AppsAssociates
Facebook: www.facebook.com/AppsAssociatesGlobal

Dmz aa aioug

More Related Content

What's hot

Similar to Dmz aa aioug

More from pasalapudi123

Recently uploaded

Dmz aa aioug