External Access points to a single Public VIP that terminates the TLS session at the external facing F5 Virtual Server. The back-end VLAN interface of F5 from the same session, forwards all TCP traffic to Oracle OHS for reverse proxy. - Which in turns communicates to the internal facing VLAN of the F5 Virtual Servers configured as Load Balancers using the F5 LTM module. The “APM” module uses the Oracle WebGate integration for access management http://mikereams.com

1. Deployment procedures
Three operations are needed to deploy new applications for an approved change
#1 – A Friendly URL aka “DNS” will need to exist on the external DNS servers. If one doesn’t yet
exist nor maps to the VIP below then request it via a Service Request (same goes for any
change). Details for request; create myapp.domain.com DNS subdomain with a CNAME
pointing to the portal funnel VIP X.X.X.X
#2 – A configuration addition to the OHS servers are needed on Apache and a transparent
Apache recycle is required for changes to take effect (No Reboot). There are three Load
Balanced DMZ Linux Web Servers in this web farm behind F5
#3 – A new Oracle Access Manager Policy is needed to protect, authorize or grant entitlements
to on-prem resources. Doesn’t require recycles and is transparent to the user experience
Public Domain Name Service (DNS)
Application Friendly URL’s are
Routed Based on assigned
Public Virtual IP Address (VIP)
Public DNS Forwarding
External Access points to a single Public VIP that terminates the TLS session at the external facing F5 Virtual Server. The back-end VLAN interface of F5 from the same session,
forwards all TCP traffic to Oracle OHS for reverse proxy. - Which in turns communicates to the internal facing VLAN of the F5 Virtual Servers configured as Load Balancers using the
F5 LTM module. The “APM” module uses the Oracle WebGate integration for access management. This design is intended for split DNS to allow internal to go exclusively through
the internal F5 Virtual Server while having external traffic route through this architectural pattern. A wildcard certificate on the F5 must be leveraged for TLS if under the same
cookie domain and the internal application/web server must not require the TLS payload downstream.
Oracle OHS Reverse ProxyF5 Big-IPPerimeter Network - Firewall
External Access Capabilities
Machine
External DNS/VIP
Person
iPhone
Laptop DesktopTablet
Android
F5 Big-IP External Virtual Server
Border Subnet
Secure
Access
DMZ Subnet
Data Center
Device Types
Internet
Browser
Linux External
DNS ServersFirewall Router
15 Minute Idle Session Limit
Design Pattern Security Decomposition
Anti-IP Spoofing
Rules are
needed
External Facing
Firewall
Forward VIP to
F5 IP (No NAT)
DNS useonly an
X.X.X.X IP Range
Configured to take header
request and proxy back to F5
Internal facing VIP
Switch
Data Center
Reverse Proxy
Servers
Internal
Proxy
F5 Big-IP Internal Virtual Server
External Internal Job/Process Web Service SSO
Internal Subnet
Federation Service
(Oracle Webgate)
Web Farm
Role Based
Access Control
F5 WebGate enforces access
policy to all external users OHS uses ReverseProxyPass to
connect to internal facing F5 Virtual
Server on behalf of client request