DMZs in one machine, debate

Solaris Containers are ideal for server consolidation . I have thought about integrating DMZ services (www, mail, dns, db, catalog) into one physical machine. I'll provide a simple scenario.
I have seen examples in various presentations about using zones in a "virtual" multi-tiered environment, where you separate these server roles into containers in one physical machine.
Today, in a highly secured enterprise network archictecture, most of these services mostly run in different DMZs and are usually put into practice through use of switching and VLANs.
So where am I going with this?
Web-example:
You have DMZ:s: WWW, APP, DB.
- The WWW DMZ consist of multiple web servers/lets say they will be clustered zones.
- The APP DMZ consist of 2 app.
- The DB DMZ consist of several database servers.
Now, this is only the production environment. There will be a similar setup for test and development.
In total this gives a minimum of 18 zones in one machine, all need to have strict communcation rules through filtering.
Here's the actual question:
Would it make sense to separate these DMZs physically by adding 3 (3 dmz) physical NICs into that machine and physically connect these DMZ-NICS to a switch, configured to be on separate VLANs?
Is it even possible to do this technically? Is it even sane to have these services running in the same physical machine? I bet some security folks would consider this insane. Can IP filter running in a global zone filter traffic between zones? If not, then my solution could work, sending the traffic out and back in through an external firewall.
I wish to have a debate whether this is a good solution for DMZ consolidation of services.
Thank you.

OK, NAT seems to be the solution for now. I will look into that.
I did a bit of research about this and found this paper:
http://www.sun.com/datacenter/consolidation/solaris10_whitepaper.pdf
This is an extract from chapter 8 (by the way, great paper):
"Traffic between zones hits the loopback before it hits the higher layers of the IP stack where IPsec resides. IPsec can be used between zones if traffic is forced to go out onto the wire via the routing table. Firewalls such as IP Filter can not filter traffic between different zones, such as between the zone and the global zone because this traffic is looped back within IP. IP Filtering is the same as IPsec, in terms of hitting the loopback between zones. One way to implement IP Filtering between zones is to put the zones in separate subnets with routers between them so that traffic is forced outside of the system. This introduces a slight trade-off in performance for higher security between applications running in different zones. If using firewalls, install them in the global zone and then configure specific rules for the zone itself. Packets sent from the zone always have the zones IP address as the source address, so this property can be used to filter traffic from the zone."
I might have misunderstood it, or the above is incorrect.
Next step is try to build this with any solution possible. I will post any success.

Similar Messages

Mutiple Instances of Custom Application on One Machine

Background: We have a custom-written PL/SQL application that uses the PL/SQL Gateway. It makes use of two database schemas named ASK and ASKME. The iAS DAD points to ASKME. There are PL/SQL procedures under ASKME that call procedures in ASK, and vice-versa. We have the 8.1.6 database and 9i running on the same box, under different ORACLE_HOME's. Everything works great.
Problem: We would like the ability to have multiple instances of our application running on one machine, for development purposes. Currently, if we want to have another copy of our software, for a temporary development "sandbox" or whatever, we have had to dedicate an entire machine to it. This can get very costly.
We can easily create another DAD, etc., for the Application Server side, but the database side is a big problem. We can't simply create another copy under a different schema, since there are two schemas which refer to one another in code.
We have attempted to create another complete installation of Oracle on the same box, listening on another port, but this seems like a big waste of resources.
Is there a better way?

Technically, yes.
I won't get into the debate about whether you should run dev and production on the same box, I will stick with what your question specifically asks, and the answer is yes. You can even run two of what we call Master Instances.
When you run the installer just be sure to give each instance a different instance id/name. Then you can access the web sites with something like this:
http://myserver/production
and
http://myserver/dev
It is very common to see a development and QA server on the same machine, and this kind of install is done very often with multiple development servers running on the same box. So, strictly speaking, you can abosolutely do this.
-Jason Stortz
http://www.corecontentonly.com

How to create two or more JVM in one machine ?

Hi to some background ,I want to invoke RMI call to a server ,and I have written the following client code ,that access a getCounter()to show the incremented static variables value ,each time calling the getCounter() will increment the static variable by 1.That code is deployed in the server.
PDOS_Remote_Interface service1 =(PDOS_Remote_Interface)Naming.lookup("rmi://x.xxx.xxx.xxx/REMOTE_SERVICE");
String s1= service1.sayHello();
int cont1 = service1.getCounter();
System.out.println(">>>>>> "+s1);
System.out.println(">>>>>> cont1 "+cont1);
PDOS_Remote_Interface service2 =(PDOS_Remote_Interface)Naming.lookup("rmi://y.yyy.yyy.yyy/REMOTE_SERVICE");
String s2= service2.sayHello();
int cont2 = service2.getCounter();
System.out.println(">>>>>> "+s2);
System.out.println(">>>>>> cont2 "+cont2);
This is working fine with even two different server (I mean in two physically different machine(x ip and y ip) ,there ip are different )
with following output :
Server Says Hai!
cont1 0
Server Says Hai!
cont2 0that is static variable is not shareing as they are in two different server
Now My problem:
I want to hit the one and only server ,In this case Service1 and Service2 are getting the remote instance from only one machine .And when I am doing that I am getting the static variable incremented ,That is following output
Server Says Hai!
cont1 0
Server Says Hai!
cont2 1Is this possible to create two JVM instance in a particular machine ..??
I mean I want the first output (both static variable shows 0)in second implementetion (using only one machine )???

Yes, but the naming service is only going to accept one registration for a given name.

How to handle sessions with two severs on one machine?

All,
I am having a problem with session cookies being overwritten when I host two apps on one machine running WebLogic 8.1 The apps are http://myserver:7300/app1 and http://myserver:7400/app2, and each runs in its own server.
Users will often access both apps at once, in two browser windows. If the windows are different threads in the same process, the sessions collide. For Internet Explorer, this isn't usually a problem since clicking on the shortcut multiple times launches different processes by default. Some browsers (Firefox, etc.) won't let you have two windows under different processes. Attempts to launch a second window 'detect' the existing process and appear to spawn a new thread. When this happens there appears to be no way for the users to use both apps at once.
I know this is happening because of the way session cookies are stored in the browser process' memory. The session cookies appear to me to be 'keyed' by the host name or ip address of the server. Does anyone know of a setting in WebLogic so that this 'key' includes the port or context root? Is this even something which can be controlled on the server side?
Thanks for any help,
Brian

Not quite sure what your intent is, but if you want to avoid a clash how
about giving each application a different default session cookie name.

Have multiple iTunes libraries on one machine?

Hi,
I want to have multiple iTunes libraries on one machine (with two different hard drives, internal fore mp3s and external for AAC files). One library is composed of mp3s for an iPod, I want the other library to have AAC audio files for burning CDs. I would rather the libraries not be mixed.
I have read the article (#301748) for migrating an iTunes library and am preparing to migrate one of the libraries on to a external hard drive.
I have read about using Libra to maintain two different libraries on one machine. I was wondering if anyone does this and if they have encountered any problems? Is there a better solution?
Thank you,
TPK

It's one thing to want two music libraries on one machine and another to want two music libraries on one user account. For the latter, here's what I've done.
I created folders in my iTunes folder called, say, Main Library Folder and Second Library Folder. (These could be anywhere you find convenient.) I dragged my regular iTunes Library file into the Main Library Folder. Then I opened iTunes and created my second music library. When I finished that, I closed iTunes and dragged the just-created iTunes Library file into the Second Library Folder.
If I want to use my main iTunes library, before opening iTunes I drag an alias (Cmmd-Option-drag) of the iTunes Library file from the Main Library Folder into the iTunes folder. Then, when I open iTunes, iTunes reads my main library file. And of course, it works the same way for the second library.
Of course, you could just shuffle the actual library files into position in the iTunes folder from their holding areas, but I strongly preferred to get myself into the habit of relying on aliases, so I could leave the actual library file alone in their respective folders. You most definitely would not want to accidentally overwrite one of your iTunes Library files.
I'm sure one of the shareware products would do a more elegant job, but this just shows you that it's not a difficult process.
The alternative is to set up separate user accounts to access different libraries on the same machine. This has real benefits and, to me, should be the first option one considers. It's easier on the brain, as it sticks to iTunes' one-user-one-library model, and there's absolutely no risk of getting libraries confused. Fast User Switching on the Mac makes going back and forth between accounts easy. But if you really want to avoid using different accounts, and it's only you that has to keep things straight, the approach of jumping back and forth between different libraries in the same user account should be OK.

Multiple version of Java on one machine

Is it possible to have multiple versions of Java co-exist on the same XP Pro machine?
Here is our scenario: we have apps that use Java 1.5, but we have one critical app that doesn't support that version yet. It has to use the 1.4 version. Is there a way to allow both versions to exist and be usable for their respective apps? If so, how?
Thank you.

I can't, however it's never a good idea to have
multiple versions of Java on one machine. Try and
standardise if possible. If OP used JAVA_HOME as you
often suggest, then he would be knackered wouldn't
he? JAVA_HOME can only point to one JDK. Your
advice is conflicting kaj.Nope. JAVA_HOME should always be defined in the start script/file for a java application, so it's not set per system. It's very common that companies have applications that requires different JDK/JRE versions, and it's usually very expensive to upgrade all applications (if it's possible at all). You can of course also alter the PATH variable if you want to in the script.
/Kaj

Need to run multiple copies of portal on one machine

This is a little involved to explain so I'll try to be clear.
Right now we have multiple developers working on our single copy of our portal
running on one machine at another location. No good can come of this and much
bad has already happened.
What we need is to be able to run different copies of our portal on different
ports on that same machine. Making a copy of the domain, changing the port and
java.io.tmpdir just confuses the first server started when the second one goes
RUNNING. Changing the Web Application name doesn't help either.
It looks like it's only our stuff that gets cornfused when I set up multiple servers
(user_projects/someDomain, user_projects/someDomain2) or multiple Web Apps (someDomain/beaApps/portalApp/webApp1,
someDomain/beaApps/portalApp/webApp2) since I can log into the console just fine.
The Big Idea is that we need each developer to have their own sandbox to play
in along with a demo/test copy of our software.
I've dug through the BEA docs and these news groups and have not found anything
that directly pertains to our situation. The BEA docs are particularly thin on
information pertaining to dealing with more than one developer or deploying to
remote machines.
Here are some of the particulars and constraints of our setup.
We are running WebLogic Platform 7.0.0.0 on a Solaris box at another physical
location. All access is via network. We have no root access for a variety of
reasons.
Oracle is used for our JDBC. No Pointbase.
Our WebApp has a servlet as the starting point.
We deploy an exploded version of our servlet and JSPs for convenience.
We edit and compile our java source on Windows boxes and FTP the .class and .jsp
files up to their proper places on the server.
Naturally, the ideal solution would be to have more than one machine for a server.
Right now we don't have that option.
Thanks for any help that you can give,
Jon Davis

Travis,
We tried something very similar to that. We're using WebLogic Platform 7.0.
We only have one login on this Solaris box.
I copied our domain (${HOME}/bea/user_projects/somePortal) to another directory
(${HOME}/bea/user_projects/somePortal-devel) and changed the relevant XML files
with regards to ports and installation directories.
Maybe the UID that each server runs as is the difference........
Maybe an earlier version of the products are more tolerant of this and what we're
experiencing is a "feature".
At least I know that my initial approach wasn't such a bad idea :)
Thanks,
Jon
"travis wissink" <[email protected]> wrote:
>
Jon,
We do this with very little issues. I’ll take a stab at putting this
into words.
I suggest that you have the developers run their own instance from their
own Solaris
user home directory. So in /home/travis make a directory bea/app (/home/travis/bea/app)
in the bea/app directory copy the applications, bin, StartPortal.sh,
StopPortal.sh,
and config directory from your current application, probably /opt/bea/wlportal4.0/.
Then make sure that your scripts (in the developers home directory)
all reference
jar files in the /opt/bea/{wlportal4.0 and wlserver6.1} directory's.
Next go
through the /home/travis/bea/app/config/portalDomain/{config.xml & *.sh},
/home/travis/bea/app/bin/unix/*.sh,
and /home/travis/bea/app/application/portalDomain/{applicationDir}/WEB-INF/web.xml
and start and stop scripts to change all “application” directory references
to
relative pathing from the /home/travis/app/bea directory also change
all references
of the 7501 and 7502 ports to another port for each developer.
Hope this is readable and helps
-travis
"Jon Davis" <[email protected]> wrote:
This is a little involved to explain so I'll try to be clear.
Right now we have multiple developers working on our single copy ofour
portal
running on one machine at another location. No good can come of this
and much
bad has already happened.
What we need is to be able to run different copies of our portal ondifferent
ports on that same machine. Making a copy of the domain, changing the
port and
java.io.tmpdir just confuses the first server started when the second
one goes
RUNNING. Changing the Web Application name doesn't help either.
It looks like it's only our stuff that gets cornfused when I set upmultiple
servers
(user_projects/someDomain, user_projects/someDomain2) or multiple Web
Apps (someDomain/beaApps/portalApp/webApp1,
someDomain/beaApps/portalApp/webApp2) since I can log into the console
just fine.
The Big Idea is that we need each developer to have their own sandbox
to play
in along with a demo/test copy of our software.
I've dug through the BEA docs and these news groups and have not found
anything
that directly pertains to our situation. The BEA docs are particularly
thin on
information pertaining to dealing with more than one developer or deploying
to
remote machines.
Here are some of the particulars and constraints of our setup.
We are running WebLogic Platform 7.0.0.0 on a Solaris box at another
physical
location. All access is via network. We have no root access for avariety
of
reasons.
Oracle is used for our JDBC. No Pointbase.
Our WebApp has a servlet as the starting point.
We deploy an exploded version of our servlet and JSPs for convenience.
We edit and compile our java source on Windows boxes and FTP the .class
and .jsp
files up to their proper places on the server.
Naturally, the ideal solution would be to have more than one machine
for a server.
Right now we don't have that option.
Thanks for any help that you can give,
Jon Davis

Can I use two different devices with different apple ID for backing up data on one machine without losing any data that was backed up with one device earlier?

Can I use two different devices with different apple ID for backing up data on one machine without losing any data that was backed up with one device earlier?

The link is to a discussion started on 12/18 in the FiOS Internet forum. Here's the link I get now, however it is different than the link I pulled a few hours ago. If this system changes the link again, it may not work.
http://forums.verizon.com/t5/FiOS-Internet/Frustration-and-just-confused-with-internet-help-please/t...
You can also look for the topic, "frustration and just confused" in the FiOS Internet forum.
Here's a link that is in the thread that gives more detail.
https://secure.dslreports.com/faq/15984
Good Luck!
P.S. "Copper Contributor" is my "rank." gs0b is my user name.
If a forum member gives an answer you like, give them the Kudos they deserve. If a member gives you the answer to your question, mark the answer as Accepted Solution so others can see the solution to the problem.

I have two iMac 24" how can i run them as one machine

im trying to figure out how to connect my two 24" to opertar as one machine if any one has the answer please help thanks

Are you referring to use the display of one with the other Mac or are you referring to use the hardware of both computers into one?
If you are referring to this first option, you have to use an application like ScreenRecycler, because only 27-inch iMacs and iMacs with Thunderbolt can be used as an external display officially.
If you are referring to my last option, you can't do it

IWeb projects from two computers. How do I combine onto one machine.

Hi,
I have been working on five sites in total. Three of them were satrted on my iMac G5 and recently I have just started two more but on my new MacBookPro.
They are all published, but I now want to combine all of the projects onto my MacBookPro. After some research it seems that iWeb saves one file called Domain in the iWeb folder. I can't have two Domian files in the same folder (one replaces the other)
Question is, how do I combine all of my iWeb projects together into one Domain file?
Any help appreciated.
Keith

I was wondering the same thing, for the same
reason...it sounds as if the separate domain files
must be maintained separately [maybe in separately
named folders in AppSupport/iWeb? and then just
switch between the separate folders to be able to
edit on one machine....but then be careful when you
do an Announce, because it'll only send
http://web.mac.com/nameofuser to the people and it
might open up Site #2 and not the one you sent,
right??
This is the reason there are applications like iWebSites (http://mistergregg.com/cocoadrillosoftware/) that help you to switch in and out different domain files. With multiple sites, you must specify the longer URL in order to get people to the specific site. I don't think the Announce email function is really up to snuff in this regard.
Any easy way to cure this issue of being able to
easily announce Site 2 to some and Site 3 to others?
without visiting sites and sending the LONG link????
that's inelegant.
See my post to you about subdomain forwarding in this thread...
http://discussions.apple.com/thread.jspa?threadID=619363&tstart=0

Can I use aperture library on more than one machine

My situation is thus:
I have a Macbook Pro on which my Aperture Library resides, in wherever Aperture decided to put it when I bought the software.
I now have a iMac, which obviously will be better than the Macbook for photo editing.
But I want to be able to take my Aperture Library with me when I take the Macbook out and about, and if necesary still edit on the Macbook.
Is there any way to share the Aperture Library, so that I can edit on the iMac, but leave the library on the Macbook, and then edit on the Macbook if I wish.
I am the only user, and will only be using Aperture on one machine at any one time.
I have searched archives but not managed to find the answer.

Is it possible to simply share the directory that contains the necessary file(s).
If your Library is in the location that aperture picks by default, then it will be in your "Pictures" folder - look for a file with a name like "Aperture Library. aplibrary".
What you will need to share depends on your import strategy for the master images. If you use managed masters, and all your master images reside inside the Aperture library, then you simply need to make this library file accessible or copy it to an external disk.
If on the other hand your masters are referenced, then I would recommend to consolidate them into the library before you share the library and then share the consolidated library.
If you will share your library over the network or just by moving it to an external device is really up to you, but you might consider the following pros and cons:
- If you want to profit from the faster CPU on your iMac, then you should keep the library on the fastes volume that is available, and a network volume might be much slower than a directly connected volume.
- if the network fails during a critical operation your library might get corrupted, if it resides on a network volume - there have been quite a few problems reported in this forum.
That is why I suggested to use your Macbook as directly mounted external volume, that leaves the library in its place on the Macbook Pro - no need to copy - and you have a very quick and stable connection, but the decision is yours to make. You will have to be comfortable with the workflow you choose.
HTH
Léonie

How to install more than one instances on one machine

Hi ALL,
I want to install more than one instances on one machine, but i am a freshman on SAP field. How and where can i get the related infomation for that? thank you very much !!

Hi tieyan,
Glad the information was of some help.
For Windows, there is an older note <a href="http://service.sap.com/sap/support/notes/28392">28392</a> that has some more information. It is important also that the SAP parameter PHYS_MEMSIZE is sized correctly according to note <a href="http://service.sap.com/sap/support/notes/88416">88416</a> (the bottom of the note gives some examples). For example, if there were two central instances and the two Oracle database instances on one host, PHYS_MEMSIZE for both instance profiles (of the central instances) would be 35% of the RAM (1/2 of 70%). In the case of MSSQLSRV 2000, for PHYS_MEMSIZE you would refer to the scenarios of note <a href="http://service.sap.com/sap/support/notes/327494">327494</a>.
If you ever want to thank somebody else for helping in answering a question, the <a href="https://wiki.sdn.sap.com/wiki/display/HOME/RulesofEngagement">Rules of Engagement</a> has a section 'Thank Others by Giving Points' that explains this further.
Regards, Mark

I have a desktop PC and a Macbook Pro. Can I install my CC programs on more than one machine/OS at the same time?

I'm looking to start using Adobe CC but I use more than one machine in my daily life - a Win8.1 PC and a Mac OSX laptop - can anyone tell me definitively whether I can install the desktop applications for CC on both and sync all my online files to whichever machine I happen to be using at the time?

Cloud License allows 2 activations http://www.adobe.com/legal/licenses-terms.html
-Install on a 2nd computer http://forums.adobe.com/thread/1452292?tstart=0
-Windows or Mac does not matter... 2 on the same operating system, or 1 on each

How to create an default profile for every user on one machine? Deployment of configurations?

On firefox 3.5.X i can copy an configured profile from an user-folder to the programm folder of firefox. \mozilla firefox\defaults\profiles.
After an new user log in to the machine the default profile will get the actual profile of the new user. With all bookmarks, configurations and so on.
But this doesn't work with the firefox 3.6.10? What changed? What will be the way i can get an default configuration for every user on one machine? I want to deploy the firefox with an default configuration in our enterprise? Why does the behaviour change?
What to do?
Thanks...

No - there are no missing data, because nothing will be copied. The profile - folder does not work.
There are the standard first start behavior.
There might be another trick? Hint? Todo?
Thanks.

How to copy/move Portal database from one machine to another?

I am receiving a ORA-22973 error (size of object identifier exceeds maxmum size allowed) on the wwsec_enabler_config_info$ table when attempting to import my entire "portal30" schema from one database to another on different Windows NT Servers.
Background: I had Portal 3.0.9.8 installed, configured, and running with the following setup:
Machine 1: Windows NT 4.0 SP 6, Oracle 9iAS 1.0.2.2, Oracle Portal 3.0.9.8
Machine 2: Windows NT 4.0 SP 6, Oracle 8i Database 8.1.7.0.0
We no longer have use of Machine 2 and needed to move the database over to Machine 1.
I performed the following steps:
1. Installed Oracle 8i database 8.1.7.0.0 on Machine 1.
2. Set up the tablespaces in the database on Machine 1 to match the same names and sizes of the tablespaces in the database on Machine 2.
3. Used the Oracle "exp" command to export the entire database that resided on Machine 2.
4. Copied the ".dmp" file to Machine 1.
5. Used the Oracle "imp" command to import the entire database on Machine 1.
6. The import completed successfully with warnings. But I had received the ORA-22973 error during the import process.
7. After it completed I compared the list of tables and packages in the "portal30" schema between the two databases. The wwsec_enabler_config_info$ table is missing.
8. I tried to export and import only the wwsec_enabler_config_info$ table between the two databases, but continue to receive the ORA-22973 error.
Without the table being created, access to the portal cannot be achieved.
Here are my questions:
1. Is there anyway to create the wwsec_enabler_config_info$ table without receiving the noted error?
2. Is there any other workable way to get the portal database from Machine 2 to Machine 1?
I am aware of the portal import/export utilities but that would require me to run through the 2 hour install of Portal 3.0.9.8 on the database on Machine 1 and then individually export and import all the portal components (security, pages, applications, content library, etc). I merely wanted to transfer the entire database from one machine to another, so I felt the Oracle exp/imp utilities would be quicker and less work.

Hi,
I've been hitting problems with Portal 3.0.9.8.1 against 8.1.7.2.1 on NT - i.e., Intermedia not working at all, and have been advised by support to move back to 8.1.7.1.1.
I don't want to lose any of my content in the Portal since the db upgrade and am wondering on what is the best way to do this.
The version of the Portal will be the same so I am hoping I can just use the Portal export and import utilities, as afterall, it is just data and the schema structures are the same between db versions. I'm also hoping that the Portal export doesn't use the standard Oracle EXP tool as it doesn't work anymore on 8.1.7.2.1 on NT!!
Regards,
John

DMZs in one machine, debate

Similar Messages

Maybe you are looking for