ORA-12535 error but TNSPing Works and listener logs connection

Question

We recently migrated our firewall and then started seeing this problem for users outside of our own subnet. However, although the user gets this error when launching the application, the workstation is able to TNSPing the server successfully and listener.log does log the connection.
I was hoping someone might have some ideas or suggestions as to what might be causing the error despite the apparent connectivity to the database.
Thanks in advance.

Answer 1

Thanks so much for the suggestions.
1. telnet <host> 1521 connects
2. sqlplus <username>/<pwd>@<instance> returns the ORA-12535 error
Finally, the sqlnet.log on the client side doesn't log anything when launching the application so I have no information as to what exactly is occurring at that point. However, the sqlplus command above logged the following:
VERSION INFORMATION:
TNS for 32-bit Windows: Version 9.2.0.1.0 - Production
Windows NT TCP/IP NT Protocol Adapter for 32-bit Windows: Version 9.2.0.1.0 - Production
Time: 26-JAN-2007 08:43:41
Tracing not turned on.
Tns error struct:
nr err code: 0
ns main err code: 12535
TNS-12535: TNS:operation timed out
ns secondary err code: 12560
nt main err code: 505
TNS-00505: Operation timed out
nt secondary err code: 60
nt OS err code: 0
I've been doing more research on this -- please note that I'm not an Oracle dba so I am just getting familiar with lots of things -- and have learned that user connect requests come in through 1521 but are then randomly redirected to other ports. Given the new firewall, I'm wondering if it's an issue that the random ports being selected aren't open for the users outside of our subnet. Does this sound like a plausible explanation? If so, how do administrators generally handle this -- by opening the necessary ports on the firewall? Is there some other standard approach?
Again, thanks so much for any assistance you can provide.