Reverse Proxy only in DMZ Node

Hi Everyone,
We are implementing reverse only proxy in DMZ in R12.1.1 option 2.4 in DMZ note. I have few doubts regarding the setup. I would appreciate if anyone could clarify those.
I have a reverse proxy server in DMZ with a public IP and internal IP( We have built apache from souce as reverse proxy)
I have a MT(Linux box) with Two IP's one for Internal Webentry (port 8001)and second IP for external webentry(port 8002). These two have been registered in DNS the first ip would resolve to appsmt and second one would resolve to appsrp
We have Created packet filter rule allowing reverse proxy to communicate explicitly with MT(appsrp) on second IP (for external webentry) over TCP port 8002
As per DMZ note 726953.1 or 380490.1
1)what should I give when it prompts for host name when I run adclonectx.pl Step 5.9.1
Target System Hostname (virtual or normal) [dcoll12xc] :
should I give reverse proxy hostname or second host name on the MT for the external webentry
2) What should I give values for below
s_webentryhost
s_webentrydomain
s_active_webport
s_server_ip_address
should they be reverse proxy hostname/Ip or second host name/Ip on the MT for the external webentry?
Thanks

Hi user;
Please follow Oracle E-Business Suite R12 Configuration in a DMZ [ID 380490.1]
For your question 1 please check upper note part *5.9.1: Create a new context file for the external Web Entry Point* , it is explain there what you have to enter
For your question 2 please check upper note part *5.4.1: Update Oracle E-Business Suite Applications Context File*, it is explain there what you have to enter
Hope it helps
Regard
Helios

Similar Messages

ITS through Reverse Proxy : Only POST method doesn't work

Hi all,
We are using an Apache Reverse Proxy infront of our Portal and ITS Server
and using https.
Reverse Proxy : 443 > ITS:8443
We have rewrite rules for /sap and /scripts (ITS) /irj (portal) in the
Reverse Proxy .
We have set the following variables through the wgate-config URL of the
ITS server (SetHeader) :
HTTPS on
HTTP_HOST proxy_server:443
All ITS Iviews that use GET mehod display correctly .
However all ITS Iviews that use POST create an Apache Proxy Error.
We believe this is due to HTTP_CONTENT_LENGTH not being set in the ITS .
Do we set this value the same way?
Are there any other ITS settings that would cause this error for POSTS in
a Reverse Proxy ?
Regards
Daniel

There is a way around this (thanks to apple for responding to my bug submission) but it's slow. Test to see if the glyphCode created is greater than zero or not:
final FontRenderContext fontRenderContext = new FontRenderContext(null, false, false);
char[] array = new char[1];
array[0] = (char) intvalueofchar;
GlyphVector glyphVector = glyphFont.createGlyphVector(fontRenderContext, array);
int glyphCode = glyphVector.getGlyphCode(0);
boolean validchar = (glyphCode > 0);I only need to do this on the mac; on windows it does the right thing without this. If anyone has any suggestions for speeding it up (I already have it running in a thread), that'd be great - but thought I'd post it here for anyone else who might run into the same problem some day.

DMZ with reverse proxy

Hi All,
I am trying to configure DMZ.
But I am having only one node for apache.
So I thought of configuring DMZ using Reverse Proxy with no External node.
But I am bit confused with configuration of Reverse Proxy using the apache shipped with E-business
My current archecture like:
Node 1 : Apache ,Forms and MWA
Node 2 : CM and DB
OS : AIX 5.3
Version : 11.5.10.2
DB : 10.2.0.4
1.Will there be 2 apache process running as applmgr on node1(one for external and other for internal)
2.Will there be 2 context files in node1 (one for external and other for internale)
3.How to configure 2 Server name for node1
Thanks in advance

Hi,
Did you review (Note: 438744.1 - Case History: Implementing a Reverse Proxy Alone in a DMZ Configuration - 11i)?
Regards,
Hussein

OCS on a single computer / DMZ using Apache reverse proxy

Hi there,
we've installed the OCS 10.1.2 on a single Solaris box in our internal LAN. Everything works fine internally. We would like to configure a Apache reverse proxy in our DMZ to get the possibility to use it from outside (as shown in "Oracle Collaboration Suite Deployment Guide", chapter 3, Figure 3-2 Single Computer in a DMZ). Unfortunately I didn't find any configuration hints for the reverse proxy.
Can someone provide me with an example configuration?
Thanks,
Christoph

Hello Andreas and Christoph!
I have the same problem like Christoph. We made a Singlebox-Installation of OCS 10.1.2 in the intranet. Now I am looking for installation documentation, how I have to configure a Apache or Oracle Standalone Webcache as a reverseproxy in the DMZ. to allow access the OCS from the internet. I only read, that it is possible, but nothing about the way.
I have installed a Webcache (OAS 10.1.2 Java Edition not dht standalone Veersion from the Companion CD) and configured by my own knowledge. The result was network errors.
Is there anywhere information?
Best regards!
Axel

Doubts regarding reverse proxy in DMZ

Hi,
We are going to implement DMZ in a test environment following the metalink note:287176.1.
We have two sun servers so we have chosen Section 2.2(Fig 4) of 287176.1 as our deployment architecture.
The steps we are going to follow are:
1.Install Oracle Applications 11.5.10.2 in internal server.
2.Clone the application to external server.
3.Open the following ports:
80,443 in the external firewall and 1521 in the data firewall.
4.Follow steps from section 5.1,5.2,5.3,5.4 of 287176.1.
5.Configure the URL firewal specific to the product that we want to expose for external use.
Can someone please validate the above steps.
Also please clarify the following doubts:
1.Do we need a seperate external URL and domain to access the application from internet??
If yes then this domain and URL mapping is done in which configuration file??
2.Do we need to set up a reverse proxy server also for this architecture?If yes then is it necessary to deploy another reverse proxy server in front of external web server?
Cant we configure the external web tier itself as reverse proxy??
If yes then,how do we do it using 9iAS shipped with EBS...as we dont want to use standalone Apache for this and the document 287176.1 describes the steps to use a standalone Apache in section.(.Appendix D)..
Please help...
We have been given a time frame and limited resources to implement this POC.So a response is highly appreciated..
Thanks
ex:External URL:

We have two sun servers so we have chosen Section 2.2(Fig 4) of 287176.1 as our deployment architecture.If you chose the above configuration there is no reverse proxy setup.
1.Do we need a seperate external URL and domain to access the application >>from internet?? If yes then this domain and URL mapping is done in which >>configuration file??The changes are done on the external web tier in the application context file. (s_webentryhost - set to DMZ host name
s_webentrydomain - domain name of DMZ host
s_active_webport - port where the host will listen to requests
s_webentyurlprotocol - http or https according to your configuration
s_login_page - http(s)://webentypoint:webentrydomain:activewebport )
2.Do we need to set up a reverse proxy server also for this architecture?Again section 2.2 does not require a reverse proxy only external webhost
Please remember that the external host in DMZ runs only webtier. All the other services should be disabled.
If yes then,how do we do it using 9iAS shipped with EBSClone the AppsTier to external host. Edit the context file and disable all the processes except
<oa_process_status oa_var="s_apcstatus">enabled</oa_process_status>
Then you have a webtier running without standalone Apache.
I have recently finished configuring this setup.
Message was edited by:
bhetaal

Apache Reverse Proxy with Abap Web query

Hi to all
We are trying to configure apache 2 to work as a reverse proxy with web abap Netweaver installation.
From inside the network the web query is fine.
Running the query with the reverse proxy we have only the html code in the browser. All the scripts and css are not present.
We checked some messages inside the forum and we have tried a lot of stuff without success.
We use always linux (Fedora, Ubuntu with xampp or apache only) plus the html module or the publisher from http://apache.webthing.com.
Our installation is like this the reverse proxy in the dmz and the netweaver to the inside off coarse, and we don't have the same domain name, i don't know if this is important.
Any help/idea is valuable.
Thank you
Yiannis

Hi Olivier
I have seen your solution in other messages but i didn't try it because i was trying to work with the html_proxy module.
I read the documents you gave me plus some apache tutorials on the rewrite rule.
In any case i have my installation working now.
I did some extra changes in my config so now the rules are like that
ProxyVia On
ProxyBadHeader IsError
ProxyRequests Off
ProxyPreserveHost On
ProxyPass /sap http://192.168.1.59:8001/sap
ProxyPassReverse /sap http://192.168.1.59:8001/sap
RewriteEngine On
RewriteRule ^/(sap\(.*) http://192.168.1.59:8001/$1 [P,L]
Thanks again for your help
Yiannis

Reverse Proxy in web dispatcher

Any statistic on which product is better / qualifies better to be used as a reverse proxy.. (& wherein generic (forward) proxy services can be disabled)
Web Dispatcher
Apache
Microsoft IIS
Any other product ?
Thanks,

Thanks !!!
> URL filtering: the Web Dispatcher 7.2 supports more than one SAP backend, but you should take a look into the confguration page at SAP Help to find out if it matches your future scenario.
I am looking for WD based on 7.3 for both the roles (Reverse proxy and load balancing). But I'll check if there is anything for me to be concerned about...
> looking at your scenario, you'll have at least 1 reverse proxy in your DMZ and the Web Dispatcher will be an additional reverse proxy (for internal and/or external access).
>
> The Web Dispatcher will be connected to the message server of the portal, so when a server/node goes down, the web dispatcher will be notified. That's a vantage over another reverse proxy.
Yes, we have one server reserved for reverse proxy software and another for load balancing (WD).. These two roles need to be on separate servers as per logistics requirement... So, is this what you are talking about..
User <> WD as reverse proxy on server1 <> WD for load balancing server2 <--> EP Message Server.

Sun Web server 6.1 SP9 Reverse proxy - Changing Web Server Context

I am trying to configure a Reverse Proxy such that it can change the context of the requested URL.
My SOWS reverse proxy plug-in is running on server server1.sample.com and the destination server is running on server2.sample.com. The use case, the incoming URL is [|http://server1.sample.com/dummy1/]...... and I need to map this to {color:#0000ff}http://server2.sample.com/*dummy2*/.....;{color} It looks like the reverse proxy only maps to a server level but disregards the context. The reason I say that, in the server 2 logs I see - .... trying to GET /dummy1....; I needed the call to look for dummy2 context. Can this be done?

well, web server uri processing does not understand web application level context (in terms of java web applications). however, if you would like to map all uri's ending with /dummy1 to go to /dummy2, then you can easily do this with web server 7 regular express processing
http://blogs.sun.com/elving/entry/mass_virtual_hosting_in_7
http://docs.sun.com/app/docs/doc/820-6599/gdaer?a=view
besides web server 7 includes a very tightly integrated reverse proxy unlike 6.1 where you need reverse proxy as a separate plugin. so, you might want to check out if ws7 can serve your needs
- sriram

BizTalk published WCF service throwing HTTP 404 error using ISA reverse proxy settings

I have published my schemas as a WCF service from BizTalk 2010 "Publish WCF Service" wizard. I used Wcf-basicHTTP adapter in receive port. I am able to run the service successfully on localhost IIS and I tested my biztalk solution by sending request using SOAP UI and got response successfully.... Now: Actually, I need to give this service endpoint to my vendor who will send request from outside my company's network i.e. internet. In my infrastrucrue BizTalk is behind the firewall so, we setup a REVERSE proxy server at DMZ layer and it is configured properly. I have tested a simple WCF service by replacing the localhost with Proxy server configured address <DNSName> and it worked absolutely fine. But when I change localhost in my BizTalk schema based published WCF service it is not working and I am getting following error. Really strugling to get it resolved. I wasted a whole 3 days....very upset. Please help me out by giving the detailed step solution. Description: HTTP 404. The resource you are looking for (or one of its dependencies) could have been removed, had its name changed, or is temporarily unavailable. Please review the following URL and make sure that it is spelled correctly. Requested URL: /BizTalkServiceInstance/MyService.svc I am surprized why other c# code based WCF services are working fine with reverse proxy settings. Server Error in '/' Application. The resource cannot be found.Is there any special things to consider Biztalk exposed wcf servcie over ssl in IIS cluster with ISA

Hi Singam :)
First I would start by browsing any other files (files other than the one from WCF) just to ensure that the reverse-proxy’s redirection rules are set correctly. If you get the same 404 error when you try to access other service/files “through reverse-proxy”,
then it’s an issue in the redirection rule(s) in reverse-proxy.
If others are fine i.e. no issue in reverse-proxy setup as such, then try the following for WCF service's web.config file. I have seen this issue in WCF service (not just BizTalk’s artifacts exposed as service in reverse-proxy). Add serviceHostingEnvironment
config as show with in serviceModel section.
<system.serviceModel>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
</system.serviceModel>
Regards,
M.R.Ashwin Prabhu
If this answers your question please mark it accordingly. If this post is helpful, please vote as helpful by clicking the upward arrow mark next to my reply.

Problem with Apache reverse proxy after applying SP13 NW

Hello,
we have a NW04 EP Portal and a Apache reverse proxy in the DMZ. After applying SP 13 for the portal we get the following error from the reverse proxy:
Proxy Error
The proxy server received an invalid response from an upstream server.
The proxy server could not handle the request GET /irj/.
Reason: Error reading from remote server
Apache/2.0.52 (Win32) mod_ssl/2.0.52 OpenSSL/0.9.7e Server at servername.company.de Port 443
Is is it possible, that there is a problem with sp13?
Best regards
Daniel Holstein

Hi Daniel,
ok I`ll try to find a solution in parallel and keep you up to date.
In the following my settings in case I missed something:
<VirtualHost test.firma.de:443>
SSLEngine on
SSLProxyEngine on
SSLCertificateFile /apache/keys/pac_ssl_qep_dmz_server.crt
SSLCertificateKeyFile /apache/keys/pac_ssl_qep_dmz_server.key
ServerName test.firma.de:443
ServerAdmin [email protected]
LogLevel debug
ErrorLog logs/ssl_443_error
CustomLog logs/ssl_443_access_log common
ProxyVia Off
ProxyPreserveHost On
ReWriteEngine on
ReWriteLogLevel 0
ReWriteLog logs//ssl_443_rewrite_http.log
ProxyPass / https://backend.firma.de:50001/
ProxyPassReverse / https://backend.firma.de:50001/
</VirtualHost>
Regards, Jens

Reverse Proxy and Load Balancer for SMP 2.3 and Agentry Application

Hi Expert,
I'm putting in place a mobile solution composed by SMP 2.3 SPS 4 and SAP ECC 6.0. In the SMP 2.3 I created the agentry server and I have deployed my agentry application.
My SMP/Agentry infrastructure is composed by two servers therefore I need a load balancer for balance the load into the several servers. Furthermore I need to use a reverse proxy in my DMZ zone.
Based on what indicated in the SAP note "1904213 - SAP Mobile Platform Server Release Information" the Apache Reverse Proxy is not supported for Agentry clients. Agentry uses nginx for Reverse Proxy.
I also found the following document How-to-Guide for Reverse Proxy and Load Balancing in SAP Mobile Platform 3.x that explain how to set-up a reverse proxy and load balancer with nginx and apache.
Both the SAP note and the HOW to document are refereed to SMP 3.0 and not to SMP 2.3.
I would know if the NGINX must be used also for SMP 2.3.
Any suggestion/information is appreciated.
Thanks in advance
g.

Please see Agentry Network Landscapes

11g B2B & Webcache Reverse Proxy

Hi all,
I'm currently trying to setup an 11g test instance similar to our current 10g instance.
Currently we have an Oracle Webcache reverse proxy in our DMZ and infrastructure & mid-tier server running on our internal network. B2B is running via mod_oc4j mounted on the DMZ Webcache server.
I have not been able to uncover any documents for 11g that detail how this should be setup now. I understand that mod_oc4j is no longer used.
This was clearly detailed in the 10g B2B Installation Guide.
Can anyone direct me to the appropriate 11g guide for this?

Actually, to be technically accurate, the Webcache server in DMZ is home to HTTP & Webcache.
mod_oc4j B2B mount is on the HTTP server and Webcache routes the incoming traffic to it...
Regardless, anyone familiar with the 10g configuration as shown in the 10g B2B Install Guide should know what I'm talking about...
With mod_oc4j out of the picture now, do I just have to use Webcache to route traffic to the internal server? I find no doc that outlines this for 11g...

Distributed Authentication Service Server or Reverse Proxy

My environment have two layers firewall in place. The DMZ is sitting on the first-tier firewall as general web sites while I plan to put Access Manager server on the second-tier firewall. As we know that, AM have to send SSO token back to the browser after authenticated. In this configuration, based on security policy we don't allow direct connection between the browser and AM. That's why we put DSSS or Reverse proxy on the DMZ zone and act as the gateway for internal & exteranl traffic.
Can anyone post the comparison, pros and cons between DSSS and Reverse Proxy? Which one is better in term of features and easy-to-implement?
Finally, Is there any other alternatives if don't want to use both DSSS and Reverse proxy? I ask this question because AM will be single point of failure of the whole system. If AM have been attacted from whether direct or indirect, all services will be unaccessable.
Best Regards,
mthekid

Bernhard,
Thanks for your response. Because my major concern is security so I want to prevent denial of service on Access Manager. It look like writing my own dist-auth equal mechanism will help. However, I have 3 different platforms in single sign-on environment. Does this mean I have to create 3 dist-auth-like ones ?
Do you think if they are worth to do (I hope I can find documentation and guideline at http://docs.sun.com) ? Please tell me frankly. I am semi-technical and presales. If they are too complex and time consuming, I may decide to with dist-auth.

Configuring a Apache Reverse Proxy for OracleAS Portal and OracleAS Single

I'm trying to implement my Oracle Portal 10g Release 2 with a reverse proxy (Apache 2.2) as described in this link: http://download.oracle.com/docs/cd/B14099_19/core.1012/b13998/variants.htm#BEIFECEH without success. I have Oracle Portal, Oracle SSO,OID in the same domain and Apache Reverse Proxy in another domain. Has anyone had success using OracleAS Portal with a reverse proxy?

First of all i'm trying to configure a reverse proxy only for Ora SSO (infra tier). Here is what i already do:
APACHE REVERSE PROXY (Apache 2.2)
http:/proxy.mycompany.com:80
ProxyRequests off
ProxyPassInterpolateEnv On
ProxyPass / http:/portal.tech.everett.it:7777/
ProxyPassReverse / http:/portal.tech.everett.it:7777/
ProxyPreserveHost On
ORACLE SSO
http:/portal.mycompany.com:7777
Here are the steps i already do:
1- CONFIG OID
create an ldif file called setdasurl.ldif and insert as follow:
dn:cn=OperationURLs,cn=DAS,cn=Products,cn=OracleContext
changetype: modify
replace: orcldasurlbase
orcldasurlbase: http:/proxy.mycompany.com/
then do ldapmodify as follow:
ldapmodify -x -h portal.mycompany.com -p 3060 -D "cn=orcladmin" -w password1 -v -f setdasurl.ldif
2- CONFIG ORA SSO (as gentjan user)
export ORACLE_HOME=/home/gentjan/product/10.1.2/OracleAS/infra/
2.1-config Apache config of ORA SSO
vi $ORACLE_HOME/Apache/Apache/conf/httpd.conf
change from:
ServerName portal.mycompany.com
Port 7777
KeepAlive On
to:
ServerName proxy.mycompany.com
Port 80
KeepAlive Off
and add at the end of httpd.conf
RewriteEngine On
RewriteOptions inherit
2.2- update DCM Repository (as root)
*$ORACLE_HOME/dcm/bin/dcmctl updateconfig -ct HTTP_Server -v -d*
2.3- modify SSO Server Home URL to reverse proxy hostname and port (as root)
*$ORACLE_HOME/sso/bin/ssocfg.sh http proxy.mycompany.com 80*
2.4- Updating the targets.xml File
Open the ORACLE_HOME/sysman/emd/targets.xml file and locate the target type oracle_sso_server.
vi $ORACLE_HOME/sysman/emd/targets.xml
Update the HTTPMachine and HTTPPort attributes with the proxy server host and port attributes that were passed to ssocfg. For example:
Property NAME="HTTPMachine" VALUE="proxy.mycompany.com"
Property NAME="HTTPPort" VALUE="80"
Property NAME="HTTPProtocol" VALUE="http"
Save and close the file.
Reload the Application Server Control Console by issuing this command (as gentjan):
*$ORACLE_HOME/bin/emctl reload*
2.5- Re-register mod_osso on SSO Middle-tier with reverse proxy hostname and port
some needed permissions
chmod -R 775 /home/gentjan/product/10.1.2/OracleAS/infra/dcm/
Re-register mod_osso (as gentjan)
*$ORACLE_HOME/sso/bin/ssoreg.sh -oracle_home_path /home/gentjan/product/10.1.2/OracleAS/infra -site_name infra.proxy.mycompany.com -config_mod_osso TRUE -mod_osso_url http:/proxy.mycompany.com:80 -update_mode MODIFY*
2.6- update DCM Repository (as root)
*$ORACLE_HOME/dcm/bin/dcmctl updateconfig -ct HTTP_Server -v -d*
2.7- Restart OC4J_Security and Oracle HTTP Server at Infrastructure tier
*$ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=HTTP_Server*
*$ORACLE_HOME/opmn/bin/opmnctl restartproc process-type=OC4J_SECURITY*
After this modifications my reverse proxy is ok.
I can access to http:/proxy.mycompany.com:80 and this redirect me to Oracle Application Server Welcome page.
If i try http:/proxy.mycompany.com/pls/orasso/orasso.home, i can view the SSO Server Home page.
The problem that i find is when i click to Login page for Oracle SSO.
I have the following error:
Forbidden You don't have permission to access /pls/orasso/ORASSO.wwsec_app_priv.login on this server.
So, in other words i can't do the login/logout under reverse proxy. Anyone can help?
Gentjan

Reverse Proxy configuration

Hi ,
Shall I know to configure the reverse proxy server in DMZ along with HTTPS to HTTP redirection.
Regards,
Satyanarayana

Please check, this is specific to Oracle EBS, but good doc to understand on Reverse Proxy
Case History: Implementing a Reverse Proxy Alone in a DMZ Configuration - R12 (Doc ID 726953.1)

Reverse Proxy only in DMZ Node

Similar Messages

Maybe you are looking for