Webdispatcher as reverse proxy in DMZ

Hello,
We are planning to setup a webdispatcher in the DMZ that will connect to the portal to replace the external hardware load balancer that we currently have. The loads are not very heavy to we decided to do away with the external load balancer.
The scenario that we want to achieve is that from an external web browser, a user can connect to the portal. The certificates will be stored in the web dispatcher such that the connection from the external web browser to webdispatcher is secure. Then the SSL should terminate for connecting the webdispatcher to the portal.
I have read through the following but I'm still not sure on how to set this up.
How to...Configure SAP Webdispatcher as a reverse proxy
https://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/60d6de2e-085b-2b10-7a8f-bc9ae1e0bba6
Note 538405 - Composite SAP Note SAP Web Dispatcher
Can someone help me or point me to a document/material that can help me?
Thanks!
MRR

Try these:
http://help.sap.com/saphelp_nw70/helpdata/EN/d8/a922d7f45f11d5996e00508b5d5211/frameset.htm
http://help.sap.com/saphelp_nw70/helpdata/EN/39/09a63d7af20450e10000000a114084/frameset.htm
The second link has step by step process for setting up SSL, and the parameters needed for termination at the web dispatcher.
Cheers
Jane

Similar Messages

SAP webdispatcher as reverse proxy

I'm using SAPNW7.3 based web dispatcher.
I would like to know if it is possible to configure webdispatcher as reverse proxy with stateful applications...
In my landscape,
<client browser> --> <webdispatcher as reverse proxy> (say, A & B) --> <webdispatcher as load balancer> (say, C&D) --> <sap EP server x4> (say, W,X,Y,Z)
A&B operate on separate servers in parallel provide reverse proxy functionality... so do C&D for load balancing.
I have configured system C&D to connect to SAP EP by using profile parameter wdisp/system_1. I want to know how to configure A or B,
IMO, in System A
wdisp/system_1 = SID=EXT, EXTSRV=http://A:8000;http://B:8000, SRCSRV=*:8093
This sends all requests (u201Cround robinu201D) arriving in port 8093 on to the two servers C&D and thereby to EP app servers W,X,Y,Z.
In this case, we can't use stateful request as per http://help.sap.com/saphelp_nw73/helpdata/en/48/957c6494cc73eae10000000a42189b/frameset.htm
Is there any other way to configure A&B, to allow operating stateful connections. If not, does this mean that sap webdispatcher cannot be used as reverse proxy unless you are using only stateless requests (without stickiness)?

Hi
Kindly refer the SCN link
How to...Configure SAP Webdispatcher as a reverse proxy
http://basisondemand.com/Documents/Whitepaper_on_SAP_Web_Dispatcher.pdf
http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/a015cea3-9627-2e10-a792-8f39e3d0b59d?QuickLink=index&…
Regards
Sriram

Webdispatcher with reverse proxy

Hi Experts,
We need to deploy reverse proxy and web dispatcher. This is for a relatively budget savvy customer so cost is big issue. My question is :-
1) Can we deploy reverse proxy & webdispatcher on the same server ? (without using VMware). Probably we will use two Linux operating system.
2) Should we plan for failover on Webdispatcher ? Or running Webdispatcher without failover may not be that big issue.
Can you guys please share your thoughts on these two issues ? Urgently require your feedback on this.
Regards,
TB

Hi,
We need to deploy reverse proxy and web dispatcher.
The web dispatcher IS a reverse proxy. What do you mean ? I think you did not perfectly understand the need...
1) Can we deploy reverse proxy & webdispatcher on the same server ?
Yes, but it does not make sense to me until you have a very unusual requirement.
Should we plan for failover on Webdispatcher ?
If you need High availability, yes. You're the only one to know if you need it...
Regards,
Olivier

Doubts regarding reverse proxy in DMZ

Hi,
We are going to implement DMZ in a test environment following the metalink note:287176.1.
We have two sun servers so we have chosen Section 2.2(Fig 4) of 287176.1 as our deployment architecture.
The steps we are going to follow are:
1.Install Oracle Applications 11.5.10.2 in internal server.
2.Clone the application to external server.
3.Open the following ports:
80,443 in the external firewall and 1521 in the data firewall.
4.Follow steps from section 5.1,5.2,5.3,5.4 of 287176.1.
5.Configure the URL firewal specific to the product that we want to expose for external use.
Can someone please validate the above steps.
Also please clarify the following doubts:
1.Do we need a seperate external URL and domain to access the application from internet??
If yes then this domain and URL mapping is done in which configuration file??
2.Do we need to set up a reverse proxy server also for this architecture?If yes then is it necessary to deploy another reverse proxy server in front of external web server?
Cant we configure the external web tier itself as reverse proxy??
If yes then,how do we do it using 9iAS shipped with EBS...as we dont want to use standalone Apache for this and the document 287176.1 describes the steps to use a standalone Apache in section.(.Appendix D)..
Please help...
We have been given a time frame and limited resources to implement this POC.So a response is highly appreciated..
Thanks
ex:External URL:

We have two sun servers so we have chosen Section 2.2(Fig 4) of 287176.1 as our deployment architecture.If you chose the above configuration there is no reverse proxy setup.
1.Do we need a seperate external URL and domain to access the application >>from internet?? If yes then this domain and URL mapping is done in which >>configuration file??The changes are done on the external web tier in the application context file. (s_webentryhost - set to DMZ host name
s_webentrydomain - domain name of DMZ host
s_active_webport - port where the host will listen to requests
s_webentyurlprotocol - http or https according to your configuration
s_login_page - http(s)://webentypoint:webentrydomain:activewebport )
2.Do we need to set up a reverse proxy server also for this architecture?Again section 2.2 does not require a reverse proxy only external webhost
Please remember that the external host in DMZ runs only webtier. All the other services should be disabled.
If yes then,how do we do it using 9iAS shipped with EBSClone the AppsTier to external host. Edit the context file and disable all the processes except
<oa_process_status oa_var="s_apcstatus">enabled</oa_process_status>
Then you have a webtier running without standalone Apache.
I have recently finished configuring this setup.
Message was edited by:
bhetaal

Proper reverse proxy in DMZ

Hi all,
I am having OS X Server in Server-LAN part of network and I am using it for Open Directory, Profile Manager, Mail server... Of course push notifications are there too. However Apple needs to have the same server visible from internet to make push notifications and profile manager work.
In best practices I found solution using d-nat on certain ports, but exposing server to the internet this way is not acceptable. Therefore I am looking for some reverse proxy solution that I can put into my DMZ zone, that would allow me to use these services without direct exposure the server to the internet.
Currently I solved it using rinetd, but I am not very happy with this solution either.
Missing good solution for more than a year I wander how do you solve this issue?
Thanks.

The only Exchange role that is supported in a DMZ is the Edge role, but that doesn't do reverse proxy.
Several months ago I would have suggested you install TMG, but that product is no longer offered. There are third-party reverse proxy solutions, some integrated with load balancers and firewalls.
Windows Server 2012 R2 has ARR and WAP, both which do some of what you might want; you might investigate those.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

SAP Webdispatcher - Reverse Proxy Configuration

Hi All,
Need your help in configuration SAP Webdispatcher as reverse proxy. Currently we are using Apache as reverse proxy, but we are facing 400 Bad Request error and not able to solve the issue.
So We are planning to install Webdispatcher and configure reverse proxy and test.
Below is the Apache Reverse proxy configuration. Need help in configuring the same parameters in SAP Webdispatcher
ProxyPass /sap http://srmerver:8000/sap
ProxyPass /SRM-MDM http://mdmserver:50100/SRM-MDM
ProxyPass /mdmimages http://portalserver:8090/mdmimages
ProxyPass /irj http://portalserver:50100/irj
ProxyPass /saml2 http://portalserver:50100/saml2
ProxyPass / http://portalserver:50100/　
ProxyPassReverse /sap http://srmserver:8000/sap
ProxyPassReverse /SRM-MDM http://mdmserver:50100/SRM-MDM
ProxyPassReverse /mdmimages http://portalserver:8090/mdmimages
ProxyPassReverse /irj http://portalserver:50100/irj
ProxyPassReverse /saml2 http://portalserver:50100/saml2
ProxyPassReverse / http://portalserver:50100/
Regards
Ponnusamy

Hi
Kindly refer the SCN link
How to...Configure SAP Webdispatcher as a reverse proxy
http://basisondemand.com/Documents/Whitepaper_on_SAP_Web_Dispatcher.pdf
http://www.sdn.sap.com/irj/scn/go/portal/prtroot/docs/library/uuid/a015cea3-9627-2e10-a792-8f39e3d0b59d?QuickLink=index&…
Regards
Sriram

Reverse Proxy - Apache vs SAP Web Dispatcher

Hi,
my config consists in a portal (EP7.0 - DB/CI + AS) and an ECC system (ECC 6.0 - DB/CI + AS).
Web developments are based on Abap Web Dynpro and are also located on ECC.
To ensure load balancing there are 2 web dispatchers : one on EP DB/CI, one on ECC DB/CI.
Those 2 systems are located in intranet. Intranet access are realized via http.
Moreover I need to open this solution to internet. I need a component to filter access in DMZ and ensure reverse proxy + https functions.
Technical target chain links are depicted below.
internet access : browser (https) -
> (https) reverse proxy in DMZ (http) -
> IS (Portal/ECC)
intranet access : browser (http) -
> IS (portal/ECC)
At the moment two application gateway solutions have been identified :
Apache (MOD_PROXY + MOD_HTTPS) - My configuration is based on Linux
SAP Web Dispatcher ("cascading" implementation as described in OSS note 740234)
I'm looking for PROs and CONs of those 2 solutions and I'm also seeking for the impact of ensuring https encryption/decryption at the application gateway level ("a priori" this usage is not transparent in term of server sizing - CPU/memory, do I require to implement an SSL accelerator ?).
Regards.
Frederic.

Hi,
PRO Webdispatcher:
- Supports SAP Java + ABAP
- Loadbalancing of SAP applications (stateful)
- Supports load balancing (saplb_* cookie)
- Free of costs
- easy to set up (up & running in 2 minutes)
- Supports HA solutions out-of-the-box (process HA)
- Filter + Rules to modify the requests
CONS Webdispatcher
- not a full reverse proxy
- Limited functionality
- one more server/solution (normaly, a company already does have a reverse proxy solution in place)
- limited user base (only SAP customers)
PRO Apache
- free
- widly in use
- full reverse proxy
- allows more complex filtering / rewriting
- can be used for more web solutions, reuse of existing apache reverse proxy
CONS Apache
- does not support SAP load balancing (connection to the message server port for load distribution)
- can be more complex to set up
- SAP specific technology / problems are more harder to fix (ABAP, Stateful connections, sap_lb*)
Short: both will server well as a reverse proxy.
Rule of thumb: If you go for Apache or Web Dispatcher should mainly depend on you current IT landscape. If you already do have an apache in use, use Apache. You already have the people / knowledge, try to foster it .
If you start from scratch and have SAP Logon Groups or many WebDynpro ABAP applications, go for the Web Dispatcher.
br,
Tobias

X.509 client certificate not working through Reverse proxy

Dear expert,
We are working on fiori infrastructure. Our current scope is to enable X.509 authentication for both internet and intranet. However, the intranet scenario for X.509 authentication is working fine but internet is not, we got error message of "Base64 decoding of certificate failed". For landscape, the only difference between internet and intranet is we have apache reverse proxy in DMZ. We are using gateway as fron-end server, business suite and HANA in the back-end.
As X.509 authentication works fine under intranet scenario, we assume that the configuration for X.509 for both front-end and back-end are correct. With that assumption, the issue would exist in reverse proxy. We are using apache 2.4.7 with openssl 1.0.1e, but we have upgraded the openssl to the latest version 1.0.1h for SSL certificate generation. Below are the apache configuration for X.509.
Listen 1081
<VirtualHost *:1081>
SSLEngine on
SSLCertificateFile "D:/Apache24/conf/server.cer"
SSLCertificateKeyFile "D:/Apache24/conf/server.key"
SSLCertificateChainFile "D:/Apache24/conf/server-ca.cer"
SSLCACertificateFile "D:/Apache24/conf/client-ca.cer"
SSLVerifyClient optional
SSLVerifyDepth 10
SSLProxyEngine On
SSLProxyCACertificateFile "D:/Apache24/conf/internal-ca.cer"
SSLProxyMachineCertificateFile "D:/Apache24/conf/server.pem"
AllowEncodedSlashes On
ProxyPreserveHost on
RequestHeader unset Accept-Encoding
<Proxy *>
     AddDefaultCharset Off
     SSLRequireSSL
     Order deny,allow
     Allow from all
</Proxy>
RequestHeader set ClientProtocol https
RequestHeader set x-sap-webdisp-ap HTTPS=1081
RequestHeader set SSL_CLIENT_CERT ""
RequestHeader set SSL_CLIENT_S_DN ""
RequestHeader set SSL_CLIENT_I_DN ""
RequestHeader set SSL_CLIENT_CERT "%{SSL_CLIENT_CERT}s"
RequestHeader set SSL_CLIENT_S_DN "%{SSL_CLIENT_S_DN}s"
RequestHeader set SSL_CLIENT_I_DN "%{SSL_CLIENT_I_DN}s"
ProxyPass / https://ldcinxd.wdf.sap.corp:1081/ nocanon Keepalive=on
proxyPassReverse / https://ldcinxd.wdf.sap.corp:1081/
We are out of mind on how to resolve this issue. Please kindly help if you have any idea on it.
thanks,
Best regards,
Xian' an

Hi Samuli,
Really thanks for your reply.
Yes, we have tried your suggestion above in the apache configure file above, but when testing the HANA service, we got error message "Certificate could not be authenticated".
Yes, web dispatcher makes the X.509 authentication much easier as under intranet scenario, no DMZ between browser and web dispatcher. Client certificate pass through web dispatcher directly and it works perfectly this way. Not sure why it doesn' t work through apache reverse proxy.
Best regards,
Xian' an

WSSecurity - WebDispatcher(reverse proxy)

Hi All,
We are planning to implement webservices using PI 7.1 and would like to capitalise on the WSSecurity standard along with the Webdispatcher performing the reverse proxy functionality. Is there a standard procedure to do that? Where can we find more information in terms of the interoperability of WSSecurity with reverse proxy using SAP Netweaver. We do not want to use SSL. Is it a possiblity.
Thanks in advance.
Vedavyas

As I know, the Web Dispatcher is not able to validate WS security. Maybe tools from other vendors can do this?
A non-central adapter engine could be set up like this:
|| DMZ 1 || DMZ 2 ||
---> Web Dispatcher --> Adapter Engine --> PI
|| || ||
So the adapter engine could do the validation of WS security, before it leaves the DMZ.
Maybe you put the question also in the Security forum
Security
Regards
Stefan

DMZ with reverse proxy

Hi All,
I am trying to configure DMZ.
But I am having only one node for apache.
So I thought of configuring DMZ using Reverse Proxy with no External node.
But I am bit confused with configuration of Reverse Proxy using the apache shipped with E-business
My current archecture like:
Node 1 : Apache ,Forms and MWA
Node 2 : CM and DB
OS : AIX 5.3
Version : 11.5.10.2
DB : 10.2.0.4
1.Will there be 2 apache process running as applmgr on node1(one for external and other for internal)
2.Will there be 2 context files in node1 (one for external and other for internale)
3.How to configure 2 Server name for node1
Thanks in advance

Hi,
Did you review (Note: 438744.1 - Case History: Implementing a Reverse Proxy Alone in a DMZ Configuration - 11i)?
Regards,
Hussein

HTTP Filtering and Reverse Proxy + DMZ

Hello all, I'm consolidating a number of my services and securing up my network.
To give some context I have 1 static IP, several websites in the form of subdomain.domain.com where domain.com is the same but there are numerous subdomains which reside on different servers. Until recently we were just using port forwarding, etc. to access
these remotely (subdomain.domain.com:9090, subdomain2.domain.com:9091) etc. but I would like to clean this up.
We have a 5505 ASA which our static IP is natted to. That has a static route to an IIS server in the 'DMZ' portion of our network. I would like to find a way to have this server see 'subdomain1.domain.com' and send it to the server hosting that service, and
so on for the other services.
I think I want to use Reverse-Proxy but I have never delved in to IIS 8 before and the extent of my reverse proxy experience was using nginx to host several web services for a friend.
If I could get any advice on 1) how to filter the url requests and direct them to the right server (some are non-windows servers) and 2) how to do this securely from the DMZ to the internal lan?
Thanks SO much for any help!

To give a better picture, here's a more complete description of set up and goals
Static IP hits external interface of ASA. ASA has a static nat rule to forward it to my DMZ server.
DMZ server is running IIS 8. Here are what some of the sites look like.
jira.xxxxx.com -> 10.1.10.21 (ubuntu server) | port 80
email.xxxxx.com - > 10.1.10.16 (domain joined server 2012) port 80, 443
media.xxxxx.com -> 10.1.10.14 (domain joined server 2012) port 80, 443
other stuff like this -> 10.1.10.x port 80 or others
All of the A records for those domain names point to the static which routes to the ASA and then is NAT'd to the DMZ server.
What do I need to do in IIS to have those sites get directed to the proper internal locations?
Thanks!!

OCS on a single computer / DMZ using Apache reverse proxy

Hi there,
we've installed the OCS 10.1.2 on a single Solaris box in our internal LAN. Everything works fine internally. We would like to configure a Apache reverse proxy in our DMZ to get the possibility to use it from outside (as shown in "Oracle Collaboration Suite Deployment Guide", chapter 3, Figure 3-2 Single Computer in a DMZ). Unfortunately I didn't find any configuration hints for the reverse proxy.
Can someone provide me with an example configuration?
Thanks,
Christoph

Hello Andreas and Christoph!
I have the same problem like Christoph. We made a Singlebox-Installation of OCS 10.1.2 in the intranet. Now I am looking for installation documentation, how I have to configure a Apache or Oracle Standalone Webcache as a reverseproxy in the DMZ. to allow access the OCS from the internet. I only read, that it is possible, but nothing about the way.
I have installed a Webcache (OAS 10.1.2 Java Edition not dht standalone Veersion from the Companion CD) and configured by my own knowledge. The result was network errors.
Is there anywhere information?
Best regards!
Axel

SharePoint 2010 portal on DMZ with reverse proxy

Hi,
I need to publish sharepoint portal for extranet,Portal can access on internet with AD credential.
i have one WFE,one App and on db server,I need to know WFE server is required to host on DMZ or new server with any reverse proxy tool.
we are more concern about security threat.
Hasan Jamal Siddiqui(MCTS,MCPD,ITIL@V3),Sharepoint and EPM Consultant,TCS
|
| Twitter

Chek below:
http://technet.microsoft.com/en-us/library/dn607304%28v=office.15%29.aspx
Port details:
APP\WEB
1.1.1.1
1.1.1.2
APP\WEB
1.1.1.1
1.1.1.2
TCP 16500-16519
search index component
APP\WEB
1.1.1.1
1.1.1.2
APP\WEB
1.1.1.1
1.1.1.2
TCP 22233-22236
AppFabric Caching Service
APP\WEB
1.1.1.1
1.1.1.2
APP\WEB
1.1.1.1
1.1.1.2
TCP 808
Windows Communication Foundation communication
APP\WEB
1.1.1.1
1.1.1.2
APP\WEB
1.1.1.1
1.1.1.2
TCP 32843, 32844, 32845
Web servers and service applications (the default is HTTP)
APP\WEB
1.1.1.1
1.1.1.2
AD DS \DNS(If multiple please include)
1.1.1.3
TCP 5725 TCP&UDP 389 (LDAP service) TCP&UDP 88 (Kerberos) TCP&UDP 53 (DNS) UDP 464 (Kerberos Change Password)
synchronizing profiles between SharePoint 2013 and Active Directory Domain Services (AD DS)
APP\WEB
1.1.1.1
1.1.1.2
SQL
1.1.1.4
TCP 1433, UDP 1434
SQL Server communication
APP\WEB
1.1.1.1
1.1.1.2
APP\WEB
1.1.1.1
1.1.1.2
TCP 32846
SharePoint Foundation User Code Service
APP\WEB
1.1.1.1
1.1.1.2
SMTP server
1.1.1.5
TCP 25
SMTP for e-mail integration
APP\WEB
1.1.1.1
1.1.1.2
APP\WEB
1.1.1.1
1.1.1.2
TCP 30000
Central Admin
APP\WEB
1.1.1.1
1.1.1.2
APP\WEB
1.1.1.1
1.1.1.2
TCP 2382
SQL Server Browser service
SQL1
1.1.1.4
SQL2
1.1.1.5
TCP 1433 and TCP 5022.
Multiple SQL if exists
APP\WEB
1.1.1.1
1.1.1.2
SQL1
1.1.1.4
TCP port 135
Integration Services service
APP\WEB
1.1.1.1
1.1.1.2
All clients
All
TCP 80/443
For client access
If this helped you resolve your issue, please mark it Answered

Implementing a Reverse Proxy Alone in a DMZ Configuration....???

Hii All ,
have anybody implemented this configuration..??
Implementing a Reverse Proxy Alone in a DMZ Configuration - R12 [ID 726953.1]
we planning to implement this configuration, please guide me if anybdy implemented and working with this configuration.
Thanks
RB

Hi,
1)in that document they have used 10g webcache as reverse proxy... but in my case already modproxy in place can i use this modproxy in place of 10g webcache..?A number of options exist for choosing a reverse proxy -- See (Oracle E-Business Suite R12 Configuration in a DMZ [ID 380490.1]), Appendix D: Reverse Proxy Configuration
It is also explained in this article.
In-Depth: Demilitarized Zones and the E-Business Suite
http://blogs.oracle.com/stevenChan/2006/05/indepth_demilitarized_zones_an.html
2)i have 2 web nodes loadbalancing through reverseproxy, do i need to configure the external web node on both the web nodes ..according to the above doc..?You do not need to have a dedicated reverse proxy for each web tier node (see the second diagram in this doc).
Advanced Deployment Architectures for Oracle E-Business Suite (OpenWorld 2008 Recap)
http://blogs.oracle.com/stevenChan/2008/11/advanced_deployment_architectures_for_oracle_ebs.html
Thanks,
Hussein

Reverse Proxy only in DMZ Node

Hi Everyone,
We are implementing reverse only proxy in DMZ in R12.1.1 option 2.4 in DMZ note. I have few doubts regarding the setup. I would appreciate if anyone could clarify those.
I have a reverse proxy server in DMZ with a public IP and internal IP( We have built apache from souce as reverse proxy)
I have a MT(Linux box) with Two IP's one for Internal Webentry (port 8001)and second IP for external webentry(port 8002). These two have been registered in DNS the first ip would resolve to appsmt and second one would resolve to appsrp
We have Created packet filter rule allowing reverse proxy to communicate explicitly with MT(appsrp) on second IP (for external webentry) over TCP port 8002
As per DMZ note 726953.1 or 380490.1
1)what should I give when it prompts for host name when I run adclonectx.pl Step 5.9.1
Target System Hostname (virtual or normal) [dcoll12xc] :
should I give reverse proxy hostname or second host name on the MT for the external webentry
2) What should I give values for below
s_webentryhost
s_webentrydomain
s_active_webport
s_server_ip_address
should they be reverse proxy hostname/Ip or second host name/Ip on the MT for the external webentry?
Thanks

Hi user;
Please follow Oracle E-Business Suite R12 Configuration in a DMZ [ID 380490.1]
For your question 1 please check upper note part *5.9.1: Create a new context file for the external Web Entry Point* , it is explain there what you have to enter
For your question 2 please check upper note part *5.4.1: Update Oracle E-Business Suite Applications Context File*, it is explain there what you have to enter
Hope it helps
Regard
Helios

Webdispatcher as reverse proxy in DMZ

Similar Messages

Maybe you are looking for