What is the minimal number of open ports needed to use forms apps

Question

Hi,
Our network administrators are doing a network segmentation / security project and they want to make it so that only authorized users can ping or see my oracle EBS server on the network, but they also want to lock down all ports that users can see, except for port 8000, which is the port we use to serve EBS on apache. I am having an argument with them. Because we use forms in socket mode, I am arguing that we need to keep all ports open because forms uses a port range and creates a socket with the users's PC in addition to holding/maintaining the Apache connection. My network administrator is saying no, it holds the socket connection in the background and they only need "access" to port 8000. I would agree with them if I was using servlet mode, but I don't think they are correct in socket mode. What port range do I need to make sure they allow through in addition to port 8000? BTW we use all the standard ports in EBS (eg 8000 is the out-of-the-box Apache port). Note also we have have single tier 11.5.10.2 installation on a solaris sparc server, so the ports that the 11i apps needs to interact / connect with itself is not relevant to the question. Also, the IT group (me) will still have access to all ports to do telnet, ssh, ping etc, we are only talking about from our end users's PCs. They are telling me to install Wireshark to find out more, and do some testing which I will - but I want to know what to expect.
Thanks Marv

Answer 1

Hussein,
Ok I have read the above documentation extensively. One thing that is quite clear is that if I switched to servlet mode, then all traffic goes through the Apache port (in my case 8000) and that would be the only port users need access too -- and this would be like setting up a DMZ or firewall inside the intranet. However, given that I am having performance issues, I need to know how to do this using forms in socket mode.
So for example in MOS 414439.1 it lists the entire ports and port pools. So I've taken that list, and separated it into groups One and Two (see below). My question is: To access EBS in the intranet by users, which of the ports in Group One is needed? And are all of the ports in group Two NOT needed? thanks in advance. Marv.
Group One of Port Pool
Web Listener Port s_webport      8000 ---> this is needed for sure.
Forms Listener Port s_formsport 9000 -------> this seems to be needed for sure.
Forms Servlet Port Range      s_forms_servlet_portrange      18000-18009 --> is this needed in socket mode?
Forms Start Port      s_frmStartPort      20000 --> is this needed?
Group Two of Port Pool - I believe that users do not need to have access to these ports for EBS, even
in forms socket mode..
Database Port      s_dbport      1521      
RPC Port      s_rpcport      1626      
Reports Port      s_repsport      7000      
OPROC Manager Port      s_oprocmgr_port      8100
Web PLSQL Port      s_webport_pls      8200
Servlet Port      s_servletport      8800      
Metrics Server Data Port      s_metdataport      9100      
Metrics Server Req. Port      s_metreqport      9200
JTF Fulfillment Server Port      s_jtfuf_port      9300      
iMeeting Collaboration Server Port      s_imtsrvport      9500      
iMeeting Recording Server Port      s_imtrecport      9600      
iMeeting Monitor (iMon) Port      s_imtimonport      9700      
Map Viewer Servlet Port      s_mapviewer_port      9800      
OEM Web Utility Port      s_oemweb_port      10000
VisiBroker OrbServer Agent Port      s_osagent_port      10100      
MSCA Server Port      s_mwaPortNo      10200      
MSCA Dispatcher Port      s_mwaDispatcherPort      10300      
TCF Port      s_tcfport      15000      
OACORE Servle Port Range      s_oacore_servlet_portrange      16000-16009      
Discoverer Servlet Port Range      s_disco_servlet_portrange      17000-17009           
XMLSVCS Servlet Port Range      s_xmlsvcs_servlet_portrange      19000-19009      
Java Object Cache Port      s_java_object_cache_port      12345      
-- end of port pool list--