When configuring Oracle E-Business Suite in a DMZ configuration, you can deploy firewalls at different levels to restrict access to only the web pages required for the business.<\/p>\n
The URL Firewall blocks access to unnecessary web pages in modules that are not installed, configured, or licensed.<\/p>\n
The external DMZ environment within the Oracle EBS architecture allows access to over 15,000 web pages when very less web pages are required. An attacker may be able to exploit security vulnerabilities present in any of these 15,000 web pages to access the core EBS application and the modules that support the business.<\/p>\n
Following steps help enable firewall in a DMZ setup.<\/p>\n
Rule 1<\/em> says when the user type \/ after the hostname, d<\/p>\n omain name and<\/p>\n #Include URLs for product IBE (iStore) with CZ<\/p>\n Enabled all the pages mentioned inside the IBE product section.<\/p>\n port number and then \/; this will redirect user to the \/OA_HTML\/ AppsLocalLogin.jsp and will stop applying any rewrite rule.<\/p>\n Rule 2<\/em> Display same url as mentioned on the left, \/OA_HTML\/jsp\/fnd\/AOLDataStreaming.jsp<\/p>\n [R,L] at the end R- Means Rewrite L- Last rewrite rule (No more rule to apply after this)<\/p>\n Rule 1<\/em> says when the user type \/ after the hostname, domain name and port number and then \/; this will redirect user to the \/OA_HTML\/ AppsLocalLogin.jsp and will stop applying any rewrite rule.<\/p>\n Rule 2<\/em> Display same url as mentioned on the left, \/OA_HTML\/jsp\/fnd\/AOLDataStreaming.jsp<\/p>\n [R,L] at the end R- Means Rewrite L- Last rewrite rule (No more rule to apply after this)<\/p>\n Rule 1<\/em> says when the user type \/ after the hostname, domain name and port number and then \/; this will redirect user to the \/OA_HTML\/ AppsLocalLogin.jsp and will stop applying any rewrite rule.<\/p>\n Rule 2<\/em> Display same url as mentioned on the left, \/OA_HTML\/jsp\/fnd\/AOLDataStreaming.jsp<\/p>\n [R,L] at the end R- Means Rewrite L- Last rewrite rule (No more rule to apply after this)<\/p>\n For more understanding of the concept.<\/strong><\/p>\n . (dot) means matches any characters<\/p>\n [] specifies a class<\/p>\n [a-z] matches any lowercase characters from a to z<\/p>\n [a-zA-Z0-9] matches any character upper or lower case from a to z and numeric 0 to 9<\/p>\n [abc$] matches a or b or c or $<\/p>\n [^0-9] matches anything except digit 0 to 9. Here ^ is negation<\/p>\n Meta Characters in Regular Expressions<\/p>\n ^ \u2013 Matches Start of a line<\/p>\n $ \u2013 Matches End of line<\/p>\n Quantifiers for Characters<\/em><\/p>\n ? matches zero or one instance of character<\/p>\n Allowing the following jsp pages by UN-comment them from the url_fw.conf file:<\/p>\n Under section \u2013 #Include URLS for login method: LOCAL<\/p>\n Before: RewriteRule ^\/$ https:\/\/<ISTORE_URL>:\/OA_HTML\/AppsLogin [R,L]<\/p>\n #RewriteRule ^\/OA_HTML\/OA.jsp$ – [L]<\/p>\n #RewriteRule ^\/OA_HTML\/RF.jsp$ – [L]<\/p>\n #RewriteRule ^\/OA_HTML\/AppsLocalLogin.jsp$ – [L]<\/p>\n #RewriteRule ^\/OA_HTML\/AppsLocalLogout.jsp$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/OALogout.jsp$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/OAErrorPage.jsp$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/OAErrorDetailPage.jsp$ – [L]<\/p>\n #RewriteRule ^\/OA_HTML\/OAExport.jsp$ – [L]<\/p>\n #RewriteRule ^\/OA_HTML\/OADownload.jsp$ – [L]<\/p>\n #RewriteRule ^\/OA_HTML\/fndvald.jsp$ – [L]<\/p>\n #RewriteRule ^\/OA_HTML\/AppsLogin$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/AppsLogout$ – [L]<\/p>\n After:<\/strong><\/p>\n RewriteRule ^\/$ https:\/\/<ISTORE_URL>:\/OA_HTML\/AppsLogin [R,L]<\/p>\n RewriteRule ^\/OA_HTML\/OA.jsp$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/RF.jsp$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/AppsLocalLogin.jsp$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/AppsLocalLogout.jsp$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/OALogout.jsp$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/OAErrorPage.jsp$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/OAErrorDetailPage.jsp$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/OAExport.jsp$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/OADownload.jsp$ – [L]<\/p>\n #RewriteRule ^\/OA_HTML\/fndvald.jsp$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/AppsLogin$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/AppsLogout$ – [L]<\/p>\n We can keep everything enabled inside the following mentioned sections<\/strong><\/p>\n Please note, since we are using product IBE, we have enabled all the pages.<\/p>\n In this section, and along with the same we have enabled common pages (not related to product) as well.<\/p>\n #Include URLs for product IBE (iStore) with CZ<\/p>\n Enable all the pages mentioned inside the IBE product section.<\/p>\n Enabled this entry to get pass the HTTP 400 Bad Request error and add to cart started working fine.<\/strong><\/p>\n RewriteRule ^\/OA_HTML\/JavaScriptServlet* – [L]<\/p>\n RewriteRule ^\/OA_HTML\/ibe*.js$ – [L]<\/p>\n #Include URLs for product IBE (iStore) with CZ<\/p>\n Enable all the pages mentioned inside.<\/p>\n After the firewall was enabled on the iStore backend server, the LB marked the service as \u201cDown\u201d. It seems the firewall change produced a redirect and changed the response code from a 200 to a 302. The index.html page was permitted and the monitor was successfully reconfigured to check \u201c\/index.html\u201d.<\/p>\n Before index.html was used<\/em><\/p>\n HTTP\/1.1 302 Found<\/p>\n Date: Mon, 20 Jul 2020 20:55:50 GMT<\/p>\n Location : https:\/\/<URL.HOSTNAME>:\/OA_HTML\/AppsLogin<\/p>\n Content-Type: text\/html; charset=iso-8859-1<\/p>\n After index.html was used<\/em><\/p>\n curl -Ik https:\/\/<IP_ADDRESS>:\/index.html<\/p>\n HTTP\/1.1 200 OK<\/p>\n Date: Mon, 20 Jul 2020 21:10:27 GMT<\/p>\n X-Content-Type-Options: nosniff<\/p>\n Last-Modified: Mon, 20 Jul 2020 20:40:39 GMT<\/p>\n ETag: \u201chd4503-7wd-5f98747\u201d<\/p>\n Accept-Ranges: bytes<\/p>\n Content-Length: 1275<\/p>\n Content-Type: text\/html<\/p>\n Open IE and navigate to the page having issue in the istore.<\/p>\n Press F12 -> Navigate to the Network tab to find out the exact page in question this can be any page like JavaScriptServlet* , ibe* or *.jsp<\/p>\n Once the exact page with issues is identified, you need to add the page as shown in the following snapshot.<\/p>\n $ORA_CONFIG_HOME\/10.1.3\/Apache\/Apache\/conf\/url_fw.conf file, bounce the services to make sure now the page is working fine.<\/p>\n Example of entries include.<\/p>\n RewriteRule ^\/OA_HTML\/JavaScriptServlet* – [L]<\/p>\n RewriteRule ^\/OA_HTML\/ibe*.js$ – [L]<\/p>\n RewriteRule ^\/OA_HTML\/<custom_pagename>.*.jsp$ – [L]<\/p>\n Please note<\/strong> – These entries need to be added in the appropriate place in the url_fw.conf file. Once all the settings are complete and verified and the pages are working fine, you can make the changes in the template file url_fw_conf_1013.tmp<\/strong> ($FND_TOP\/admin\/template\/url_fw_conf_1013.tmp ) and copy the file to custom folder ($FND_TOP\/admin\/template\/custom\/url_fw_conf_1013.tmp ) and run autoconfig.<\/strong><\/p>\n Firewall controls access between the internet and internal network or intranet (within the organization). Firewall dictates which external communications will be permitted into the organization network, and which will be blocked. A well-designed firewall can prevent numerous common internet-based security attacks.<\/p>\n By following and completing the above mentioned steps, one can systematically enable the firewall in a DMZ setup and debug the issue.<\/p>\n","protected":false},"excerpt":{"rendered":" URL FIREWALL for External Node\/DMZ<\/p>\n","protected":false},"author":2,"featured_media":6933,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","format":"standard","meta":{"content-type":"","nid":"25724","content_type":"blog","created_by":"10130","authored_on":"2023-07-11T21:52:20+00:00","field_article_industries":"","tag_category":"Technical","field_blog_author_text":"by Rackspace Technology Staff","seo_description":"Enhance Oracle E-Business Suite security in a DMZ setup with a URL Firewall. Block access to unnecessary web pages for added security.\r\n","field_featured_image":"","insights_image":"\/wp-content\/uploads\/2026\/blog_technical_images\/25724-insights_image-oracle-technical-blog-1-insights.jpg","field_partners":"","rxt_platforms":"Oracle","product":"","publisheddate":"2022-03-03T22:52:20","rxt_solutions":"Databases, Security","opengraph_tag":"","x_tag":"","teaser_flag":"Technical Blog","seo_titile":"Oracle E-Business Suite with FIREWALL in DMZ Configurations","field_topics":"","field_slug":"url-firewall-for-external-node-dmz","footnotes":""},"categories":[178],"tags":[204],"class_list":["post-6931","blogs","type-blogs","status-publish","format-standard","has-post-thumbnail","hentry","category-blog","tag-technical"],"_links":{"self":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/6931","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs"}],"about":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/types\/blogs"}],"author":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/comments?post=6931"}],"version-history":[{"count":1,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/6931\/revisions"}],"predecessor-version":[{"id":6932,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/blogs\/6931\/revisions\/6932"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media\/6933"}],"wp:attachment":[{"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/media?parent=6931"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/categories?post=6931"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.rackspace.com\/en-gb\/wp-json\/wp\/v2\/tags?post=6931"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}+<\/code> matches one or more instance of character<\/p>\n*<\/code> matches zero or more instance of character<\/p>\n2) MODIFY FILE $ORA_CONFIG_HOME\/10.1.3\/APACHE\/APACHE\/CONF\/URL_FW.CONF COMMENT\/DISABLE THE REQUIRED JSPS IN THE FIREWALL<\/h4>\n
IN CASE YOU NEED TO DISABLE THE FIREWALL FOR THE CZ PRODUCT, COMPLETE THE FOLLOWING STEPS:<\/h4>\n
3) NETWORK TEAM IS REQUIRED TO CHANGE THE HEARTBEAT FOR THE LOAD BALANCER SO THEY DO IT USING THE INDEX.HTML<\/h4>\n
4) TROUBLESHOOTING TIPS IN CASE ANY SPECIFIC PAGE IS NOT WORKING, CUSTOM PAGE OR THE SEED PAGE.<\/h4>\n
Conclusion<\/h3>\n