1 Introduction

 Kemp's LoadMaster family of purpose-built hardware and Virtual Appliances (Virtual LoadMaster) offer advanced Layer 4 and Layer 7 server load balancing, content switching, SSL Acceleration and many other advanced Application Delivery Controller (ADC) and optimization features.

The Kemp LoadMaster fully supports Oracle E-Business Suite and has been certified by Oracle. The LoadMaster efficiently distributes user traffic for the Oracle workload so users get the best performance experience possible. Also, High Availability (HA) and high capacity scale-out deployments of the Oracle solutions are complemented from the network technology side.

The entire Kemp LoadMaster product family, including the Virtual LoadMaster (VLM) supports Oracle.

For more information about Kemp, visit www.kemptechnologies.com.

1.1 Document Purpose

This document is intended to provide technical guidance on configuring the Kemp LoadMaster to provide various application delivery network services for Oracle E-Business Suite application.

1.2 Prerequisites

The reader should be a network administrator or a person familiar with networking and general computer terminology.

The Oracle environment must be set up and the Kemp LoadMaster installed.

A network and an Oracle administrator should collaborate on details relating to network and application configurations.

The minimum system requirements are:

LoadMaster with firmware version 7.1 or later

Oracle E-Business Suite 12 or later

Configured internal and external Domain Name Server (DNS) entries for the Oracle applications

Established access to the LoadMaster Web User Interface (WUI)

The complete LoadMaster documentation suite can be found at: http://www.kemptechnologies.com/documentation.

2 Load Balancing Oracle E-Business Suite

Deploying an Oracle environment requires multiple servers to provide High Availability (HA). Load balancing is necessary to distribute the traffic amongst these servers.

Kemp recommends the configuration shown in the above Oracle Network Topology diagram. In this scenario, the Oracle E-Business Suite version 12 leverages the Oracle Database version 11. If your configuration differs from the recommended one and there are issues deploying the LoadMaster, please contact your local Kemp Support Team for assistance.

3 Template

Kemp has developed a template containing our recommended settings for this workload. You can install this template to help create Virtual Services (VSs) because it automatically populates the settings. You can use the template to easily create the required VSs with the recommended settings. You can remove templates after use and this will not affect deployed services. If needed, you can make changes to any of the VS settings after using the template.

Download released templates from the following page: LoadMaster Templates.

For more information and steps on how to import and use templates, refer to the Virtual Services and Templates, Feature Description.

4 Configuring Virtual Services for Oracle

The sections below provide instructions and recommended configuration options for setting up a Kemp LoadMaster to work with the Oracle E-Business Suite.

For an explanation of each of the fields mentioned, refer to the Web User Interface (WUI), Configuration Guide.

4.1 Ports

In some cases, the ports used for accessing Oracle E-Business Suite are non-standard to provide better security. In general, all ports used by the Oracle backend systems can be freely configured by the Oracle application administrator. The standard HTTP 80 and HTTPS 443 ports for Internet-facing traffic are supported and may be used during the configuration. However, the purpose of an ADC is to provide standard ports 80/443 for Internet-facing traffic and route that traffic to non-standard ports used on the Oracle backend systems as a passive security measure.

4.2 Persistence

Persistence will provide client connections to the same Oracle server node of a scale out cluster deployment for each subsequent request to the Virtual Service.

More information on Virtual Services and other LoadMaster features can be found in the Web User Interface (WUI), Configuration Guide on the Kemp website.

Source IP Address Persistence

If enabling Source IP Address persistence note that:

Clients from behind a Network Address Translation (NAT) device show up as a single IP address

It can result in uneven connection distribution

Cookie Persistence

If cookies are used, there is no negative impact. The name of the cookie does not have any specific requirements.

4.3 SSL Acceleration

With SSL Acceleration enabled on a Kemp LoadMaster, there are two options which can be leveraged. Which option to choose is primarily determined by the corporate security policies within an organization.

SSL Offloading

This option allows the LoadMaster to accept connections from the clients encrypted over HTTPS and then sends the traffic to the Oracle backend application un-encrypted over HTTP. In some environments this is not permitted due to the possible security risks.

SSL Reencrypt

This option allows the LoadMaster to accept connections from the clients encrypted over HTTPS and then re-encrypts the traffic over HTTPS before sending to the Oracle EBS backend application. This configuration typically provides the security requirements for most organizations.

4.4 Certificates

Certificates play a large part in the configuration of the Oracle EBS applications. Several certificate types are used as in this configuration and must be imported into the LoadMaster.

More information about managing LoadMaster certificates can be found in SSL Accelerated Services, Feature Description document on the Kemp website.

4.4.1 Server Certificates

To encrypt traffic between the client and the LoadMaster, the necessary certificates must be installed. If the configuration is to be encrypted traffic from end to end, the same certificates on the back end systems may be used. These certificates can either be in .PEM or .PFX formats and are imported under Certificates & Security > SSL Certificates in the main menu of the LoadMaster WUI.

4.4.2 Intermediate Certificates

Intermediate certificates are imported to allow the LoadMaster to trust the Certificate Authorities used in obtaining the Server and Client Certificates. These certificates are in Base64 format and are imported under Certificates & Security > Intermediate Certs in the main menu of the LoadMaster WUI.

5 Configure the Virtual Service for Oracle E-Business Suite with SSL Acceleration

In most cases the deployment of Oracle E-Business Suite requires client to server encryption.  To configure a Virtual Service with SSL Acceleration for Oracle E-Business Suite, use the following steps:

1. In the main menu of the LoadMaster WUI, go to Virtual Services > Add New.

2. Enter a valid IP address in the Virtual Address text box.

3. Enter 443 in the Port text box.

The port may differ depending on the Oracle environment.

4. Enter a recognisable Service Name, for example Oracle HTTPS.

5. Ensure tcp is selected as the Protocol.

6. Click Add This Virtual Service.

7. Configure the settings as shown in the following table:

Section	Option	Value	Comments
Basic Properties	Service Type	HTTP/HTTPS
Standard Options	Transparency	Disabled
	Persistence Mode	Active Cookie
	Persistence Timeout	12 Hours
	Idle Connection Timeout	1800	The Persistence and Scheduling may differ depending on requirements.
SSL Properties	SSL Acceleration	Enabled
	Reencrypt	Enabled or Disabled	Depending on the desired level of security, select Enable or Disable.*
	Cipher Set	BestPractices
	Certificates		Click Set Certificates.
	Require SNI hostname	Disabled
	Support TLS Only	Enabled
	Client Certificates	No Client Certificates required
Real Servers	Real Server Check Method	HTTP Protocol
	Checked Port	Enter the correct checked port for your environment.	Click Set Check Port.
	HTTP Method	HEAD

 

 

*To assign the EBS certificate previously imported, select it and click the > button.

More information about managing LoadMaster certificates can be found in SSL Accelerated Services, Feature Description document on the Kemp website.

Expand the section and set the following options:

8. To add Real Servers:

a) Click the Add New button.

b) Enter the Real Server Address.

c) Enter the correct Port.

d) Click Add this Real Server.

e) If required, add more Real Servers by repeating steps b) to d).

6 Configure the Virtual Service for Oracle EBS without SSL Acceleration

In some deployments of Oracle E-Business Suite there may be no requirement for encryption.  To configure a Virtual Service without SSL Acceleration for Oracle E-Business Suite, perform the following steps:

1. In the LoadMaster WUI main menu, go to Virtual Services > Add New.

2. Enter a Virtual Address.

3. Enter 80 in the Port text box.

The port may differ depending on Oracle environment.

4. Enter a recognisable Service Name, for example Oracle EBS.

5. Ensure the Protocol is set to tcp.

6. Click Add This Virtual Service.

7. Configure the settings as shown in the following table:

Section	Option	Value	Comments
Basic Properties	Service Type	HTTP/HTTPS
Standard Options	Transparency	Disabled
	Persistence Mode	Active Cookie
	Persistence Timeout	12 Hours	The Persistence and Scheduling may differ depending on requirements.
	Idle Connection Timeout	1800	Click Set Idle Timeout.
Real Servers	Real Server Check Method	HTTP Protocol
	Checked Port	Enter the correct checked port for your environment.	Click Set Check Port.
	HTTP Method	HEAD	The HTTPS Protocol may be used if re-encryption is used to the Real Servers.

 

 

 

8. To add Real Servers:

a) Click the Add New button.

b) Enter the Real Server Address.

c) Enter the correct Port.

d) Click Add this Real Server.

e) If required, add more Real Servers by repeating steps b) to d).

7 Additional Features

Additional Kemp LoadMaster security and optimization features can be enabled for the deployment of Oracle E-Business Suite. The deployment and configuration settings of these features can be found in the documents listed in the References section of this document. These documents can be found on the Kemp documentation web page: http://kemptechnologies.com/documentation/

Edge Security Pack (ESP) - A solution which provides edge security, SSO application integration and flexible authentication options is critical for optimal user experience and information security policy compliance.

Web Application Firewall (WAF) - Enables the secure deployment of web applications and prevention of Layer 7 attacks while maintaining core load balancing services, thus ensuring superior application delivery and security.

Content Caching - The LoadMaster can cache static content which fits certain criteria (file extension, query string, caching headers, size, and so on.). As long as the file meets these criteria it can be stored locally in the LoadMaster to avoid unnecessary requests to the Real Server to retrieve the file.

Intrusion Detection - The LoadMaster's implementation of Intrusion Detection leverages Snort.

Snort is an open source network intrusion prevention and detection system (IDS/IPS). Snort rules can be imported to the LoadMaster and applied to HTTP/HTTPS connections.

References

Unless otherwise specified, the following documents can be found at http://www.kemptechnologies.com/documentation.

Kemp website

www.kemptechnologies.com

SSL Accelerated Services, Feature Description

Web User Interface (WUI), Configuration Guide

Web Application Firewall (WAF), Feature Description

Virtual Services and Templates, Feature Description

Last Updated Date

This document was last updated on 21 June 2022.