OPS-17: Utilizing Firewalls - In the Reign of Fire Sasha Kraljevic Principal TS Engineer

Agenda Firewalls Intro What will be covered (and what not) Short history Firewall types What will be covered (and what not) OpenEdge® Environment Database connectivity AppServer™ WebSpeed® Adapters DataServers OPS-17: Utilizing Firewalls - In the Reign of Fire

Firewalls Intro A firewall is the first line of defense for basic network security. It separates the untrusted network (the Internet) and the trusted network (the Intranet). There is usually a third network called the DMZ or Demilitarized zone. This network is separate from both the others, but it can communicate with both. Usually it employs NAT (network address translation) and/or port mapping "Responsible" for vast majority of calls logged with the technical support OPS-17: Utilizing Firewalls - In the Reign of Fire

Firewalls Intro DMZ Intranet Firewall Device Internet OPS-17: Utilizing Firewalls - In the Reign of Fire

Firewalls Intro DMZ Intranet Firewall Device #1 Firewall Device #2 Internet DMZ Firewall Device #2 Intranet OPS-17: Utilizing Firewalls - In the Reign of Fire

Firewalls Intro Short history… A firewall is a system or group of systems that enforces an access control policy between two networks. Late 80’s – 1st Gen. – packet filters 2nd Gen – stateful filters Early 90’s – 3rd Gen – application layer Next Gen – convergence of Firewalls and IPS OPS-17: Utilizing Firewalls - In the Reign of Fire

Firewalls Intro Network layer firewalls Application layer firewalls Firewall types… Network layer firewalls Application layer firewalls Hybrid firewalls OPS-17: Utilizing Firewalls - In the Reign of Fire

Agenda Firewalls Intro What will be covered (and what not) Short history Firewall types What will be covered (and what not) OpenEdge Environment Database connectivity AppServer WebSpeed Adapters DataServers OPS-17: Utilizing Firewalls - In the Reign of Fire

What will be covered (and what not) We will talk about: Network layer firewalls OpenEdge products …but not about: Application layer firewalls NAT, proxies, VPN, IDS & IPS Non-OpenEdge products OPS-17: Utilizing Firewalls - In the Reign of Fire

Agenda Firewalls Intro What will be covered (and what not) Short history Firewall types What will be covered (and what not) OpenEdge Environment Database connectivity AppServer WebSpeed Adapters DataServers OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment Database connectivity Shared memory Database Broker Remote Server 1 Remote Server 2 Remote Server n Shared memory OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment Database connectivity Shared memory Connect rq > Database Broker < Remote Srv port Remote Server 1 Remote Server 2 Remote Server n Shared memory OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment Database connectivity Shared memory Database Broker Remote Server 1 Remote Server 2 Remote Server n Shared memory OPS-17: Utilizing Firewalls - In the Reign of Fire

Don’t forget –PendConnTime ! OpenEdge Environment Database connectivity and firewall configuration DB Broker Open all TCP ports from ABL/ODBC/JDBC client to the DB broker port (-S) Open all TCP ports from ABL/ODBC/JDBC client to the remote servers port range DB Remote Servers port range is defined with -minport & -maxport parameters Remote Srv Don’t forget –PendConnTime ! OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment AppServer And the Server was without the form and void… Admin said “Let there be light” and there was AdminServer. And it started the NameServer… NameServer/5162 AdminServer and NameServer are started. User/Admin starts the AppServer broker: # asbman –i asbroker1 –start UDP mess. uuid asbroker1 hostname 3090 Broker keeps sending UDP KeepAlive messages to the NameServer until it is shutdown. AppServer Broker AppServer Server(s) (Agents) AdminServer sets the broker’s environment and then it starts the Java™ process which takes the properties from ubroker.properties file. Servers (_proapsv) start using db connection and other startup parameters passed by broker. Broker opens its listening port and starts predetermined number of servers. And the Database Server was started… When all servers are started, broker sends the udp message to the controlling NameServer to register with it. OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment Overview – AppServer round trip UDP to 5162 : asbroker1 ? NameServer/5162 UDP from 5162 : asbroker1, host, port NameServer checks for the broker registered with AppService name asbroker1 and sends the message back to the client (udp) with the broker’s registered host name (or ip address) and the port where it listens End user initiates the connection from the 4GL: AppServer://host:5162/asbroker1 AS Broker AS Agent OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment Overview – Stateless AppServer round trip RUN… NameServer/5162 RUN… Client connects to the AppServer broker using TCP/IP, the hostname and the port number provided by the NameServer … and then it executes the RUN … ON statement RUN… AS Broker AS Agent Broker checks its pool of available agents and allocates one of them, passing the RUN request. _proapsv gets the request and it starts executing it…. OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment Overview – Stateless AppServer round trip NameServer/5162 Client accepts the OUTPUT params (if any) and continues on with processing – now calling another RUN, or disconnecting from AppServer. After the procedure is executed, agent returns the output parameters (if any), and signals to broker that it has finished. AS Broker AS Agent OUTPUT…END OUTPUT…END Broker returns the OUTPUT params (if any) and signals the end of the RUN request to the 4GL client. _proapsv gets the request and it starts executing it…. OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment Overview – State-reset & State-aware AS round trip NameServer/5162 Client connects to the AppServer broker using TCP/IP, the hostname and the port number provided by the NameServer AS Broker AS Agent Broker checks its pool of available agents and returns the port number of one of them back to the client. OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment Overview – State-reset & State-aware AS round trip NameServer/5162 RUN..ON AS Broker AS Agent Client disconnects from the AppServer broker and connects to the agent Client executes the RUN … ON statement _proapsv gets the request and it starts executing it…. OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment Overview – State-reset & State-aware AS round trip NameServer/5162 4GL client accepts the OUTPUT param’s (if any) and it is now ready to make a new RUN, or to disconnect the AppServer. OUTPUT..END I’m available again! AS Broker AS Agent Note that 4GL client sends the AppServer DISCONNECT to the agent which then signals to broker that it is ready to accept another client connection. After it is finished, agent returns the params (if any) and signals the end to the client OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment AppServer and Firewall Configuration NameServer Open all UDP ports from client to the NameServer’s UDP port (5162) NameServer Open UDP from NameServer port (5162) to all UDP ports to the client S t a t e l e s s AS Broker Open all TCP ports from client to the AppServer Broker listening port (3090) S S t t a a t t e & e r a e w s a e r t e Open all TCP ports from client to the AppServer’s servers port range (2002:2202) AppServer’s servers port range is defined with srvrMinPort & srvrMaxPort properties AS Agents OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment WebSpeed Web server End user initiates the request from the web browser: http://host/scripts/cgiip.exe/WService=wsbroker1/order.w NameServer WS Broker WS Agent OPS-17: Utilizing Firewalls - In the Reign of Fire

/WService=wsbroker1/order.w OpenEdge Environment WebSpeed Web server scripts/cgiip.exe /WService=wsbroker1/order.w NameServer WS Broker WS Agent OPS-17: Utilizing Firewalls - In the Reign of Fire

/WService=wsbroker1/order.w OpenEdge Environment WebSpeed Web server Messenger reads ubroker.properties and using controlingNameServer locates the host and port where it sends the udp message to the NS. It can use minNSclientPort and maxNSclientPort to specify the udp port range for getting back the reponse from NS – used for firewall. /WService=wsbroker1/order.w Messenger NameServer WS Broker WS Agent OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment WebSpeed Web server wsbroker1 ? Messenger NameServer WS Broker WS Agent NameServer checks for the broker registered with AppService name wsbroker1 and sends the message back to the Messenger (udp) with the broker’s registered host name (or ip address) and the port where it listens OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment WebSpeed Web server Messenger NameServer WS Broker WS Agent Messenger connects to the broker… which then checks its pool of available agents and sends the message (tcp) back to the messenger with the port number of chosen available agent to process the request OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment WebSpeed Web server Messeger connects (tcp) to the WS agent and it passes the name of the web object to execute along with the list of parameters (if any): /order.w?custnum=1 Messenger NameServer WS Broker WS Agent OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment WebSpeed Web server Messenger WS agent executes the web object and… NameServer WS Broker WS Agent OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment WebSpeed Web server …it returns the HTML in the web output stream… Messenger NameServer WS Broker WS Agent OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment WebSpeed Web server …that is returned to the end user’s browser. Messenger NameServer WS Broker WS Agent OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment WebSpeed Internet Web Server Internet NameServer Internet WebSpeed Server Internet Database Internet Production Server Internet / Untrusted Zone Demilitarized Zone (DMZ) Intranet / Trusted Zone Intranet NameServer Intranet WebSpeed Server Intranet Database Intranet Web Server Intranet Production Server Users Dev/Test NameServer Dev/Test WebSpeed Server Dev/Test Database Dev/Test Web Server Development Test Server Developers & Testers OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment WebSpeed Internet Web Server Internet NameServer Internet Production Server Internet NameServer Internet Database Internet WebSpeed Server Internet / Untrusted Zone Demilitarized Zone (DMZ) Intranet / Trusted Zone Intranet Database Intranet WebSpeed Server Intranet Server Intranet NameServer Development Test Server Intranet Web Server Dev/Test WebSpeed Server Dev/Test Database Developers & Testers Users OPS-17: Utilizing Firewalls - In the Reign of Fire

Open all UDP ports from WS Msngr to the NameServer’s UDP port (5162) OpenEdge Environment WebSpeed NameServer Open all UDP ports from WS Msngr to the NameServer’s UDP port (5162) NameServer Open UDP from NameServer port (5162) to minNSclientPort : maxNSclientPort Msngr WS Broker Open all TCP ports from WS Msngr to the WebSpeed Broker listening port (3090) Open all TCP ports from WS Msngr to the WebSpeed’s servers port range (2002:2202) WebSpeed’s servers port range is defined with srvrMinPort & srvrMaxPort properties WS Agents OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment OpenEdge Adapters - AIA AIA ABL/OpenClient proxy AIA HTTP Client creates the message for the AppServer… Wraps it up in the HTTP packet… OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment OpenEdge Adapters - AIA AIA ABL/OpenClient proxy AIA HTTP Client creates the message for the AppServer… AIA receives the HTTP packet… Wraps it up in the HTTP packet… And sends it to the AIA… OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment OpenEdge Adapters - AIA AIA ABL/OpenClient proxy AIA HTTP Client creates the message for the AppServer… AIA receives the HTTP packet… Unwraps and extracts the message… Wraps it up in the HTTP packet… And sends it to the AIA… OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment OpenEdge Adapters - AIA AIA ABL/OpenClient proxy AIA HTTP Client creates the message for the AppServer… AIA receives the HTTP packet… Unwraps and extracts the message… Wraps it up in the HTTP packet… And it sends it to the AppServer. And sends it to the AIA… OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment OpenEdge Adapters - AIA ABL/OpenClient proxy JSE/AIA AppServer Open TCP port(s) to JSE listener 80 or 8080 and/or 443 Open all ports following client-to-AppServer rules AIA to NameServer : minNSClientPort - maxNSClientPort OPS-17: Utilizing Firewalls - In the Reign of Fire

OpenEdge Environment OpenEdge Adapters - WSA WebService client JSE/WSA AppServer Open TCP port(s) to JSE listener 80 or 8080 and/or 443 Open all ports following client-to-AppServer rules WSA to NameServer : nsMinClientPort - nsMaxClientPort OPS-17: Utilizing Firewalls - In the Reign of Fire

NB: DataServer servers cannot specify port range! OpenEdge Environment OpenEdge DataServers Configuration - schema holder location - foreign db location - connecting through DataServer broker (standard/unified) Foreign database connection configuration NB: DataServer servers cannot specify port range! OPS-17: Utilizing Firewalls - In the Reign of Fire

In Summary Firewalls are not panacea! Understand the roundtrip! Double-check the rules! OPS-17: Utilizing Firewalls - In the Reign of Fire

For More Information, go to… PSDN http://www.psdn.com/library/entry.jspa?externalID=1433 http://www.psdn.com/library/entry.jspa?externalID=163 Documentation: Core Business Services Application and Integration Services OPS-17: Utilizing Firewalls - In the Reign of Fire

Relevant Exchange Sessions OPS-19: What is IPv6 and Why Should I Care? OPS-17: Utilizing Firewalls - In the Reign of Fire

? Questions OPS-17: Utilizing Firewalls - In the Reign of Fire

Thank You OPS-17: Utilizing Firewalls - In the Reign of Fire

OPS-17: Utilizing Firewalls - In the Reign of Fire