1. OPS-17: Utilizing Firewalls - In the Reign of Fire
Sasha Kraljevic
Principal TS Engineer

2. Agenda Firewalls Intro What will be covered (and what not)
Short history
Firewall types
What will be covered (and what not)
OpenEdge® Environment
Database connectivity
AppServer™
WebSpeed®
Adapters
DataServers
OPS-17: Utilizing Firewalls - In the Reign of Fire

3. Firewalls Intro
A firewall is the first line of defense for basic network security.
It separates the untrusted network (the Internet) and the trusted network (the Intranet).
There is usually a third network called the DMZ or Demilitarized zone. This network is separate from both the others, but it can communicate with both.
Usually it employs NAT (network address translation) and/or port mapping
"Responsible" for vast majority of calls logged with the technical support
OPS-17: Utilizing Firewalls - In the Reign of Fire

4. Firewalls Intro DMZ Intranet Firewall Device Internet
OPS-17: Utilizing Firewalls - In the Reign of Fire

5. Firewalls Intro DMZ Intranet Firewall Device #1 Firewall Device #2
Internet
DMZ
Firewall Device #2
Intranet
OPS-17: Utilizing Firewalls - In the Reign of Fire

6. Firewalls Intro
Short history…
A firewall is a system or group of systems that enforces an access control policy between two networks.
Late 80’s – 1st Gen. – packet filters
2nd Gen – stateful filters
Early 90’s – 3rd Gen – application layer
Next Gen – convergence of Firewalls and IPS
OPS-17: Utilizing Firewalls - In the Reign of Fire

7. Firewalls Intro Network layer firewalls Application layer firewalls
Firewall types…
Network layer firewalls
Application layer firewalls
Hybrid firewalls
OPS-17: Utilizing Firewalls - In the Reign of Fire

8. Agenda Firewalls Intro What will be covered (and what not)
Short history
Firewall types
What will be covered (and what not)
OpenEdge Environment
Database connectivity
AppServer
WebSpeed
Adapters
DataServers
OPS-17: Utilizing Firewalls - In the Reign of Fire

9. What will be covered (and what not)
We will talk about:
Network layer firewalls
OpenEdge products
…but not about:
Application layer firewalls
NAT, proxies, VPN, IDS & IPS
Non-OpenEdge products
OPS-17: Utilizing Firewalls - In the Reign of Fire

10. Agenda Firewalls Intro What will be covered (and what not)
Short history
Firewall types
What will be covered (and what not)
OpenEdge Environment
Database connectivity
AppServer
WebSpeed
Adapters
DataServers
OPS-17: Utilizing Firewalls - In the Reign of Fire

11. OpenEdge Environment Database connectivity Shared memory
Database Broker
Remote Server 1
Remote Server 2
Remote Server n
Shared memory
OPS-17: Utilizing Firewalls - In the Reign of Fire

12. OpenEdge Environment Database connectivity Shared memory
Connect rq >
Database Broker
< Remote Srv port
Remote Server 1
Remote Server 2
Remote Server n
Shared memory
OPS-17: Utilizing Firewalls - In the Reign of Fire

13. OpenEdge Environment Database connectivity Shared memory
Database Broker
Remote Server 1
Remote Server 2
Remote Server n
Shared memory
OPS-17: Utilizing Firewalls - In the Reign of Fire

14. Don’t forget –PendConnTime !
OpenEdge Environment
Database connectivity and firewall configuration
DB Broker
Open all TCP ports from ABL/ODBC/JDBC client to the DB broker port (-S)
Open all TCP ports from ABL/ODBC/JDBC client to the remote servers port range
DB Remote Servers port range is defined with -minport & -maxport parameters
Remote Srv
Don’t forget –PendConnTime !
OPS-17: Utilizing Firewalls - In the Reign of Fire

15. OpenEdge Environment AppServer
And the Server was without the form and void… Admin said “Let there be light” and there was AdminServer. And it started the NameServer…
NameServer/5162
AdminServer and NameServer are started. User/Admin starts the AppServer broker: # asbman –i asbroker1 –start
UDP mess. uuid asbroker1 hostname 3090
Broker keeps sending UDP KeepAlive messages to the NameServer until it is shutdown.
AppServer Broker
AppServer Server(s) (Agents)
AdminServer sets the broker’s environment and then it starts the Java™ process which takes the properties from ubroker.properties file.
Servers (_proapsv) start using db connection and other startup parameters passed by broker.
Broker opens its listening port and starts predetermined number of servers.
And the Database Server was started…
When all servers are started, broker sends the udp message to the controlling NameServer to register with it.
OPS-17: Utilizing Firewalls - In the Reign of Fire

16. OpenEdge Environment Overview – AppServer round trip
UDP to 5162 : asbroker1 ?
NameServer/5162
UDP from 5162 : asbroker1, host, port
NameServer checks for the broker registered with AppService name asbroker1 and sends the message back to the client (udp) with the broker’s registered host name (or ip address) and the port where it listens
End user initiates the connection from the 4GL: AppServer://host:5162/asbroker1
AS Broker
AS Agent
OPS-17: Utilizing Firewalls - In the Reign of Fire

17. OpenEdge Environment Overview – Stateless AppServer round trip RUN…
NameServer/5162
RUN…
Client connects to the AppServer broker using TCP/IP, the hostname and the port number provided by the NameServer
… and then it executes the RUN … ON statement
RUN…
AS Broker
AS Agent
Broker checks its pool of available agents and allocates one of them, passing the RUN request.
_proapsv gets the request and it
starts executing it….
OPS-17: Utilizing Firewalls - In the Reign of Fire

18. OpenEdge Environment Overview – Stateless AppServer round trip
NameServer/5162
Client accepts the OUTPUT params (if any) and continues on with processing – now calling another RUN, or disconnecting from AppServer.
After the procedure is executed, agent returns the output parameters (if any), and signals to broker that it has finished.
AS Broker
AS Agent
OUTPUT…END
OUTPUT…END
Broker returns the OUTPUT params (if any) and signals the end of the RUN request to the 4GL client.
_proapsv gets the request and it
starts executing it….
OPS-17: Utilizing Firewalls - In the Reign of Fire

19. OpenEdge Environment
Overview – State-reset & State-aware AS round trip
NameServer/5162
Client connects to the AppServer broker using TCP/IP, the hostname and the port number provided by the NameServer
AS Broker
AS Agent
Broker checks its pool of available agents and returns the port number of one of them back to the client.
OPS-17: Utilizing Firewalls - In the Reign of Fire

20. OpenEdge Environment
Overview – State-reset & State-aware AS round trip
NameServer/5162
RUN..ON
AS Broker
AS Agent
Client disconnects from the AppServer broker and connects to the agent
Client executes the RUN … ON statement
_proapsv gets the request and it
starts executing it….
OPS-17: Utilizing Firewalls - In the Reign of Fire

21. OpenEdge Environment
Overview – State-reset & State-aware AS round trip
NameServer/5162
4GL client accepts the OUTPUT param’s (if any) and it is now ready to make a new RUN, or to disconnect the AppServer.
OUTPUT..END
I’m available again!
AS Broker
AS Agent
Note that 4GL client sends the AppServer DISCONNECT to the agent which then signals to broker that it is ready to accept another client connection.
After it is finished, agent returns the params (if any) and signals the end to the client
OPS-17: Utilizing Firewalls - In the Reign of Fire

22. OpenEdge Environment AppServer and Firewall Configuration
NameServer
Open all UDP ports from client to the NameServer’s UDP port (5162)
NameServer
Open UDP from NameServer port (5162) to all UDP ports to the client
S t a t e l e s s
AS Broker
Open all TCP ports from client to the AppServer Broker listening port (3090)
S S t t a a t t e & e r a e w s a e r t e
Open all TCP ports from client to the AppServer’s servers port range (2002:2202)
AppServer’s servers port range is defined with srvrMinPort & srvrMaxPort properties
AS Agents
OPS-17: Utilizing Firewalls - In the Reign of Fire

23. OpenEdge Environment WebSpeed Web server
End user initiates the request from the web browser:
NameServer
WS Broker
WS Agent
OPS-17: Utilizing Firewalls - In the Reign of Fire

24. /WService=wsbroker1/order.w
OpenEdge Environment
WebSpeed
Web server
scripts/cgiip.exe
/WService=wsbroker1/order.w
NameServer
WS Broker
WS Agent
OPS-17: Utilizing Firewalls - In the Reign of Fire

25. /WService=wsbroker1/order.w
OpenEdge Environment
WebSpeed
Web server
Messenger reads ubroker.properties and using controlingNameServer locates the host and port where it sends the udp message to the NS. It can use minNSclientPort and maxNSclientPort to specify the udp port range for getting back the reponse from NS – used for firewall.
/WService=wsbroker1/order.w
Messenger
NameServer
WS Broker
WS Agent
OPS-17: Utilizing Firewalls - In the Reign of Fire

26. OpenEdge Environment WebSpeed Web server wsbroker1 ? Messenger
NameServer
WS Broker
WS Agent
NameServer checks for the broker registered with AppService name wsbroker1 and sends the message back to the Messenger (udp) with the broker’s registered host name (or ip address) and the port where it listens
OPS-17: Utilizing Firewalls - In the Reign of Fire

27. OpenEdge Environment WebSpeed Web server Messenger NameServer
WS Broker
WS Agent
Messenger connects to the broker… which then checks its pool of available agents and sends the message (tcp) back to the messenger with the port number of chosen available agent to process the request
OPS-17: Utilizing Firewalls - In the Reign of Fire

28. OpenEdge Environment WebSpeed Web server
Messeger connects (tcp) to the WS agent and it passes the name of the web object to execute along with the list of parameters (if any): /order.w?custnum=1
Messenger
NameServer
WS Broker
WS Agent
OPS-17: Utilizing Firewalls - In the Reign of Fire

29. OpenEdge Environment WebSpeed Web server Messenger
WS agent executes the web object and…
NameServer
WS Broker
WS Agent
OPS-17: Utilizing Firewalls - In the Reign of Fire

30. OpenEdge Environment WebSpeed Web server
…it returns the HTML in the web output stream…
Messenger
NameServer
WS Broker
WS Agent
OPS-17: Utilizing Firewalls - In the Reign of Fire

31. OpenEdge Environment WebSpeed Web server
…that is returned to the end user’s browser.
Messenger
NameServer
WS Broker
WS Agent
OPS-17: Utilizing Firewalls - In the Reign of Fire

32. OpenEdge Environment WebSpeed Internet Web Server Internet NameServer
Internet WebSpeed Server
Internet Database
Internet Production Server
Internet / Untrusted Zone
Demilitarized Zone (DMZ)
Intranet / Trusted Zone
Intranet NameServer
Intranet WebSpeed Server
Intranet Database
Intranet Web Server
Intranet Production Server
Users
Dev/Test NameServer
Dev/Test WebSpeed Server
Dev/Test Database
Dev/Test Web Server
Development Test Server
Developers & Testers
OPS-17: Utilizing Firewalls - In the Reign of Fire

33. OpenEdge Environment WebSpeed Internet Web Server Internet NameServer
Internet Production Server
Internet NameServer
Internet Database
Internet WebSpeed Server
Internet / Untrusted Zone
Demilitarized Zone (DMZ)
Intranet / Trusted Zone
Intranet Database
Intranet WebSpeed Server
Intranet Server
Intranet NameServer
Development Test Server
Intranet Web Server
Dev/Test WebSpeed Server
Dev/Test Database
Developers & Testers
Users
OPS-17: Utilizing Firewalls - In the Reign of Fire

34. Open all UDP ports from WS Msngr to the NameServer’s UDP port (5162)
OpenEdge Environment
WebSpeed
NameServer
Open all UDP ports from WS Msngr to the NameServer’s UDP port (5162)
NameServer
Open UDP from NameServer port (5162) to minNSclientPort : maxNSclientPort Msngr
WS Broker
Open all TCP ports from WS Msngr to the WebSpeed Broker listening port (3090)
Open all TCP ports from WS Msngr to the WebSpeed’s servers port range (2002:2202)
WebSpeed’s servers port range is defined with srvrMinPort & srvrMaxPort properties
WS Agents
OPS-17: Utilizing Firewalls - In the Reign of Fire

35. OpenEdge Environment OpenEdge Adapters - AIA AIA
ABL/OpenClient proxy
AIA
HTTP
Client creates the message for the AppServer…
Wraps it up in the HTTP packet…
OPS-17: Utilizing Firewalls - In the Reign of Fire

36. OpenEdge Environment OpenEdge Adapters - AIA AIA
ABL/OpenClient proxy
AIA
HTTP
Client creates the message for the AppServer…
AIA receives the HTTP packet…
Wraps it up in the HTTP packet…
And sends it to the AIA…
OPS-17: Utilizing Firewalls - In the Reign of Fire

37. OpenEdge Environment OpenEdge Adapters - AIA AIA
ABL/OpenClient proxy
AIA
HTTP
Client creates the message for the AppServer…
AIA receives the HTTP packet…
Unwraps and extracts the message…
Wraps it up in the HTTP packet…
And sends it to the AIA…
OPS-17: Utilizing Firewalls - In the Reign of Fire

38. OpenEdge Environment OpenEdge Adapters - AIA AIA
ABL/OpenClient proxy
AIA
HTTP
Client creates the message for the AppServer…
AIA receives the HTTP packet…
Unwraps and extracts the message…
Wraps it up in the HTTP packet…
And it sends it to the AppServer.
And sends it to the AIA…
OPS-17: Utilizing Firewalls - In the Reign of Fire

39. OpenEdge Environment OpenEdge Adapters - AIA
ABL/OpenClient proxy
JSE/AIA
AppServer
Open TCP port(s) to JSE listener 80 or 8080 and/or 443
Open all ports following client-to-AppServer rules
AIA to NameServer : minNSClientPort - maxNSClientPort
OPS-17: Utilizing Firewalls - In the Reign of Fire

40. OpenEdge Environment OpenEdge Adapters - WSA
WebService client
JSE/WSA
AppServer
Open TCP port(s) to JSE listener 80 or 8080 and/or 443
Open all ports following client-to-AppServer rules
WSA to NameServer : nsMinClientPort - nsMaxClientPort
OPS-17: Utilizing Firewalls - In the Reign of Fire

41. NB: DataServer servers cannot specify port range!
OpenEdge Environment
OpenEdge DataServers
Configuration - schema holder location - foreign db location - connecting through DataServer broker (standard/unified)
Foreign database connection configuration
NB: DataServer servers cannot specify port range!
OPS-17: Utilizing Firewalls - In the Reign of Fire

42. In Summary Firewalls are not panacea! Understand the roundtrip!
Double-check the rules!
OPS-17: Utilizing Firewalls - In the Reign of Fire

43. For More Information, go to…
PSDN
Documentation:
Core Business Services
Application and Integration Services
OPS-17: Utilizing Firewalls - In the Reign of Fire

44. Relevant Exchange Sessions
OPS-19: What is IPv6 and Why Should I Care?
OPS-17: Utilizing Firewalls - In the Reign of Fire

45. ?
Questions
OPS-17: Utilizing Firewalls - In the Reign of Fire

46. Thank You
OPS-17: Utilizing Firewalls - In the Reign of Fire

47. OPS-17: Utilizing Firewalls - In the Reign of Fire