Radware s AppDirector and Oracle E-Business Suite 12.1 Integration Guide

Transcription

1 Radware s AppDirector and Oracle E-Business Suite 12.1 Integration Guide Products: Radware AppDirector Software: AppDirector version DL Platform: On-Demand Switch II XL E-Business Suite version

2 Table of Contents JOINT SOLUTION OVERVIEW...3 E-BUSINESS SUITE OVERVIEW...3 Definitions as they apply to E-Business Suite...3 General Architecture of Oracle E-Business Suite Release Diagram EBS General Architecture...5 RADWARE APPDIRECTOR OVERVIEW...6 DEPLOYMENT NOTES...6 E-Business Suite Modifications...6 Table E-Business Suite Modifications...7 AppDirector Modifications...8 APPDIRECTOR AND E-BUSINESS SUITE ARCHITECTURE...8 Diagram E-Business Suite 12 and AppDirector Logical Topology...9 Tests Conducted for Solution Validation and Result Summary...9 Table Test Conducted for Solution Validation...10 APPDIRECTOR CONFIGURATION FOR E-BUSINESS SUITE Table 3.0 Lab configuration...11 Diagram E-Business Suite 12.1 and AppDirector Physical Topology...12 PRIMARY APPDIRECTOR CONFIGURATION...12 IP Configuration...13 Farm Configuration...15 Caching...16 Create Cache URL Exceptions Rule-Lists...17 Create Cache Policy...17 Create Compression Policy...18 Create SSL Certificate...19 Create SSL Policy...20 Create Layer 4 Policy...21 Configure L7 Persistency for the web farm...22 Adding Servers to the Farm...23 Health Monitoring...25 Create the Health Monitoring Checks...26 Binding Health Checks to Servers...28 GENERAL REDUNDANT CONFIGURATION NOTES...29 Primary AppDirector VRRP Configuration...29 Primary Virtual Routers...30 Primary Associated IP Addresses...31 Primary Mirroring...33 AUTO-GENERATE THE BACKUP APPDIRECTOR CONFIGURATION...34 Setting up basic IP connectivity on the Backup AppDirector...34 Auto Generating the Backup Configuration from the Primary AppDirector...35 Upload the Backup Configuration file to the Backup AppDirector...37 Appendix 1 - Primary AppDirector Configuration File...38 Appendix 2 - Backup AppDirector Configuration File...41 Appendix 3 - Oracle Application Server Web Cache - Caching Rules...44 Appendix 4 Certificates and Keys...46 Appendix 5 HTTP redirect to HTTPS...47 Appendix 6 AutoConfig Context Editor...51 Appendix 7 Test Plan

3 Joint Solution Overview The Radware and E-Business Suite joint solution ensures E-Business Suite 12.1 customer s solution resilience, efficiency and scale. Radware s AppDirector guarantees E-Business Suite applications maximum availability, scalability, performance and security, managing traffic for the web server content. AppDirector works in conjunction with E-Business Suite 12.1 servers to offload resource intensive processing, providing advanced health monitoring and avoiding system down time to deliver a best of breed subsystem. With a pay as you grow platform licensing model, AppDirector ensures long term investment protection facilitating incremental growth demanded by today s Business. Diagram 2.0 is a logical depiction of the intended deployment model. E-Business Suite Overview See Reference Doc ID: Definitions as they apply to E-Business Suite Tier A tier is a logical grouping of services, potentially spread across more than one physical machine. Client Tier The client interface is provided through HTML for the HTML-based applications, and via a Java applet in a Web browser for the traditional Forms-based interface. In Oracle Applications Release 12, each user logs in to Oracle Applications through the E-Business Suite Home Page on a desktop client web browser. The E-Business Suite Home Page provides a single point of access to HTML-based applications, Forms-based applications, and Business Intelligence applications. Application Tier The application tier hosts the various services that process the business logic and manage communication between the desktop tier and the database tier. This tier runs the web server and the associated processes, concurrent processing server, Interaction and Oracle fulfillment server. Database Tier The database tier contains the Oracle database server which stores all the data maintained by Oracle Applications. This tier has the Oracle data server files and Oracle Applications database executables that physically store the tables, indexes, and other database objects in the system. OPMN Oracle Process Manager and Notification Server (OPMN) is installed and configured on every tier designated to run the web application. OPMN provides an - 3 -

4 integrated way to manage all Oracle Application Server components. OPMN consists of two main pieces: the Process Manager and the Notification Server. The Process manager (PM) is the centralized process management mechanism in Oracle Application Server and is used to manage all Oracle Application Server processes. The PM starts, restarts, stops, and monitors every process it manages. It also performs death-detection and automatic restart of the processes. Oracle Notification Server (ONS) is the transport mechanism for failure, recovery, startup, and other related notifications between components in Oracle Application Server. OHS Oracle HTTP Server (OHS) is installed and configured on every tier that is designated to run the web application. It provides the key infrastructure required for serving the static and dynamic content generated by Oracle E Business Suite products. OC4J Oracle Containers for J2EE (OC4J) is the core Java 2 Platform Enterprise Edition (J2EE) runtime component of Oracle Application Server. It is installed and configured on every tier that is designated to run the web application. It is a fully J2EE 1.5 compliant container that runs on a standard file based JDK 1.5 Java Virtual Machine and provides complete support for Java Server Pages (JSP), Servlets, Enterprise Java Beans (EJB), Web Services and all J2EE services. Web Entry Point Web Entry Point refers to the host name which is designated to be used by all users to access the Oracle E-Business Suite Release 12 system. By default, the web entry point is set to the hostname of the application server where Oracle E-Business Suite is installed. In the case where a load-balancer is used, the Web Entry Point becomes the virtual host name resolved to the virtual IP of the load-balancer. Session Persistence Session Persistence is the act of keeping a specific user's traffic going to the same server that was initially hit when the site was contacted for the first HTTP transaction. This is especially important for E-Business Suite as various modules bundled with the suite need to maintain session state. Session persistence is sometimes referred to as "server stickiness." General Architecture of Oracle E-Business Suite Release 12 The Oracle E-Business Suite Release 12 architecture, as shown in the figure below, is a framework for multi-tiered, distributed computing that supports various Oracle Applications products. In this model, various servers are distributed among multiple levels, or tiers

5 Diagram EBS General Architecture A server is a process or group of processes that runs on a single machine and provides a particular class of functionality, often referred to as a service. For example, the Oracle HTTP server is a process that listens for and processes HTTP requests; a Concurrent Processing server is a server that process batch jobs submitted through concurrent requests. The three-tier architecture that comprises an Oracle E-Business Suite installation is made up of: 1. The database tier, which supports and manages the Oracle database 2. The application tier, which supports and manages the various Applications components, and is sometimes known as the middle tier 3. The client tier, which provides the user interface via a supported web browser, either natively in HTML or via Forms running in the Sun Java Runtime Engine For more information on Oracle E-Business Suite, see

6 Radware AppDirector Overview Radware s AppDirector is an intelligent application delivery controller (ADC) that provides scalability and application-level security for service infrastructure optimization, fault tolerance and redundancy. Radware combined its next-generation, OnDemand Switch multi-gigabit hardware platform with the powerful capabilities of the company s APSolute operating system classifier and flow management engine. The result AppDirector enables accelerated application performance; local and global server availability; and application security and infrastructure scalability for fast, reliable and secure delivery of applications over IP networks. AppDirector is powered by the innovative OnDemand Switch platform. OnDemand Switch, which has established a new price/performance standard in the industry, delivers breakthrough performance and superior scalability to meet evolving network and business requirements. Based on its on demand, pay-as-you-grow approach, no forklift upgrade is required even when new business requirements arise. This helps companies guarantee short-term and long-term savings on CAPEX and OPEX for full investment protection. Radware s OnDemand Switch enables customers to pay for the exact capacity currently required, while allowing them to scale their ADC throughput capacity and add advanced application-aware services or application acceleration services on demand to meet new or changing application and infrastructure needs. And it does it without compromising on performance. AppDirector lets you get the most out of your service investments by maximizing the utilization of service infrastructure resources and enabling seamless consolidation and high scalability. AppDirector s throughput licensing options allows pay as you grow investment protection. Make your network adaptive and more responsive to your dynamic services and business needs with AppDirector s fully integrated traffic classification and flow management, health monitoring and failure bypassing, traffic redirection, bandwidth management, intrusion prevention and DoS protection. For more information, please rwestit: Deployment Notes E-Business Suite Modifications In order for E-Business Suite to work with an AppDirector, there are several parameters that need to be defined. The Load Balancer Entry Point URL used to access the Applications logon page needs to be defined as a single entry point, the Application servers that are being load balanced need to be defined, the protocol, port and active web portal need to be defined on both Application Servers. The configuration file that needs to be modified is the Applications Context File. The servers Applications Context File is Located: - 6 -

7 $INST_TOP/appl/admin/ rwest_node2.xml Use the AutoConfig Context Editor to set the configuration values in the applications context file on server 1 and 2. The table below describes how the context value should be changed when a load balancer is configured in front of application servers. For example: Load Balancer Entry Point: AppDirector.estuate Application Server 1: node2.estuate Application Server 2: node3.estuate Web Entry protocol: https Application Tier Web Protocol: https Application Tier Web Port: 8001 Active Web Port:443 Context Variable Name s_webentryurlprotocol s_webentryhost s_webentrydomain s_active_webport s_login_page Context Variable Description Protocol that desktop clients use to communicate with the entry point server Name of the host that receives the first HTTP request from the desktop client Domain name of the host that receives the first HTTP request from the desktop client Port on the web server or load balancer that listens for HTTP requests URL used to access the Applications logon page Old Context Value http node2 on Application Server 1 kavery on Application Server 2 estuate New Context Value https for AppDirector.estuate AppDirector as the web entry host for node2 and node3 Estuate 8001 on node2 and node3 443 for AppDirector.estuate /OA_HTML/AppsLogin /OA_HTML/AppsLogin pslogin s_external_url URL that third party tools use to connect to the E-Business Suite System. This is used only by the Oracle Web Services product. /OA_HTML/AppsLogin /OA_HTML/AppsLogin pslogin Table E-Business Suite Modifications The values listed for the context variables in the table above should only be used as a reference to change your applications context file. It is possible that system administrators may have changed the default values to perform other advanced configurations. After completing the changes shown above, do the following: - 7 -

8 1. Run the AutoConfig utility on all the application tier Servers 2. Restart application server processes 3. Test sign on from different entry points. Please see Appendix 6 for details on how to configure the setting with AutoConfig Context Editor. AppDirector Modifications The AppDirector was configured for SSL offload to accelerate SSL traffic and offload servers. AppDirector handles the SSL key negotiation with the client and encrypting and decrypting of communication. AppDirector serves as a proxy, terminating the SSL client sessions and opening a separate session to the backend servers. SSL Offload is necessary to manipulate TLS components, L7 persistence would not work without SSL offload, as the data payload would be encrypted. Farm aging time was tuned to just over 30 Minutes (1860) from default value for testing. This was to ensure that state entries would not be terminated prior to client aging time. appdirector farm table setcreate "web server farm" -at cm \ "No Checks" -sm RemoveOnSessionEnd-SPS Reset of the sessions if still existing after the aging. This will ensure any clean-up of abandoned sessions which could hold state on the servers inadvertently. appdirector farm extended-params set "web server farm" -sc Enabled -ic \ "Enable and remove cookie on return path" AppDirector and E-Business Suite Architecture Key features implemented on the AppDirector to support this solution: Service health monitoring Layer 7 load balancing Caching Compression TCP Multiplexing SSL Offloading VRRP - 8 -

9 Diagram E-Business Suite 12 and AppDirector Logical Topology Tests Conducted for Solution Validation and Result Summary The following tests were conducted to ensure the most appropriate solution was defined and validated. All tests were successfully completed using the AppDirector and Oracle E-Business Suite 12.1 configurations following Table 2.0. See Appendix 7 for a full test plan description

10 EBS Basic Health Check Test Case EBS Web Login Page EBS Self-Service: Home Page EBS Application Manager Screen EBS Self-Service: Create a Purchase Requisition from iprocurement module EBS Self-Service: Query a purchase requisition EBS Forms Service: EBS Home Page EBS Forms Service: Create User EBS Forms Service: Query User record EBS Web Server Hardware Failure/Power down Status PASS PASS PASS PASS PASS PASS PASS PASS PASS PASS Load Distribution Test Case EBS Web Server Load Balance Status PASS Fail Over server Test Case EBS Web Server Failover Status PASS Persistency Check Test Case EBS Web Server Session Persistence Enabled EBS Web Server Session Persistence Disabled EBS Web Client Session Timeout Status PASS PASS PASS Acceleration Features Test Case EBS Web Server SSL Offloading EBS Web Server Caching EBS Web Server Compression Status PASS PASS PASS Table Test Conducted for Solution Validation

11 AppDirector Configuration for E-Business Suite 12.1 E-Business Suite Server Name Service Port Network IP Address EBS_web_71 web EBS_web_72 web VIP E-Business Suite virtual IP web Primary AppDirector Routing table and interface IP s interface subnet Network IP Address Gateway G Subnet G Subnet G Management Interface MNG G-11 Interface G G-1 Interface G Backup AppDirector Routing table and interface IP s interface subnet Network IP Address Gateway G Subnet G Subnet G Management Interface MNG G-11 Interface G G-1 Interface G Table 3.0 Lab configuration

12 Diagram E-Business Suite 12.1 and AppDirector Physical Topology Primary AppDirector Configuration Using a serial cable and a terminal emulation program, connect to the AppDirector. The default console port settings are: Bits per Second: Data Bits: 8 Parity: None Stop Bits: 1 Flow Control: None

13 1. Using the following Command line, assign management IP address / 24 to interface MNG-1 (Dedicated Management Interface) of the AppDirector: net ip-interface create MNG-1 -pa Using a browser, connect to the management IP Address of the AppDirector ( ) via HTTP or HTTPS. The default username and password are radware and radware. HTTPS is recommended as it is required for TLS/SSL configuration management which will be part of the configuration. Failure to establish a connection may be due to the following: Incorrect IP Address in the browser Incorrect IP Address or default route configuration in the AppDirector Failure to enable Web Based Management or Secure Web Based Management in the AppDirector If the AppDirector can be successfully pinged, attempt to connect to it via Telnet or SSH. If the pinging or the Telnet/SSH connection are unsuccessful, reconnect to the AppDirector via its console port. Once IP Configuration 1. From the menu, select Router IP Router Interface Parameters to display the IP Interface Parameters page similar to the one shown below:

14 2. Click the Create button. 3. On the IP Interface Parameters Create page, enter the necessary parameters as shown below: 1 4. Click the Set button to save parameters. 5. On the IP Interface Parameters page, click the Create button to configure another interface. Enter the necessary parameters as shown below: 1 Items circled in red indicate settings that need to be entered or changed. Items not circled should be left to default settings

15 6. Click the Set button to save parameters. 7. Verify that the new entries were created on the IP Interface Parameters page: Farm Configuration 1. From the menu, select AppDirector Farms Farm Table to display the Farm Table page similar to the one shown below:

16 2. Click the Create button. 3. On the Farm Table Create page, enter the necessary parameters as shown below: Note: The aging time is displayed in seconds and is set to 31 Minutes. The EBS time out is set for 30 Minutes. 4. Click the Set button to save parameters. 5. Verify that the new entry is created on the Farm Table page: Caching With caching there may be a need to create exceptions for certain URI s. We had a need to create an exception for our deployment. There is a Dashboard page used by EBS administrators to check the health and status of the EBS servers. On the page there are tabs that reference overview, performance, critical activities, diagnostics, business flows, security and software updates

17 The issue with caching this page is that the URI looks the same to the cache no matter what tab is selected and therefore the page view never changes, it s stuck on the cached page You can create an exception in the AppDirector or Install and configure Oracle Application Server Web Cache and create the exception rule their (see appendix 3 Oracle Application Server Web Cache - Caching Rules for more details) Create Cache URL Exceptions Rule-Lists 1. From the menu, select AppDirector Layer 4 Traffic Redirection Cache URL Exceptions Rule-Lists to display the Cache URL Exceptions Rule-Lists page similar to the one shown below: 2. Click the Create button. 3. On the Cache URL Exceptions Rule-Lists Create page, enter the necessary parameters as shown below. Where the URL is: /OA_HTML/weboam/oam/oamApps$target=rwest 4. Click the Set button to save the parameters. Create Cache Policy 1. From the menu, select AppDirector Layer 4 Traffic Redirection Caching Policies to display the Caching Policies page similar to the one shown below:

18 2. Click the Create button. 3. On the Caching Policies Create page, enter the necessary parameters as shown below. 4. Click the Set button to save the parameters. Create Compression Policy 1. From the menu, select AppDirector Layer 4 Traffic Redirection Compression Policies to display the Compression Policies page similar to the one shown below: 2. Click the Create button. 3. On the Compression Policies Create page, enter the necessary parameters as shown below

19 Note: Hardware compression is a hardware option that must be supported. 4. Click the Set button to save the parameters. Create SSL Certificate Note: This is a self signed certificate, in a production environment you would use a certificate signed from a CA (Certificate Authority) like VeriSign. See appendix 3 for an explanation of Certificates and how to generate a Certificate request. You must log into the AppDirector through a secure connection (HTTPS) in order to configure certificates. 1. From the menu, select Security Certificates Table to display the Certificates Table page similar to the one shown below: 2. Click the Create button. 3. On the Certificates Table Create page, enter the necessary parameters as shown below

20 4. There will be a popup when you click on the Key Passphrase field, asking you to enter in a Passphrase, as shown below. Note: The Key Passphrase encrypts the key in storage and is required to export the key from AppDirector. Since Private Keys are the most sensitive parts of PKI data they must be protected by passphrase. The Passphrase should be at least 4 characters and is recommended to use stronger passphrases than that based on letters, numbers and signs. 5. Click the Set button to save the Passphrase. 6. Click the Set button to save the Certificate parameters. Create SSL Policy 1. From the menu, select AppDirector Layer 4 Traffic Redirection SSL Policies to display the SSL Policies page similar to the one shown below:

21 2. Click the Create button. 3. On the SSL Policies Create page, enter the necessary parameters as shown below. 4. Click the Set button to save the parameters. Create Layer 4 Policy Note: Please see Appendix 5 for instructions to shows how to create a L7 Policy that redirects all HTTP traffic to same host name same URI over HTTPS. This L7 Policy is a safety net; it catches the traffic that incorrectly comes in on HTTP and redirects it to HTTPS From the menu, select AppDirector Layer 4 Traffic Redirection Layer 4 Policies to display the L4 Policies page similar to the one shown below: 2. Click the Create button. 3. On the L4 Policies Create page, enter the necessary parameters as shown below

22 4. Click the Set button to save the parameters. 5. Verify that the new entries were created on the L4 Policies page: Configure L7 Persistency for the web farm Persistence is handled at the web tier with cookie insertion and removal configured in Extended Farm Parameters as seen below. 1. From the menu, select AppDirector Farms Extended Parameters to display the Extended Farm Parameters page similar to the one shown

23 2. Select the web server farm under the Farm Name to display the Extended Farm Parameters Update page, enter the necessary parameters as shown below: 3. Click the Set button to save parameters. Note: Close Session At Aging: will reset sessions if still existing when their Aging Time expires. This will ensure any clean-up of abandoned sessions which could hold state on the servers inadvertently. Note: Configuring Cookie Insertion for Web Service HTTP Persistence in the Extended Farm Parameters Update page generates all of the L7 persistence logic automatically from the single drop down menu. See Appendix 4 to view and better understand the entries that auto generate to facilitate this function. Cookies are inserted on reply and removed on request. Adding Servers to the Farm 1. From the menu, select AppDirector Servers Application Servers Table to display the Server Table page similar to the one shown below: 2. Click the Create button

24 3. On the Server Table Create page, enter the necessary parameters as shown below: 4. Click the Set button to save parameters. 5. On Server Table page Click the Create button to configure another server. Enter the necessary parameters as shown below:

25 6. Click the Set button to save parameters. 7. Verify that the new entries were created on the Server Table page: Health Monitoring 1. From the menu, select Health Monitoring Global Parameters to display the Health Monitoring Global Parameters page. 2. On the Health Monitoring Global Parameters page, change the parameters as shown below:

26 3. Click the Set button to save parameters. Create the Health Monitoring Checks. 1. From the menu, select Health Monitoring Check Table to display the Health Monitoring Check Table page similar to the one shown below: 2. Click the Create button. 3. Create a set of health checks for the web servers. On the Health Monitoring Check Table Create page, enter the necessary parameters as shown below:

27 4. Before clicking the Set button, choose the button next to Arguments to populate the specific logic settings related to the method for this check. 5. Enter the information below: 6. Click the Set button for the Method Arguments and click the Set button again in the Health Monitoring Check Table Create window. 7. Repeat the steps 2-6 to create the second server health check for web server EBS_web_72, host Verify the new entries were created on the Health Monitoring Check Table The status of this check may display Unknown until the server replies successfully to the AppDirector s check

28 Binding Health Checks to Servers 1. From the menu, select Health Monitoring Binding Table to display the Health Monitoring Binding Table page similar to the one shown below: 2. Click the Create button. 3. Create the health check binding for the web servers. On the Health Monitoring Binding Table Create page, enter the necessary parameters as shown below: 4. Click the Set button to save parameters. 5. Repeat the steps 2-5 to bind the second web server health check. EBS_web_72: Farm EBS_Web_farm Verify that the new entries were created on the Health Monitoring Binding Table page:

29 General Redundant Configuration Notes For complete high-availability, Radware encourages implementing pairs of AppDirector units in an Active / Backup configuration. If your implementation of this architecture includes only a single AppDirector, then it is unnecessary to follow the steps in this section. Primary AppDirector VRRP Configuration 1. From the menu, select AppDirector Redundancy Global Configuration and set the parameters as noted below:

30 2. Click the Set button to save these changes. Primary Virtual Routers 1. From the menu, select AppDirector Redundancy VRRP Virtual Routers to display the Virtual Router Table page similar to the one shown below. 2. Click the Create button 3. On the Virtual Router Table page, enter the necessary parameters as shown below. \

31 4. Click the Set button to save the parameters. 5. On the Virtual Router Table Create page, click the Create button to configure another interface. Enter the necessary parameters as shown below: 6. Click the Set button to save the parameters. 7. Verify that the new entries were created on the Virtual Router Table page: Primary Associated IP Addresses 1. From the menu, select AppDirector Redundancy VRRP Associated IP Addresses to display the Associated IP Addresses page similar to the one shown below:

32 2. Click the Create button 3. On the Associated IP Addresses Create page, enter the necessary parameters as shown below: 4. Click the Set button to save the parameters 5. Follow steps 2-4 to create the associated IP Addresses ((VIP), VR ID = 1), ((default gateway for the web servers), VR ID = 2). 6. Verify that the new entries were created on the Associated IP Addresses page: 7. Go to AppDirector Redundancy VRRP Virtual Routers and click on the link to If Index G-1 8. Raise all of the Virtual interfaces to up by selecting VRIDs to All Up click the Set button to save the parameters

33 9. Make certain that the State of this VR is displayed as Master in the Virtual Router table: Primary Mirroring 1. Go to AppDirector Redundancy Mirroring Active Device Parameters and set the Client Table Mirroring status to enable: Note: enable session-id mirroring, if you are using the cookie-insertion feature. The new cookie insertion feature uses dynamic session-ids. 2. Click the Set button to save the parameters. 3. From the menu, select AppDirector Redundancy Mirroring Mirror Device Parameters to display the Mirror Device Parameters page similar to the one shown below

34 4. Click the Create button 5. On the Mirror Device Parameters page, enter the necessary parameters as shown below: Note: This sets the Backup AD IP used as the target address for mirroring traffic. 6. Click the Set button to save the parameters. This completes the configuration of the Primary AppDirector. Auto-Generate the Backup AppDirector Configuration To create the Backup AppDirector configuration is very easy. Once the Backup AppDirector is configured for basic IP connectivity and is available to the network, simply export the Backup Configuration file from the Primary AppDirector and upload it to the Backup AppDirector. The steps are defined below. Setting up basic IP connectivity on the Backup AppDirector Using a serial cable and a terminal emulation program, connect to the AppDirector. The default console port settings are: Bits per Second: Data Bits: 8 Parity: None Stop Bits:

35 Flow Control: None 1. Using the following Command line, assign management IP address / 24 to interface MNG-1 (Dedicated Management Interface) of the AppDirector: net ip-interface create MNG-1 -pa Using a browser, connect to the management IP Address of the AppDirector ( ) via HTTP or HTTPS. The default username and password are radware and radware. Failure to establish a connection may be due to the following: Incorrect IP Address in the browser Incorrect IP Address or default route configuration in the AppDirector Failure to enable Web Based Management or Secure Web Based Management in the AppDirector If the AppDirector can be successfully pinged, attempt to connect to it via Telnet or SSH. If the pinging or the Telnet/SSH connection are unsuccessful, reconnect to the AppDirector via its console port. Auto Generating the Backup Configuration from the Primary AppDirector 1. From the web interface menu of the Primary AppDirector, select File Configuration Receive from Device to display the Download Configuration File page similar to the one shown below: Note: Switch from the Backup to Primary AppDirector to auto-generate the Backup configuration file

36 2. On the Configuration File Download page, choose the necessary parameters as shown below: 3. Click the Set button to launch save file window. 4. Click the SAVE button to save the file to a local directory

37 Upload the Backup Configuration file to the Backup AppDirector 1. From the web interface menu of the Backup AppDirector, select File Configuration Send to Device to display the Configuration File Upload page similar to the one shown below: Note: Clicking the Browse button and navigate to the updated configuration file. 2. Click the Set button to upload the configuration. The Backup device will reboot and be ready for use. This completes the configuration of the Backup AppDirector

38 Appendix 1 - Primary AppDirector Configuration File!!Device Configuration!Date: :01:22!DeviceDescription: AppDirector with Cookie Persistency!Base MAC Address: 00:03:b2:4b:16:40!Software Version: DL (Build date Mar , 17:27:35,Build#2)!APSolute OS Version: DLA(17): !!! The following commands will take effect only! once the device has been rebooted!! system tune bridge-fft-table set 1024 system tune ip-fft-table set system tune arp-table set 1024 system tune client-table set system tune routing-table set 512 system tune url-table set 256 system tune request-table set 5000 system tune nat-address-table set 4 system tune nat-ports-table set system tune session-id-table set system tune l3-client-table-size set 20 system tune outbound-nat-address set 0 system tune outbound-nat-ports set system tune outbound-intrcpt-tbl set 512 system tune radius-attribute-table set 1 system tune segments set 15 system tune l4-policy-table set 512 system tune static-dns-persistency set 5 system tune dynamic-dns-persistency set 10 manage snmp versions-after-reset set "v1 & v2c & v3" statistics protocol status set Enabled system tune session-pasv-protocols set 16 system tune session set 512 system tune session-resets set 100 appdirector global accel-engine-status set Enabled!! The following commands take effect immediately! upon execution!! net ip-interface create G-1 -pa net ip-interface create G-11 -pa net ip-interface create MNG-1 -pa health-monitoring check create EBS_web_71 -id 8 -m HTTP -p a \ PATH=/OA_HTML/AppsLogin.jsp HOST= MTD=G PRX=N NOCACHE=N AUTH=B C1=200 -d health-monitoring check create EBS_web_72 -id 9 -m HTTP -p a \ PATH=/OA_HTML/AppsLogin.jsp HOST= MTD=G PRX=N NOCACHE=N AUTH=B C1=200 -d net route table create i G-1 redundancy mode set VRRP appdirector farm table setcreate EBS_Web_farm -at cm "No Checks" -sm RemoveOnSessionEnd-SPS appdirector farm server table create EBS_Web_farm sn EBS_web_71 -id 31 -sd node1 appdirector farm server table create EBS_Web_farm sn EBS_web_72 -id 32 -sd node2 appdirector l7 farm-selection method-table setcreate Auto-G_Cookie_EBS_W \ -cm "Set Cookie" -ma KEY=ZNpD9L6HDH VAL=$Dyn_Cookie_Value P=/ appdirector l7 farm-selection method-table setcreate Auto-G_RCookie_EBS_ -cm Cookie -ma KEY=ZNpD9L6HDH appdirector l7 farm-selection method-table setcreate appdirector.estuate \ -cm URL -ma HN=appdirector.estuate P=/ appdirector l7 farm-selection policy-table setcreate EBS_HTTP_Redirect 0 \ -m1 appdirector.estuate -pa RDRS=appdirector.estuate redundancy interface-group set Enabled appdirector nat server status set enable redundancy mirror main client-status set Enabled redundancy mirror address setcreate statistics appdirector mode set Full statistics appdirector flow-polling-time set 60 statistics appdirector health-polling-time set 60 redundancy backup-in-vlan set Disabled appdirector farm connectivity-check httpcode setcreate EBS_Web_farm "200 - OK" appdirector nat server specific-nat-address set redundancy backup-fake-arp set Enabled net next-hop-router setcreate id 5 -fl 1 appdirector farm nhr setcreate ip fl

39 appdirector farm extended-params set EBS_Web_farm -sc Enabled -ic "Enable and remove cookie on return path" appdirector nat client address-range setcreate t appdirector nat client range-to-nat setcreate t appdirector nat client status set Enabled redundancy backup-interface-group set Enabled system internal appdirector full-session-id-table setcreate EBS_Web_farm\ 0 TCP -k ZNpD9L6HDH -l Cookie -t d "No Learning" -fl 1 appdirector segmentation nhr-table setcreate DefaultNHR -ip fl 1 appdirector l4-policy caching-url-rules-lists create EBS_App_Dashboard_rwest tabs -p 10 -u \ /OA_HTML/weboam/oam/oamApps$target=rwest appdirector l4-policy ssl-policy create EBS_SSL -c radware -lp r Enabled appdirector l4-policy compression create EBS_Compression appdirector l4-policy caching create EBS_Cache -r EBS_App_Dashboard_rwest appdirector l4-policy table create TCP \ Secure_EBS -fn EBS_Web_farm -ta HTTPS -sl EBS_SSL -co EBS_Compression -ca EBS_Cache appdirector l4-policy table create TCP \ EBS_Redirect -po EBS_HTTP_Redirect -ta HTTP redundancy vrrp automated-config-update set Enabled appdirector l7 modification table setcreate Auto-G_Cookie_EBS_W -i 0 -f \ EBS_Web_farm -d Reply -am Auto-G_Cookie_EBS_W appdirector l7 modification table setcreate Auto-G_RCookie_EBS_ -i 0 -f \ EBS_Web_farm -ac Remove -mm Auto-G_RCookie_EBS_ manage trap-logging status set Enabled manage trap-logging file-size set 1000 manage trap-logging min-severity set Info redundancy mirror main sid-status set Enabled redundancy global-configuration failure-action set Ignore health-monitoring binding create 8 31 health-monitoring binding create 9 32 health-monitoring status set enable health-monitoring response-level-samples set 0 redundancy vrrp virtual-routers create G-1 1 -as Up -p 255 -pip redundancy vrrp virtual-routers create G as Up -p 255 -pip redundancy vrrp associated-ip create G redundancy vrrp associated-ip create G redundancy vrrp associated-ip create G manage user table create radware -pw GndridF04zNWSGOrZjKFV78REiEra/Qm manage telnet status set enable manage telnet server-port set 23 manage web status set enable manage ssh status set enable manage secure-web status set enable services dns client primary-server set services dns client alt-server set services dns client status set Enabled redundancy arp-interface-group set Send statistics protocol reporting set Disabled statistics protocol period set 30 statistics protocol lifetime set 30 net l2-interface set ad up net l2-interface set ad up redundancy vrrp global-advertise-int set 0 manage snmp groups create SNMPv1 public -gn initial manage snmp groups create SNMPv1 ReadOnlySecurity -gn InitialReadOnly manage snmp groups create SNMPv2c public -gn initial manage snmp groups create SNMPv2c ReadOnlySecurity -gn InitialReadOnly manage snmp groups create UserBased radware -gn initial manage snmp groups create UserBased ReadOnlySecurity -gn InitialReadOnly manage snmp access create initial SNMPv1 noauthnopriv -rvn iso -wvn iso -nvn iso manage snmp access create InitialReadOnly SNMPv1 noauthnopriv -rvn ReadOnlyView manage snmp access create initial SNMPv2c noauthnopriv -rvn iso -wvn iso -nvn iso manage snmp access create InitialReadOnly SNMPv2c noauthnopriv -rvn ReadOnlyView manage snmp access create initial UserBased authpriv -rvn iso -wvn iso -nvn iso manage snmp access create InitialReadOnly UserBased authpriv -rvn ReadOnlyView manage snmp views create iso 1 manage snmp views create ReadOnlyView 1 manage snmp views create ReadOnlyView cm excluded manage snmp views create ReadOnlyView cm excluded manage snmp views create ReadOnlyView cm excluded manage snmp views create ReadOnlyView cm excluded manage snmp views create ReadOnlyView cm excluded manage snmp views create ReadOnlyView cm excluded manage snmp views create ReadOnlyView cm excluded manage snmp notify create alltraps -ta v3traps manage snmp global engine-id set b24b1640 manage snmp users create radware -cf 0.0 -ap MD5 -akc \ 5efe7eb262018b74de977d1091aff3f9 -pp DES -pkc 5efe7eb262018b74de977d1091aff3f9 manage snmp target-address create v3mngstations -tl v3traps -p radware-authpriv manage snmp target-parameters create public-v1 -d SNMPv1 -sm SNMPv1 -sn public -sl noauthnopriv manage snmp target-parameters create public-v2 -d SNMPv2c -sm SNMPv2c -sn public -sl noauthnopriv manage snmp target-parameters create radware-authpriv -d SNMPv3 -sm UserBased -sn radware -sl authpriv

40 manage snmp community create public -n public -sn public manage telnet session-timeout set 5 manage telnet auth-timeout set 30 system diagnostics policies setcreate all system diagnostics capture output file set "RAM Drive and Flash" system diagnostics capture output term set Disabled system diagnostics capture point set Both redundancy force-down-ports-time set 0 manage trap-logging power-supply-traps set enable system diagnostics capture traffic-match-mode set "Inbound and Outbound" appdirector global connectivity-check tcp-timeout set 3 security certificate table \ Name: EBS \ Type: certificate \ -----BEGIN CERTIFICATE----- \ MIIBkzCB/QICc7YwDQYJKoZIhvcNAQEEBQAwEjEQMA4GA1UEAxMHUmFkd2FyZTAe \ Fw0xMDA1MjAwMjQzNDlaFw0xMTA1MjAwMjQzNDlaMBIxEDAOBgNVBAMTB1JhZHdh \ cmuwgz8wdqyjkozihvcnaqebbqadgy0amigjaogbanbzqpyp2w2qmqk2vet/5+jx \ PtQXLM1Qqh+XDuExSCn2KdCnEEW2Xjb1bR4iuXiGWmNyE38lIbVVcccDQkW1zIg+ \ Pmp5lJLX1lQityOipxzY+FX6d+3a6MqBwstMFcTuZn1oCecwkh9nd2GGhIDGHxth \ WDqWCRIExhdH/lC6ce0/AgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAm57pXPOL0xVl \ ofz9x9n6qssapk7n8l9q6ifczjwagtarzv5tveltf4yossikqjhxz0mbcn2iacw/ \ 7v2qFSIaBBIrJp1xa1/LdT4QeN2SFBO31Sen0DUL9A26YCAtXSHBKc/fxLzLrcW1 \ 0BPPaJ4YD/pcMEIhbND/oNmn7pN+z0s= \ -----END CERTIFICATE----- \ Name: radware \ Type: certificate \ -----BEGIN CERTIFICATE----- \ MIIB2TCCAYMCAhsgMA0GCSqGSIb3DQEBBAUAMHcxCzAJBgNVBAYTAlVTMRAwDgYD \ VQQIEwdSYWR3YXJlMRAwDgYDVQQHEwdSYWR3YXJlMRUwEwYDVQQDEww3Ni4xOTcu \ MTkuNjExEDAOBgNVBAoTB1JhZHdhcmUxGzAZBgNVBAsTElJhZHdhcmUgd2ViIHNl \ cnzlcjaefw0xmda1mjawmjqwmdhafw0xmta1mjawmjqwmdhamhcxczajbgnvbayt \ AlVTMRAwDgYDVQQIEwdSYWR3YXJlMRAwDgYDVQQHEwdSYWR3YXJlMRUwEwYDVQQD \ Eww3Ni4xOTcuMTkuNjExEDAOBgNVBAoTB1JhZHdhcmUxGzAZBgNVBAsTElJhZHdh \ cmugd2viihnlcnzlcjbcma0gcsqgsib3dqebaquaa0samegcqqdlhzawwpnzxqd8 \ 9nUWhPDGnUekYG/YiRPFwJHRloCbYJqmCyWqJ68yY5rYNGFNsL/LtDUNzRAZIFim \ 94OtCP9/AgMBAAEwDQYJKoZIhvcNAQEEBQADQQCRCjgb0TyaMELSx2sQgYmY6zSA \ QEDFmPvrvNMJdjDWxkeQqIYzYmBm03rjy0wRg0LPx1Y1Tx3kDh/GRM6PMhZj \ -----END CERTIFICATE----- \ Name: rdwrhmm \ Type: certificate \ -----BEGIN CERTIFICATE----- \ MIIB8zCCAZ0CAiIjMA0GCSqGSIb3DQEBBAUAMIGDMQswCQYDVQQGEwJVUzEQMA4G \ A1UECBMHUmFkd2FyZTEQMA4GA1UEBxMHUmFkd2FyZTEaMBgGA1UEAxMRUlcgU1NM \ IG1vbml0b3JpbmcxEDAOBgNVBAoTB1JhZHdhcmUxIjAgBgNVBAsTGVJhZHdhcmUg \ SGVhbHRoIE1vbml0b3JpbmcwHhcNMTAwNTIwMDI0MDA5WhcNMTEwNTIwMDI0MDA5 \ WjCBgzELMAkGA1UEBhMCVVMxEDAOBgNVBAgTB1JhZHdhcmUxEDAOBgNVBAcTB1Jh \ ZHdhcmUxGjAYBgNVBAMTEVJXIFNTTCBtb25pdG9yaW5nMRAwDgYDVQQKEwdSYWR3 \ YXJlMSIwIAYDVQQLExlSYWR3YXJlIEhlYWx0aCBNb25pdG9yaW5nMFwwDQYJKoZI \ hvcnaqebbqadswawsajbakrwrprzgm6nu4cy86axnt5dqdnwscc9pjs3jcdqj6gd \ jmq8wizyaw09/2rckxvusbd5wc7wss1f2mwjvzyqeyecaweaatanbgkqhkig9w0b \ AQQFAANBAEqIVXcSSyVBMDEkQUrYUv56/mTWrUSz6HUpK0qIMNn+yb5oT60/tR9d \ JdJPhgoA6qNYpJcmkoyTMw1ESS6KpwE= \ -----END CERTIFICATE-----!File Signature: 88cf821015d171f87401bfb a1-40 -

41 Appendix 2 - Backup AppDirector Configuration File!!Device Configuration!Date: :05:03!DeviceDescription: AppDirector with Cookie Persistency!Base MAC Address: 00:03:b2:4b:16:40!Software Version: DL (Build date Mar , 17:27:35,Build#2)!APSolute OS Version: DLA(17): !!! The following commands will take effect only! once the device has been rebooted!! system tune bridge-fft-table set 1024 system tune ip-fft-table set system tune arp-table set 1024 system tune client-table set system tune routing-table set 512 system tune url-table set 256 system tune request-table set 5000 system tune nat-address-table set 4 system tune nat-ports-table set system tune session-id-table set system tune l3-client-table-size set 20 system tune outbound-nat-address set 0 system tune outbound-nat-ports set system tune outbound-intrcpt-tbl set 512 system tune radius-attribute-table set 1 system tune segments set 15 system tune l4-policy-table set 512 system tune static-dns-persistency set 5 system tune dynamic-dns-persistency set 10 manage snmp versions-after-reset set "v1 & v2c & v3" statistics protocol status set Enabled system tune session-pasv-protocols set 16 system tune session set 512 system tune session-resets set 100 appdirector global accel-engine-status set Enabled!! The following commands take effect immediately! upon execution!! net ip-interface create G-1 -pa net ip-interface create G-11 -pa net ip-interface create MNG-1 -pa health-monitoring check create EBS_web_71 -id 8 -m HTTP -p a \ PATH=/OA_HTML/AppsLogin.jsp HOST= MTD=G PRX=N NOCACHE=N AUTH=B\ C1=200 -d health-monitoring check create EBS_web_72 -id 9 -m HTTP -p a \ PATH=/OA_HTML/AppsLogin.jsp HOST= MTD=G PRX=N NOCACHE=N AUTH=B C1=200 -d net route table create i G-1 redundancy mode set VRRP system mib2-name set AppDirector_peer appdirector farm table setcreate EBS_Web_farm -at cm "No Checks" -sm RemoveOnSessionEnd-SPS appdirector farm server table create EBS_Web_farm sn EBS_web_71 -id 31 -sd node1 appdirector farm server table create EBS_Web_farm sn EBS_web_72 -id 32 -sd node2 appdirector l7 farm-selection method-table setcreate Auto-G_Cookie_EBS_W \ -cm "Set Cookie" -ma KEY=ZNpD9L6HDH VAL=$Dyn_Cookie_Value P=/ appdirector l7 farm-selection method-table setcreate Auto-G_RCookie_EBS_ -cm Cookie -ma KEY=ZNpD9L6HDH appdirector l7 farm-selection method-table setcreate appdirector.estuate \ -cm URL -ma HN=appdirector.estuate P=/ appdirector l7 farm-selection policy-table setcreate EBS_HTTP_Redirect 0 \ -m1 appdirector.estuate -pa RDRS=appdirector.estuate redundancy interface-group set Disabled appdirector nat server status set enable redundancy mirror backup status set Enabled redundancy mirror main client-status set Disabled redundancy mirror address setcreate statistics appdirector mode set Full statistics appdirector flow-polling-time set 60 statistics appdirector health-polling-time set 60 redundancy backup-in-vlan set Enabled appdirector farm connectivity-check httpcode setcreate EBS_Web_farm "200 - OK" appdirector nat server specific-nat-address set

42 redundancy backup-fake-arp set Enabled net next-hop-router setcreate id 5 -fl 1 appdirector farm nhr setcreate ip fl 1 appdirector farm extended-params set EBS_Web_farm -sc Enabled -ic "Enable and remove cookie on return path" appdirector nat client address-range setcreate t appdirector nat client range-to-nat setcreate t appdirector nat client status set Enabled redundancy backup-interface-group set Enabled system internal appdirector full-session-id-table setcreate EBS_Web_farm\ 0 TCP -k ZNpD9L6HDH -l Cookie -t d "No Learning" -fl 1 appdirector segmentation nhr-table setcreate DefaultNHR -ip fl 1 appdirector l4-policy caching-url-rules-lists create EBS_App_Dashboard_rwest tabs -p 10 -u \ /OA_HTML/weboam/oam/oamApps$target=rwest appdirector l4-policy ssl-policy create EBS_SSL -c radware -lp r Enabled appdirector l4-policy compression create EBS_Compression appdirector l4-policy caching create EBS_Cache -r EBS_App_Dashboard_rwest appdirector l4-policy table create TCP \ Secure_EBS -fn EBS_Web_farm -ta HTTPS -rs Backup -sl EBS_SSL -co EBS_Compression -ca EBS_Cache appdirector l4-policy table create TCP \ EBS_Redirect -po EBS_HTTP_Redirect -ta HTTP -rs Backup redundancy mirror main dns-status set Disabled redundancy vrrp automated-config-update set Enabled appdirector l7 modification table setcreate Auto-G_Cookie_EBS_W -i 0 -f \ EBS_Web_farm -d Reply -am Auto-G_Cookie_EBS_W appdirector l7 modification table setcreate Auto-G_RCookie_EBS_ -i 0 -f \ EBS_Web_farm -ac Remove -mm Auto-G_RCookie_EBS_ manage trap-logging status set Enabled manage trap-logging file-size set 1000 manage trap-logging min-severity set Info redundancy mirror main sid-status set Disabled redundancy global-configuration failure-action set Ignore health-monitoring binding create 8 31 health-monitoring binding create 9 32 health-monitoring status set enable health-monitoring response-level-samples set 0 redundancy vrrp virtual-routers create G-1 1 -as Up -p 155 -pip redundancy vrrp virtual-routers create G as Up -p 155 -pip redundancy vrrp associated-ip create G redundancy vrrp associated-ip create G redundancy vrrp associated-ip create G manage user table create radware -pw GndridF04zNWSGOrZjKFV78REiEra/Qm manage telnet status set enable manage telnet server-port set 23 manage web status set enable manage ssh status set enable manage secure-web status set enable services dns client primary-server set services dns client alt-server set services dns client status set Enabled redundancy arp-interface-group set Send statistics protocol reporting set Disabled statistics protocol period set 30 statistics protocol lifetime set 30 net l2-interface set ad up net l2-interface set ad up redundancy vrrp global-advertise-int set 0 manage terminal prompt set AppDirector_peer manage snmp groups create SNMPv1 public -gn initial manage snmp groups create SNMPv1 ReadOnlySecurity -gn InitialReadOnly manage snmp groups create SNMPv2c public -gn initial manage snmp groups create SNMPv2c ReadOnlySecurity -gn InitialReadOnly manage snmp groups create UserBased radware -gn initial manage snmp groups create UserBased ReadOnlySecurity -gn InitialReadOnly manage snmp access create initial SNMPv1 noauthnopriv -rvn iso -wvn iso -nvn iso manage snmp access create InitialReadOnly SNMPv1 noauthnopriv -rvn ReadOnlyView manage snmp access create initial SNMPv2c noauthnopriv -rvn iso -wvn iso -nvn iso manage snmp access create InitialReadOnly SNMPv2c noauthnopriv -rvn ReadOnlyView manage snmp access create initial UserBased authpriv -rvn iso -wvn iso -nvn iso manage snmp access create InitialReadOnly UserBased authpriv -rvn ReadOnlyView manage snmp views create iso 1 manage snmp views create ReadOnlyView 1 manage snmp views create ReadOnlyView cm excluded manage snmp views create ReadOnlyView cm excluded manage snmp views create ReadOnlyView cm excluded manage snmp views create ReadOnlyView cm excluded manage snmp views create ReadOnlyView cm excluded manage snmp views create ReadOnlyView cm excluded manage snmp views create ReadOnlyView cm excluded manage snmp notify create alltraps -ta v3traps manage snmp global engine-id set b24b1640 manage snmp users create radware -cf 0.0 -ap MD5 -akc \

43 5efe7eb262018b74de977d1091aff3f9 -pp DES -pkc 5efe7eb262018b74de977d1091aff3f9 manage snmp target-address create v3mngstations -tl v3traps -p radware-authpriv manage snmp target-parameters create public-v1 -d SNMPv1 -sm SNMPv1 -sn public -sl noauthnopriv manage snmp target-parameters create public-v2 -d SNMPv2c -sm SNMPv2c -sn public -sl noauthnopriv manage snmp target-parameters create radware-authpriv -d SNMPv3 -sm UserBased -sn radware -sl authpriv manage snmp community create public -n public -sn public manage telnet session-timeout set 5 manage telnet auth-timeout set 30 system diagnostics policies setcreate all system diagnostics capture output file set "RAM Drive and Flash" system diagnostics capture output term set Disabled system diagnostics capture point set Both redundancy force-down-ports-time set 0 manage trap-logging power-supply-traps set enable system diagnostics capture traffic-match-mode set "Inbound and Outbound" appdirector global connectivity-check tcp-timeout set 3 security certificate table \ Name: EBS \ Type: certificate \ -----BEGIN CERTIFICATE----- \ MIIBkzCB/QICc7YwDQYJKoZIhvcNAQEEBQAwEjEQMA4GA1UEAxMHUmFkd2FyZTAe \ Fw0xMDA1MjAwMjQzNDlaFw0xMTA1MjAwMjQzNDlaMBIxEDAOBgNVBAMTB1JhZHdh \ cmuwgz8wdqyjkozihvcnaqebbqadgy0amigjaogbanbzqpyp2w2qmqk2vet/5+jx \ PtQXLM1Qqh+XDuExSCn2KdCnEEW2Xjb1bR4iuXiGWmNyE38lIbVVcccDQkW1zIg+ \ Pmp5lJLX1lQityOipxzY+FX6d+3a6MqBwstMFcTuZn1oCecwkh9nd2GGhIDGHxth \ WDqWCRIExhdH/lC6ce0/AgMBAAEwDQYJKoZIhvcNAQEEBQADgYEAm57pXPOL0xVl \ ofz9x9n6qssapk7n8l9q6ifczjwagtarzv5tveltf4yossikqjhxz0mbcn2iacw/ \ 7v2qFSIaBBIrJp1xa1/LdT4QeN2SFBO31Sen0DUL9A26YCAtXSHBKc/fxLzLrcW1 \ 0BPPaJ4YD/pcMEIhbND/oNmn7pN+z0s= \ -----END CERTIFICATE----- \ Name: radware \ Type: certificate \ -----BEGIN CERTIFICATE----- \ MIIB2TCCAYMCAhsgMA0GCSqGSIb3DQEBBAUAMHcxCzAJBgNVBAYTAlVTMRAwDgYD \ VQQIEwdSYWR3YXJlMRAwDgYDVQQHEwdSYWR3YXJlMRUwEwYDVQQDEww3Ni4xOTcu \ MTkuNjExEDAOBgNVBAoTB1JhZHdhcmUxGzAZBgNVBAsTElJhZHdhcmUgd2ViIHNl \ cnzlcjaefw0xmda1mjawmjqwmdhafw0xmta1mjawmjqwmdhamhcxczajbgnvbayt \ AlVTMRAwDgYDVQQIEwdSYWR3YXJlMRAwDgYDVQQHEwdSYWR3YXJlMRUwEwYDVQQD \ Eww3Ni4xOTcuMTkuNjExEDAOBgNVBAoTB1JhZHdhcmUxGzAZBgNVBAsTElJhZHdh \ cmugd2viihnlcnzlcjbcma0gcsqgsib3dqebaquaa0samegcqqdlhzawwpnzxqd8 \ 9nUWhPDGnUekYG/YiRPFwJHRloCbYJqmCyWqJ68yY5rYNGFNsL/LtDUNzRAZIFim \ 94OtCP9/AgMBAAEwDQYJKoZIhvcNAQEEBQADQQCRCjgb0TyaMELSx2sQgYmY6zSA \ QEDFmPvrvNMJdjDWxkeQqIYzYmBm03rjy0wRg0LPx1Y1Tx3kDh/GRM6PMhZj \ -----END CERTIFICATE----- \ Name: rdwrhmm \ Type: certificate \ -----BEGIN CERTIFICATE----- \ MIIB8zCCAZ0CAiIjMA0GCSqGSIb3DQEBBAUAMIGDMQswCQYDVQQGEwJVUzEQMA4G \ A1UECBMHUmFkd2FyZTEQMA4GA1UEBxMHUmFkd2FyZTEaMBgGA1UEAxMRUlcgU1NM \ IG1vbml0b3JpbmcxEDAOBgNVBAoTB1JhZHdhcmUxIjAgBgNVBAsTGVJhZHdhcmUg \ SGVhbHRoIE1vbml0b3JpbmcwHhcNMTAwNTIwMDI0MDA5WhcNMTEwNTIwMDI0MDA5 \ WjCBgzELMAkGA1UEBhMCVVMxEDAOBgNVBAgTB1JhZHdhcmUxEDAOBgNVBAcTB1Jh \ ZHdhcmUxGjAYBgNVBAMTEVJXIFNTTCBtb25pdG9yaW5nMRAwDgYDVQQKEwdSYWR3 \ YXJlMSIwIAYDVQQLExlSYWR3YXJlIEhlYWx0aCBNb25pdG9yaW5nMFwwDQYJKoZI \ hvcnaqebbqadswawsajbakrwrprzgm6nu4cy86axnt5dqdnwscc9pjs3jcdqj6gd \ jmq8wizyaw09/2rckxvusbd5wc7wss1f2mwjvzyqeyecaweaatanbgkqhkig9w0b \ AQQFAANBAEqIVXcSSyVBMDEkQUrYUv56/mTWrUSz6HUpK0qIMNn+yb5oT60/tR9d \ JdJPhgoA6qNYpJcmkoyTMw1ESS6KpwE= \ -----END CERTIFICATE-----!File Signature: 3c209ce403e08b36c16c761e

44 Appendix 3 - Oracle Application Server Web Cache - Caching Rules E-Business Suite does not have any method to implement Caching Rules to determine what object/page/uri to Cache and which you don t. You will have to install/integrate separate Application Oracle Application Server Web Cache which is designed to help E-Business Suite system combines caching, compression and assembly technologies to accelerate the delivery of both static and dynamically generated Web content. The Caching Rules in Oracle Application Server Web Cache determine which E-Business Suite objects are cached. Oracle Application Server Web Cache 10g ships with a set of predefined caching, personalization and compression rules for all the sites. You can choose to delete those rules if they are not applicable to any site in your web cache configuration. For Installing Oracle Application Server Web Cache and integrating it with E-Business Suite 12i please refer Note: Section 4. For Implementing Caching Rules Please refer Note: Section 5.2. Table in Section 5.2 shows example how you can set specific URL Expression to Cache or Don t Cache Example: Here is a URI that needs an exception rule not to cache the content. Below is a screen shot of the Dashboard page used by EBS administrators to check the health and status of the EBS servers. There are tabs that reference overview, performance, critical activities, diagnostics, business flows, security and software updates

45 The issue with caching this page is that the URI looks the same to the cache no matter what tab is selected and therefore the page view never changes, it s stuck on the cached page. An exception rule can be created in the AppDirector or in Oracle Application Server Web Cache

46 Appendix 4 Certificates and Keys Certificates Certificates are digitally signed indicators which identify the server or user. They are usually provided in the form of an electronic key or value. The digital certificate represents the certification of an individual business or organizational public key but can also be used to show the privileges and roles for which the holder has been certified. It also includes information from a third party verifying identity. Authentication is needed to ensure that users in a communication or transaction are who they claim to be. A basic certificate includes: The certificate holder s identity The certificate s serial number The certificate holder s expiry date A copy of the certificate holder s public key The identity of the Certificate Authority (CA) and its digital signature to affirm the digital certificate was issued by a valid agency. Keys A key is a variable set of numbers that the sender applies to decrypted data to produce encrypted data, to be sent via the internet. Usually a pair of public and private keys is used. A private key is kept secret and used, only by its owner, to encrypt and decrypt data. A public key has a wide distribution and is not secret. It is used for encrypting data and for verifying signatures. One key is used by the sender to encrypt or interpret the data. The recipient also uses the key to authenticate that the data comes from the sender. The use of keys ensures that unauthorized personnel cannot decipher the data. Only with the appropriate key can the information be easily deciphered or understood. Stolen or copied data would be incomprehensible without the appropriate key to decipher it and prevent forgery. AppDirector supports the following key size lengths - 512, 1024 or 2048 bytes. To create a Certificate Signing Request (CSR) When a new Certificate is needed, this process should be followed 1. Create a certificate (see Certificates Table) and select CSR. 2. Complete the relevant fields (or update the defaults before you start) 3. Click OK. The Key and CSR are created 4. Move to the Export Certificates window. Export the CSR to file or Text and send to a Certificate Signing Authority such as VeriSign. 5. After receiving the signed certificate back from CA, use the Import Certificates window to import it into the CSR and convert it to a Key and a Certificate

47 Appendix 5 HTTP redirect to HTTPS The following instructions shows how to create a L7 Policy that redirects HTTP traffic to same host name same URI over HTTPS. This L7 Policy is a safety net; it catches the traffic that incorrectly comes in on HTTP and redirects it to HTTPS. Create Layer 7 Policy Note: AppDirector needs to be configured with a L7 rules in order to identify the HTTP traffic that needs to be converted to HTTPS. Methods Table A method is defined to identify the Host/URI that is used to identify the traffic that is to be converted from HTTP to HTTPS. The Methods are mapped to the three rules described above. 1. From the menu, select AppDirector Layer 7 Farm Selection Methods to display the Methods Table page similar to the one shown below: 2. Click the Create button 3. On the Methods Table Create page, enter the necessary parameters as shown below: 4. Select the to enter in the arguments below:

48 5. Click the Set button to save the parameters. Layer 7 Policy Table 1. From the menu, select AppDirector Layer 7 Farm Selection Policies to display the Layer 7 Policies Table page similar to the one shown below: 2. Click the Create button 3. On the Policy Table Create page, enter the necessary parameters as shown below: 4. Select the to enter in the arguments below:

49 Note: HTTPS Redirect To (RDRS): AppDirector redirects the HTTP request to the specified name or IP and modifies the request to a HTTPS request. 5. Click the Set button to save the parameters. Create Layer 4 Policy 1. From the menu, select AppDirector Layer 4 Traffic Redirection Layer 4 Policy Table to display the Layer 4 Policy Table page similar to the one shown below: 2. Click the Create button. 3. On the Layer 4 Policy Table Create page, enter the necessary parameters as shown below

50 4. Click the Set button to save the parameters