DEPLOYING ORACLE ENTERPRISE MANAGER 12C IN A COMPLEX NETWORKING ENVIRONMENT Telstra Corporation Limited. All rights reserved

Transcription

1 DEPLOYING ORACLE ENTERPRISE MANAGER 12C IN A COMPLEX NETWORKING ENVIRONMENT TELSTRA TEMPLATE 4X3 BLUE BETA TELPPTV4

2 EM12C GOALS TO ACHIEVE Deploying agents without burning firewall rules Using corporate login accounts Simplifying agent deployment and target discovery 2

3 EM12C SOLUTIONS Configuring firewalls per network instead of per host EM12C External Roles and Microsoft Active Directory Utilising EM12C Dynamic Groups 3

4 TELSTRA CORPORATION LTD Australia s leading telecommunications and information services company Employs more than 39,000 people worldwide Telstra Global has access to 230 countries and territories and more than 1400 Points of Presence throughout Australia, Asia Pacific, Europe and the USA One of the top 10 telcos in the world 4

5 TELSTRA DATABASE SOLUTIONS Tony Kirn, Oracle Domain Lead Responsible for Oracle database standards in Telstra Provide guidance and consultation for Telstra solutions and projects that have Oracle database products Offer Oracle DBaaS and APEX for Telstra systems 5

6 6

7 TELSTRA AND ACS (ADVANCED CUSTOMER SERVICES) Advising on best practice for Telstra IT Engage with Telstra project teams and partners to provide expertise for deployment of Oracle technologies Assist with Telstra Oracle Standards Maximize return on Telstra s investment in Oracle software Knowledge Transfer sessions to Telstra staff and partners Evaluate new Oracle features and technologies 7

8 TELSTRA AND ENTERPRISE MANAGER 8

9 TELSTRA DATABASE ENVIRONMENT Approx 3000 database instances managed through EM More databases and environments yet to be on boarded End of life EM 10G has approx of these instances Enterprise Manager 12C is managing the remaining 400 databases and migrations from the 10G environment are now in progress 9

10 TELSTRA ENTERPRISE MANAGER BENEFITS Centralised database management platform Automated Database builds based on Gold images Rapid database diagnostic information to resolve high severity issues Proactive alerting and performance tuning 10

11 TELSTRA S EARLY ADOPTION OF ENTERPRISE MANAGER Telstra became the first enterprise in the world to use Oracle Enterprise Manager 10g Deployment peaked at 6182 managed targets Oracle sponsored report by Mainstay Partners August

12 ORIGINAL ENTERPRISE MANAGER 10G DEPLOYMENT 12

13 INITIAL 10G NETWORKING MODEL 13

14 COMPLEX 10G NETWORKING MODEL Enterprise Manager Enterprise Manager Enterprise Manager Enterprise Manager 14

15 TELSTRA ENTERPRISE MANAGER 12C 15

16 THE NEED TO SIMPLIFY THE NETWORK Eliminate firewall rules per host Centralised view of all targets regardless of network Leverage additional functionality of existing equipment 16

17 THE EM12 DEPLOYMENT SCOPE Our EM12c project initially spanned approximately 15 firewalled networks and then to include another 30 additional networks. 17

18 LOAD BALANCER AND ROUTER IDEA EM12C OMS Hosts F5 Load Balancer Network 18

19 F5 ROUTE DOMAINS A route domain is a configuration object that the F5 Big IP load balancer uses to isolate network traffic for a particular application. Using the route domains feature of the BIG-IP system Telstra was able to connect to any configured network to securely manage EM targets. 19

20 F5 ROUTE DOMAINS F5 Load Balancer Route Domain1 Route Domain2 No network VLAN 1 bridging VLAN 2 When a VLAN group is assigned to a route domain, the BIG-IP system automatically assigns the VLAN group members to the route domain. 20

21 F5 BIG IP AND JUNIPER SRX FIREWALL Used to satisfy Additonal Telstra Security requirements EM12C OMS Hosts Juniper Firewall F5 Load Balancer (& route domains) Network 21

22 TELSTRA S ROUTABLE NETWORK F5 Load Balancer IP address is presented to target networks F5 Load Balancer & Juniper Firewall 22

23 12C NETWORK LAYOUT 23

24 FROM THE DESKTOPS TO EM12C The following ports have been configured on the Juniper firewalls and F5 load balancers. Port Number Web Browser to DBMPLUS webpage Protocol 7799 OEM web console user traffic from the EDN through the security firewall and load balancer to the OMS 7101 WebLogic Admin server from the EDN through the security firewall and load balancer to the OMS HTTPS HTTPS 9702 Oracle Business Intelligence(BI) Publisher console port HTTPS 24

25 FROM THE AGENT TO THE OMS Port Number From OEM agents to DBMPLUS Protocol 1159 OMA target traffic through the security firewall, through the load balancer to OMS for secure communication HTTPS 4889 OMA target traffic through the security firewall, through the load balancer to OMS to request wallet with SSL key. This port will only be used when the target gets installed. Once the SSL key has been downloaded to the agent all communication to the OMS will be on port 1159 using HTTPS Note: This port no longer required as of EM12C HTTP 25

26 FROM THE OMS TO THE AGENTS Port Number OMS to agents Protocol 3872 From the OMS, through the load balancer and the security gateway, bound for OMA targets for secure communication HTTPS From OMS, through the load balancer and security gateway to connect to all OMA target databases JDBC 22 From the OMS, through load balancer and security gateway to all OMA target for secure admin traffic SSH 7 enable OEM Beacons using ping and traceroute ICMP 26

27 DETAILED TRAFFIC FLOW BETWEEN EM12C COMPONENTS 27

28 EM12C SERVER NETWORK LAYOUT Only OMS hosts can communicate with the F5 loadbalancer DNS name of dbmplus.in.telstra.com visible on all networks 28

29 NO MORE FIREWALL BURNS PER HOST Once a network has been added, only traffic to and from that network and EM12c will be allowed through AND only on specific ports. All traffic to and from the EM12c environment will be communicating with the F5 load balancer via a DNS name, e.g. dbmplus.in.telstra.com.au 29

30 EM12C AGENT TRAFFIC FLOWS 30

31 EM12C AGENT DEPLOYMENT FLOW Target Hosts User Authentication OMS Network 1 Network 2 Network 3 HTTPS SCP OMR Target Hosts Target Hosts Target Hosts 31

32 EM12C OMS AND AGENT TRAFFIC Target Hosts OMS Network 1 Network 2 Network 3 HTTPS OMR Target Hosts Target Hosts Target Hosts 32

33 EM12C DATABASE TRAFFIC Target Databases OMS Network 1 Network 2 Network 3 OMR HTTPS JDBC Target Databases Target Databases Target Databases 33

34 EM12C DEPLOYMENT SIMPLIFIED When a server is ready to be deployed into any configured network, an agent can be deployed Databases can be provisioned by using Enterprise Manager without delays and from a centralised location Now to simplify user administration 34

35 ACTIVE DIRECTORY & SINGLE SIGN ON 35

36 REDUCING MANAGEMENT OVERHEAD Incorporating Single Sign On (SSO) EM12C External Roles with Microsoft Active Directory Distribute user and target administration 36

37 ACTIVE DIRECTORY ADVANTAGES Leverage off the existing Active Directory infrastructure in the company to login to EM12C Managing users with EM12C External Roles that map back to Active Directory groups Free up the EM12C administrator from tedious user administration in a large organisation 37

38 TRADITIONAL EM GROUPS AND ROLES EM Internal Role TELSTRA_DBOPS Target Privileges Resource Privileges SYSMAN EM Users: Tony Kirn Bob Smith Harry Jones Sekhar Singh Target Group New Target Hosts 38

39 TRADITIONAL EM GROUPS AND ROLES EM Users: Tony Kirn Bob Smith Harry Jones Sekhar Singh EM Internal Role TELSTRA_DBOPS Target Privileges Resource Privileges Target Group The EM administrator has to manage: Adding/removing users Adding/removing targets to/from groups 39

40 MAKING USER MANAGEMENT EASIER EM Internal Role TELSTRA_DBOPS Take the user administration out of Enterprise Manager Target Privileges Resource Privileges EM Users: Tony Kirn Bob Smith Harry Jones Sekhar Singh Target Group EM Users: Tony Kirn Bob Smith Harry Jones Sekhar Singh 40

41 SINGLE SIGN ON VIA WEBLOGIC 41

42 SINGLE SIGN ON VIA WEBLOGIC 42

43 SINGLE SIGN ON VIA WEBLOGIC 43

44 ORACLE DOCUMENTATION FOR ACTIVE DIRECTORY SSO Oracle Enterprise Manager Cloud Control Security Guide 12c Release 3 ( ) Part Number E Microsoft Active Directory Based Authentication 44

45 WEBLOGIC JAVA KEYSTORE Before you begin the certificate chain import make a backup of the <Middleware>/wlserver_10.3/server/lib/DemoTrust.jks file The order for the java key imports is very important. It typically starts with importing the root certificate first and the actual server/alias certificate last. 45

46 ADDING KEYS TO THE KEYSTORE -> keytool -import -trustcacerts -alias root -file root.cer -keystore / <Middleware>/wlserver_10.3/server/lib/DemoTrust.jks -> keytool -import -trustcacerts -alias policy -file policy.cer keystore / <Middleware>/wlserver_10.3/server/lib/DemoTrust.jks -> keytool -import -trustcacerts -alias objects -file objects.cer keystore / <Middleware>/wlserver_10.3/server/lib/DemoTrust.jks -> keytool -import -alias em12serv.com -file em12srv.cer keystore / <Middleware>/wlserver_10.3/server/lib/DemoTrust.jks 46

47 WEBLOGIC JAVA KEYSTORE The default password for the WebLogic DemoTrust.jks keystore file is: DemoTrustKeyStorePassPhrase Ensure you change this password and keep the DemoTrust.jks keystore secure 47

48 MAPPING ACTIVE DIRECTORY GROUPS TO EM 12C ROLES 48

49 EM12C EXTERNAL ROLES AND MICROSOFT ACTIVE DIRECTORY EM External Role atelstra_dbops Target Privileges Resource Privileges Target Group Active Directory Group atelstra_dbops Tony Kirn Bob Smith Harry Jones Sekhar Singh Users now managed via Active Directory. EM Admins are free to do value add work. New Target Hosts Targets however are still managed by sysman. 49

50 CONFIGURING EXTERNAL ROLES TO ACTIVE DIRECTORY GROUPS 50

51 CONFIGURING EXTERNAL ROLES TO ACTIVE DIRECTORY GROUPS 51

52 NEW EM12CR2 FEATURE DYNAMIC GROUPS 52

53 MAKING TARGET MANAGEMENT EASIER Target Privileges Resource Privileges EM Internal Role TELSTRA_DBOPS Automate the addition/deletion and managment of targets Targets Dynamic Group 53

54 EM12C DYNAMIC GROUPS SIMPLIFYING TARGET MANAGEMENT Automating target to group assignment Allow teams to manage target deployments seamlessly Decentralising target management 54

55 DYNAMIC GROUPS AND MICROSOFT ACTIVE DIRECTORY EM External Role atelstra_dbops EM Dynamic Group TELSTRA_DBOPS EM Targets With Target Property Department set Active Directory Group atelstra_dbops New Target Hosts Tony Kirn Bob Smith Harry Jones Sekhar Singh 55

56 DYNAMIC GROUPS AND MICROSOFT ACTIVE DIRECTORY EM External Role atelstra_dbops EM Dynamic Group TELSTRA_DBOPS EM Targets With Target Property Department set Active Directory Group atelstra_dbops Targets can be added to Dynamic Groups without sysman administrator involvement. EM targets can now be added by teams deploying the agents. Tony Kirn Bob Smith Harry Jones Sekhar Singh 56

57 CONFIGURING EM12C DYNAMIC GROUPS 57

58 CONFIGURING EM12C DYNAMIC GROUPS 58

59 CONFIGURING EM12C DYNAMIC GROUPS 59

60 CONFIGURING EM12C DYNAMIC GROUPS 60

61 CONFIGURING EM12C DYNAMIC GROUPS 61

62 CONFIGURING EM12C DYNAMIC GROUPS 62

63 CONFIGURING EM12C DYNAMIC GROUPS 63

64 CONFIGURING EM12C DYNAMIC GROUPS 64

65 CONFIGURING EM12C DYNAMIC GROUPS 65

66 ORACLE DOCUMENTATION FOR DYNAMIC GROUPS Oracle Enterprise Manager Cloud Control Admin Guide 12c Release 3 ( ) Part Number E Creating Dynamic Groups 66

67 NEXT STEPS Deploy the solution to our remaining networks Leverage new Oracle Database 12C features with EM Schema auto provisioning and chargeback Use administration groups and templates to automate our database monitoring 67

68 TO WRAP UP Telstra can seamlessly deploy EM targets over any configured network User account management can be delegated to relevant team leaders or managers Enterprise Manager administrators are free from managing users and target deployments for other teams 68

69 Q&A 69