BusinessObjects Enterprise XI 3.0 with Complex NAT Networks

Transcription

1 BusinessObjects Enterprise XI 3.0 with Complex NAT Networks Applies to: BusinessObjects Enterprise XI 3.0 Summary The BusinessObjects Enterprise Administrator s Guide (XI 3.1) provides the basic concept and detailed steps to design and configure BusinessObjects Enterprise to work with simple Network Address Translation (NAT) network scenarios. Written as a supplementary reading material to that document, this white paper is to provide an in-depth technical exploration to run BusinessObjects Enterprise to work with complex NAT networks. Author(s): Xing Jin Company: SAP Created on: 15 February 2009 Author Bio Xing Jin is a technical program manager of transversal team, Business Objects, An SAP Company. He has five years working experience in the company and enterprise deployment is one of his interests and active areas. He holds a master degree in Computer Science from University of Victoria SAP AG 1

2 Table of Contents Legend... 3 Introduction... 4 Network Address Translation... 4 Basic Static NAT Types... 4 Type A NAT... 4 Type B NAT... 5 Type C NAT... 5 Type D NAT... 6 Communication between BusinessObjects Enterprise Components... 6 Inbound Communication to BusinessObjects Enterprise Servers... 6 Outbound Communication from BusinessObjects Enterprise Servers... 7 Two-way Communication... 7 NAT types and BusinessObjects Enterprise Communication... 8 NAT Chains... 8 Summary Related Content Copyright SAP AG 2

3 Legend NAT firewall/router. The type is indicated by the center text. It has two network interfaces denoted as solid black boxes inside on its left and outside on its right. The inside part usually is under a more secure zone than the outside part. IP addresses of inside part are hidden from outside part while outside IP addresses are visible to the inside part. A network packet traversing from right to left. DA denotes destination address. SA denotes source address. DA=d and SA=a indicate the packet has d as its destination address and a as its source address. A network interface with IP address d. A mapping from hostname to an IP address (also known as hostname to IP resolution) An initial BusinessObjects Enterprise connection request A BusinessObjects Enterprise service location information. The hostname is a string of hostname, FQDN, or IP address. The port is a number. The location information tells where to find a BusinessObjects Enterprise server service SAP AG 3

4 Introduction This paper begins by highlighting some of the key NAT concepts. After a classification of NAT types, attention is next focused on the communication between BusinessObjects Enterprise components. It then includes examples of BusinessObjects Enterprise systems to work with NAT chains. Network Address Translation Network Address Translation (NAT) translates internal or private IP addresses to external or public routable IP addresses. NAT can be used to save public IP addresses, secure internal IP addresses, and simplify routing. (NAT is described in RFC 1631, available from: One important thing to know about NAT is that any applications that carry and use the internal IP addresses will have difficulty working through a NAT. The difficulties come from the fact that the internal IP addresses are not publically routable, and it therefore requires special hostname resolution for the applications to work through NATs. Knowing this is important because BusinessObjects Enterprise is one such application. Many NAT devices and much NAT software can also translate ports in addition to IP addresses. However, to work with NATs, BusinessObjects Enterprise requires that internal port numbers must match its external port numbers. In other words, the BusinessObjects Enterprise server port numbers cannot be altered when traversing through NATs. This is because both internal and external parts of BusinessObjects Enterprise system rely on same port numbers. In this sense, Port Address Translation (PAT) is barely supported by BusinessObjects Enterprise. NAT may generally be classified into a static NAT and a dynamic NAT according to methods for translating an internal IP address into an external IP address. Static NAT is designed to allow one-to-one mapping between internal and external IP addresses. This is particularly useful for inside BusinessObjects Enterprise servers to be accessible from the outside. Dynamic NAT is designed to map to a dynamic external IP address from a pool of reserved addresses, when an internal host requires an external address. With Dynamic NAT, it is hard for outside parties initiating communication to inside BusinessObjects Enterprise servers. Therefore, hereafter in this paper will generally discuss Static NAT if not explicitly specified. Basic Static NAT Types There are several ways to classify NATs. One way is to see whether source addresses and/or destination addresses are translated when traversing across NATs - this results in the following four NAT types: A, B, C and D. Type A NAT Computer L (IP address a) and computer S (IP address d) are separated by a Type A NAT (IP address c and b). IP address a is visible (routable) to the inside, but IP address d is not visible (routable) to outside. Therefore, b and d are translated to each other when packets are traversing the NAT. Inside host S is known by the outside as b. NOTE NAT Type A is equivalent to the following Cisco firewall configuration: 2009 SAP AG 4

5 ip nat inside source static d b interface c ip nat inside interface b ip nat outside Type B NAT IP address a is not visible to the inside and IP address d is not visible to outside. Therefore, b and d are translated to each other when packets are traversing Type B NATs while a and c are translated to each other when packets are traversing Type B NATs. Inside host S is known to the outside as b and outside host L is known to the inside as c. NOTE NAT Type B is equivalent to the following Cisco firewall configuration: ip nat inside source static d b ip nat outside source static a c interface c ip nat inside interface b ip nat outside Type C NAT Type C NAT is the reverse view of Type A NAT SAP AG 5

6 IP address d is visible to the outside, but IP address a is not visible to inside. Therefore, a and c are translated to each other when packets are traversing Type C NATs. Outside host L is known to the inside as c. NOTE NAT Type C is equivalent to the following Cisco firewall configuration: ip nat outside source static a c interface c ip nat inside interface b ip nat outside Type D NAT Type D NAT is the extreme case where no IP translation occurs and is usually known as Packet Filtering rather than NAT. Either side knows the hosts on the other side. Communication between BusinessObjects Enterprise Components For BusinessObjects Enterprise to work with NATs, it is essential to know how BusinessObjects Enterprise components communicate. Chapter Working with Firewalls, BusinessObjects Enterprise Administrator s Guide (XI 3.0), provides very good background information on this topic. The communication between BusinessObjects Enterprise components can be categorized into three types: inbound communication to BusinessObjects Enterprise, outbound communication from BusinessObjects Enterprise, and two-way communication. Inbound Communication to BusinessObjects Enterprise Servers The communication from BusinessObjects Enterprise SDK (e.g. InfoView) and BusinessObjects Enterprise rich clients (e.g. Publishing Wizard) to BusinessObjects Enterprise servers falls under this category. For example, BusinessObjects Enterprise rich clients initiate communication to a BusinessObjects Enterprise server (i.e. service) by firstly contacting to a BusinessObjects Enterprise CMS server for a service lookup. The BusinessObjects Enterprise CMS server sends back a piece of location information containing the service s hostname (or FQDN) or IP address plus its port number. The BusinessObjects Enterprise rich clients then rely on this location information to communicate with the BusinessObjects Enterprise server (i.e. service). NOTE: BusinessObjects Enterprise clients and servers use CORBA to communicate with each other. The location information containing the hostname or IP address plus the port number is called Interoperable Object Reference (IOR) in CORBA world SAP AG 6

7 One of the keys to work with NATs is always choosing a hostname instead of its internal IP address as part of the location information. In addition, at both inside and outside of the NAT network, the same hostname should be resolved to correct IP addresses which are determined by the type and the topology of the NAT. The diagram below shows an example with a single Type A NAT. At inside, the hostname (of BusinessObjects Enterprise Servers) is mapped to an internal IP address (d). At outside, it is mapped to an external IP address (b), the external IP address of the NAT. In reality, the mapping could be implemented via DNS, WINS, or hosts file. maps to Outbound Communication from BusinessObjects Enterprise Servers BusinessObjects Enterprise servers initiate communication with other parties, e.g. database servers (BusinessObjects Enterprise servers do not initiate communication with the web application server, or with any client applications.) Outbound communication is smoother through NATs unless other parties enforce to carry and use their internal non-routable IP addresses in the communications. The BusinessObjects Enterprise server doesn t pass location information to other parties to talk back. The diagram below shows an example with a single Type A NAT. No special hostname mapping is required for the BusinessObjects Enterprise server. However, on the outside, the database server has to be mapped to its external IP address (b). Two-way Communication When a BusinessObjects Enterprise server talks to another BusinessObjects Enterprise server, it is usually a two-way communication. Both servers need to initiate connections to each other. This implies that each BusinessObjects Enterprise server has to pass its location information to the other. Hostname mapping is required for BusinessObjects Enterprise servers on both sides of the NAT. The diagram below shows an example with a single Type B NAT. On the inside, the hostname1 (for BusinessObjects Enterprise Server1) is mapped to an internal IP address (d) and hostname2 (for BusinessObjects Enterprise Server2) is mapped to the NAT s internal IP address (c). On the outside, hostname1 is mapped to the NAT s external IP address (b) and hostname2 is mapped to an external IP address (a) SAP AG 7

8 maps to maps to maps to NAT types and BusinessObjects Enterprise Communication When considering NAT types with communications between BusinessObjects Enterprise components, Type A, B, C and D NATs all work with the three ways in which BusinessObjects Enterprise communicates inbound, outbound, and two-way communications. However, where the hostname is mapped to should be considered carefully. Type A NAT: For inbound and two-way communications, extra hostname mapping (of S) is required on the outside part and the hostname is mapped to b. Type B NAT: For inbound communication, an extra hostname mapping (of S) is required on the outside part and the hostname is mapped to b. For outbound communication, an extra hostname mapping (of L) is required on the inside part and the hostname is mapped to c. For two-way communications, both mappings are required. Type C NAT: For outbound and two-way communications, an extra hostname mapping (of L) is required on the inside part and the hostname is mapped to c. Type D NAT: No extra hostname mapping is required. NAT Chains The discussion above outlined the basic NAT types. In reality, it is very common that multiple NATs are cascaded together to form a chain of firewalls to secure BusinessObjects Enterprise servers. Theoretically, BusinessObjects Enterprise supports NAT chains of any combination of the four NAT types discussed; however, the complexity is increased dramatically as the number of firewalls increases. This section looks at a few NAT chains. Below is a simple NAT chain composed of a row of Type A NATs. In this network, IP address a is routable to all network segments so that address a can traverse the entire path. The diagram considers only inbound communication. Hostname (of BusinessObjects Enterprise Servers) is mapped to the appropriate IP address at each segment this ensures that BusinessObjects Enterprise Rich Clients at each segment be able to communicate to the BusinessObjects Enterprise servers correctly SAP AG 8

9 A row of Type B NATs presents a similar situation. Again, the diagram below considers only inbound communication. Although none of the IP addresses is routable to any other segments, hostnames (of BusinessObjects Enterprise Servers) still traverse the entire network and have to be mapped to the appropriate IP addresses at each segment to ensure that BusinessObjects Enterprise Rich Clients at each segment be able to communicate to the BusinessObjects Enterprise servers correctly. A row of Type C NATs shows a different situation. Still, the diagram below considers only inbound communication. Because IP address n is routable to all network segments, the hostname is mapped to IP address n at all segments. Usually, this should have been done through default DNS configuration, so no extra hostname mapping is required. The diagram below still shows the hostname mapping but just for clarification SAP AG 9

10 As a final example, the diagram below illustrates a complex chain of mixed type NATs denoted as CABBACC. Although it looks like very complex, it is straightforward to analyze because it is just composed of the basic NAT types discussed previously. As usual, it considers only inbound communication. One thing to notice is that the same hostname (of BusinessObjects Enterprise Servers) is mapped to different IP addresses at different network segments. Summary NAT Networks can be built as complex as one can imagine. The list below summarizes some general analyzing rules discussed in this paper by which one can simplify his situation: 1. Determine each NAT type. 2. Determine if it is inbound, outbound, or two-way communication. Two-way communication can be thought as two inbound communications. Consider one at a time. 3. Determine if source/destination address translation occurs at each network segment when traversing the path based on the NAT types. 4. Determine where hostname is mapped to for each network segment. The hostname must be mapped so that each segment can route to the correct BusinessObjects Enterprise server SAP AG 10

11 Related Content BusinessObjects Enterprise Community BusinessObjects Enterprise XI 3.0 Administrator's Guide BusinessObjects XI 3.1 Webinar - What's New 2009 SAP AG 11

12 Copyright 2009 SAP AG. All rights reserved. No part of this publication may be reproduced or transmitted in any form or for any purpose without the express permission of SAP AG. The information contained herein may be changed without prior notice. Some software products marketed by SAP AG and its distributors contain proprietary software components of other software vendors. Microsoft, Windows, Outlook, and PowerPoint are registered trademarks of Microsoft Corporation. IBM, DB2, DB2 Universal Database, OS/2, Parallel Sysplex, MVS/ESA, AIX, S/390, AS/400, OS/390, OS/400, iseries, pseries, xseries, zseries, System i, System i5, System p, System p5, System x, System z, System z9, z/os, AFP, Intelligent Miner, WebSphere, Netfinity, Tivoli, Informix, i5/os, POWER, POWER5, POWER5+, OpenPower and PowerPC are trademarks or registered trademarks of IBM Corporation. Adobe, the Adobe logo, Acrobat, PostScript, and Reader are either trademarks or registered trademarks of Adobe Systems Incorporated in the United States and/or other countries. Oracle is a registered trademark of Oracle Corporation. UNIX, X/Open, OSF/1, and Motif are registered trademarks of the Open Group. Citrix, ICA, Program Neighborhood, MetaFrame, WinFrame, VideoFrame, and MultiWin are trademarks or registered trademarks of Citrix Systems, Inc. HTML, XML, XHTML and W3C are trademarks or registered trademarks of W3C, World Wide Web Consortium, Massachusetts Institute of Technology. Java is a registered trademark of Sun Microsystems, Inc. JavaScript is a registered trademark of Sun Microsystems, Inc., used under license for technology invented and implemented by Netscape. MaxDB is a trademark of MySQL AB, Sweden. SAP, R/3, mysap, mysap.com, xapps, xapp, SAP NetWeaver, and other SAP products and services mentioned herein as well as their respective logos are trademarks or registered trademarks of SAP AG in Germany and in several other countries all over the world. All other product and service names mentioned are the trademarks of their respective companies. Data contained in this document serves informational purposes only. National product specifications may vary. These materials are subject to change without notice. These materials are provided by SAP AG and its affiliated companies ("SAP Group") for informational purposes only, without representation or warranty of any kind, and SAP Group shall not be liable for errors or omissions with respect to the materials. The only warranties for SAP Group products and services are those that are set forth in the express warranty statements accompanying such products and services, if any. Nothing herein should be construed as constituting an additional warranty. These materials are provided as is without a warranty of any kind, either express or implied, including but not limited to, the implied warranties of merchantability, fitness for a particular purpose, or non-infringement. SAP shall not be liable for damages of any kind including without limitation direct, special, indirect, or consequential damages that may result from the use of these materials. SAP does not warrant the accuracy or completeness of the information, text, graphics, links or other items contained within these materials. SAP has no control over the information that you may access through the use of hot links contained in these materials and does not endorse your use of third party web pages nor provide any warranty whatsoever relating to third party web pages. Any software coding and/or code lines/strings ( Code ) included in this documentation are only examples and are not intended to be used in a productive system environment. The Code is only intended better explain and visualize the syntax and phrasing rules of certain coding. SAP does not warrant the correctness and completeness of the Code given herein, and SAP shall not be liable for errors or damages caused by the usage of the Code, except if such damages were caused by SAP intentionally or grossly negligent SAP AG 12