OEM 24ai Configure OMS to listen on specific IP address instead of all IP addresses

Oracle Enterprise Manager (OEM) has a couple of ports always listening on all IPs. The IP configuration with WebLogic and OHS does not take into effect. It means you cannot change listening IP by configuring WebLogic or OHS.

These ports include,

   OEM Upload Http Port - default 4889

   OEM Upload Http SSL Port - default 4903

   OEM Central Console Http Port - default 7788

   OEM Central Console Http SSL Port - default 7799

Current port configuration can be found with following commands,

   emctl get property -name oracle.sysman.emSDK.svlt.ConsoleServerPort

   emctl get property -name oracle.sysman.emSDK.svlt.ConsoleServerHTTPSPort

   emctl get property -name oracle.sysman.emSDK.svlt.EMConsoleServerPort

   emctl get property -name oracle.sysman.emSDK.svlt.EMConsoleServerHTTPSPort

For example,

[oracle@host01]$ emctl get property -name oracle.sysman.emSDK.svlt.ConsoleServerPort
Oracle Enterprise Manager 24ai Release 1
Copyright (c) 1996, 2024 Oracle Corporation.  All rights reserved.
SYSMAN password:
Value for property oracle.sysman.emSDK.svlt.ConsoleServerPort for oms host01.dbaplus.ca:4889_Management_Service is 4889

[oracle@host01]$ emctl get property -name oracle.sysman.emSDK.svlt.ConsoleServerHTTPSPort
Oracle Enterprise Manager 24ai Release 1
Copyright (c) 1996, 2024 Oracle Corporation.  All rights reserved.
SYSMAN password:
Value for property oracle.sysman.emSDK.svlt.ConsoleServerHTTPSPort for oms host01.dbaplus.ca:4889_Management_Service is 4903
[oracle@host01]$

[oracle@host01]$ emctl get property -name oracle.sysman.emSDK.svlt.EMConsoleServerPort
Oracle Enterprise Manager 24ai Release 1
Copyright (c) 1996, 2024 Oracle Corporation.  All rights reserved.
SYSMAN password:
Value for property oracle.sysman.emSDK.svlt.EMConsoleServerPort for oms host01.dbaplus.ca:4889_Management_Service is 7788

[oracle@host01]$ emctl get property -name oracle.sysman.emSDK.svlt.EMConsoleServerHTTPSPort
Oracle Enterprise Manager 24ai Release 1
Copyright (c) 1996, 2024 Oracle Corporation.  All rights reserved.
SYSMAN password:
Value for property oracle.sysman.emSDK.svlt.EMConsoleServerHTTPSPort for oms host01.dbaplus.ca:4889_Management_Service is 7799

Check listening IP with command ss or netstat,

    ss -ltunp | grep -Ei '4890|4903|7788|7799|Netid|State'

For example,

[oracle@host01]$ ss -ltunp | grep -Ei '4889|4903|7788|7799|Netid|State'
Netid State  Recv-Q Send-Q  Local Address:Port  Peer Address:Port  Process
tcp   LISTEN 0      4096                *:7788             *:*    users:(("java",pid=18031,fd=25))
tcp   LISTEN 0      4096                *:7799             *:*    users:(("java",pid=18031,fd=27))
tcp   LISTEN 0      4096                *:4903             *:*    users:(("java",pid=18031,fd=29))
tcp   LISTEN 0      4096                *:4889             *:*    users:(("java",pid=18031,fd=28))

OEM is listening on all IPs (*) with these four ports.

In order to have OEM listen on specific IP instead of all IPs, we need to add "bindHost" directive to OEM API Gateway (apigateway) configuration file "em.conf". The file can be found from 

    <MiddleWare_Home>/ext_oms_home/apigateway/conf/server-config

Here, <MiddleWare_Home> is directory you entered while installing OEM management service (OMS). Installer creates two directories under <MiddleWare_Home>: oms_home and ext_oms_home.

As of 24ai Release Update 10, em.conf does not include any entries to configure listening IP. In order to let OEM only listen on specific IP instead of all IP addresses. We need add "bindHost" directive to each application connector.

OEM 24ai Release Update 10 original em.conf defines four application connectors,

applicationConnectors: [{
    type: http,
    port: ${EM_CONSOLE_HTTP_PORT},
    useDateHeader : ${USE_DATE_HEADER},
    httpCompliance: ${HTTP_COMPLIANCE},
    idleTimeout : ${IDLE_TIMEOUT} seconds
  },
  {
    type: "sso-https",
    port: ${EM_CONSOLE_HTTPS_PORT},
    keyStorePath: ${EM_CONSOLE_KEYSTORE_PATH},
    keyStoreType: ${KEYSTORE_TYPE},
    supportedProtocols: ${SUPPORTED_PROTOCOLS},
    supportedCipherSuites:${SUPPORTED_CIPHER_SUITES},
    excludedCipherSuites : [""],
    useDateHeader : ${USE_DATE_HEADER},
    httpCompliance: ${HTTP_COMPLIANCE},
    idleTimeout : ${IDLE_TIMEOUT} seconds
  },
  {
    type: http,
    port: ${EM_UPLOAD_HTTP_PORT},
    useDateHeader : ${USE_DATE_HEADER},
    httpCompliance: ${HTTP_COMPLIANCE},
    idleTimeout : ${IDLE_TIMEOUT} seconds
  },
  {
    type: "sso-https",
    port: ${EM_UPLOAD_HTTPS_PORT},
    keyStorePath: ${EM_UPLOAD_KEYSTORE_PATH},
    keyStoreType: ${KEYSTORE_TYPE},
    supportedProtocols: ${SUPPORTED_PROTOCOLS},
    supportedCipherSuites:${SUPPORTED_CIPHER_SUITES},
    excludedCipherSuites : [""],
    useDateHeader : ${USE_DATE_HEADER},
    httpCompliance: ${HTTP_COMPLIANCE},
    idleTimeout : ${IDLE_TIMEOUT} seconds
  }
]

Suppose to listen on IP 10.1.1.28, new connectors as following,

applicationConnectors: [{
  type: http,
  port: ${EM_CONSOLE_HTTP_PORT},
  bindHost: "10.1.1.28",
  useDateHeader : ${USE_DATE_HEADER},
  httpCompliance: ${HTTP_COMPLIANCE},
  idleTimeout : ${IDLE_TIMEOUT} seconds
},
  {
    type: "sso-https",
    port: ${EM_CONSOLE_HTTPS_PORT},
    bindHost: "10.1.1.28",
    keyStorePath: ${EM_CONSOLE_KEYSTORE_PATH},
    keyStoreType: ${KEYSTORE_TYPE},
    supportedProtocols: ${SUPPORTED_PROTOCOLS},
    supportedCipherSuites:${SUPPORTED_CIPHER_SUITES},
    excludedCipherSuites : [""],
    useDateHeader : ${USE_DATE_HEADER},
    httpCompliance: ${HTTP_COMPLIANCE},
    idleTimeout : ${IDLE_TIMEOUT} seconds
  },
  {
    type: http,
    port: ${EM_UPLOAD_HTTP_PORT},
    bindHost: "10.1.1.28",
    useDateHeader : ${USE_DATE_HEADER},
    httpCompliance: ${HTTP_COMPLIANCE},
    idleTimeout : ${IDLE_TIMEOUT} seconds
  },
  {
    type: "sso-https",
    port: ${EM_UPLOAD_HTTPS_PORT},
    bindHost: "10.1.1.28",
    keyStorePath: ${EM_UPLOAD_KEYSTORE_PATH},
    keyStoreType: ${KEYSTORE_TYPE},
    supportedProtocols: ${SUPPORTED_PROTOCOLS},
    supportedCipherSuites:${SUPPORTED_CIPHER_SUITES},
    excludedCipherSuites : [""],
    useDateHeader : ${USE_DATE_HEADER},
    httpCompliance: ${HTTP_COMPLIANCE},
    idleTimeout : ${IDLE_TIMEOUT} seconds
  }
]

After saving em.conf, restart oms with commands

  emctl stop oms -all

  emctl start oms

Make sure -all option be used for stopping oms. After OMS is up, verify the listening IP,

[oracle@host01]$ ss -ltunp | grep -Ei '4889|4903|7788|7799|Netid|State'
Netid State  Recv-Q Send-Q         Local Address:Port Peer Address:Port  Process
tcp   LISTEN 0      4096    [::ffff:10.1.1.28]:4889            *:*     users:(("java",pid=158072,fd=28))
tcp   LISTEN 0      4096    [::ffff:10.1.1.28]:4903            *:*     users:(("java",pid=158072,fd=29))
tcp   LISTEN 0      4096    [::ffff:10.1.1.28]:7799            *:*     users:(("java",pid=158072,fd=27))
tcp   LISTEN 0      4096    [::ffff:10.1.1.28]:7788            *:*     users:(("java",pid=158072,fd=25))