Executive Summary

This white paper provides an end-to-end procedure for configuring an OCI public load balancer to route client traffic to an Oracle E-Business Suite (EBS) compute instance in a private subnet.

The document emphasizes practical troubleshooting considerations so that the guidance can be applied in a production environment. OCI Load Balancer distributes client traffic across backend servers, providing a highly available and scalable application entry point. The following sections describe the prerequisites, configuration steps, validation checks, and troubleshooting actions.

Prerequisites

Before configuring the load balancer, confirm that the following requirements are met:

1. An Oracle EBS instance is installed and running in a private subnet. This example uses the Oracle E-Business Suite 12.2.13 Demo Install Image from OCI Marketplace. For instructions on deploying the demo instance and performing basic administration tasks such as start, stop, and status checks, refer to the link below.

https://exploreora.blogspot.com/2026/08/how-to-use-ebs-marketplace-image-for.html

2. Because the EBS instance is in a private subnet, a jump server (bastion host) must be available in a public subnet to provide administrative SSH access to the EBS backend server.

3. Configure a security rule that permits the required traffic between the jump server subnet and the private subnet containing the EBS compute instance. Attach the rule to the EBS private subnet, and use the jump server subnet CIDR as the source.

4. Store the private key for the EBS compute instance securely on the jump server, such as under /root/.ssh, and verify SSH access with: ssh -i <path-to-private-key> <IP-or-hostname>.

Load Balancer Deployment

Step 1: Identify the EBS Ports

First, identify the ports on which the EBS application services are listening.

Connect to the EBS VM through the public jump server, and run the following commands to review the listening ports:

netstat -tulpn | grep LISTEN

netstat -tulpn | grep httpd

(Not all processes could be identified, non-owned process info

will not be shown, you would have to be root to see it all.)

tcp6 0 0 :::9999 :::* LISTEN 204489/httpd.worker

tcp6 0 0 :::8000 :::* LISTEN 204489/httpd.worker

tcp6 0 0 :::4443 :::* LISTEN 204489/httpd.worker

Validate the HTTP endpoint locally:

curl -I http://localhost:8000

HTTP/1.1 200 OK

Date: Thu, 24 Sep 2026 17:33:25 GMT

Server:

Last-Modified: Wed, 23 Sep 2026 13:35:49 GMT

ETag: "519-65c268fa91740"

Accept-Ranges: bytes

Content-Length: 1305

X-Frame-Options: SAMEORIGIN

X-Content-Type-Options: nosniff

Content-Type: text/html

Content-Language: en

Alternatively, validate the HTTPS endpoint:

curl -k https://localhost:4443

<!--

###############################################################

Do not edit settings in this file manually. They are managed

automatically and will be overwritten when AutoConfig runs.

For more information about AutoConfig, refer to the Oracle

E-Business Suite Setup Guide.

###############################################################

Template <AD_TOP>/admin/template/index.html

To customize this page, please refer to Oracle MetaLink Note 387859.1.

-->

<!-- appdet.html - this is needed to make the page pass

the Rapid Install post install check -->

<html>

<HEAD>

<TITLE>E-Business Suite Home Page Redirect</TITLE>

</HEAD>

<body>

The E-Business Home Page is located at <a href="http://myebs.regionalsub.regionalsub.oraclevcn.com:8000/OA_HTML/AppsLogin">http://myebs.regionalsub.regionalsub.oraclevcn.com:8000/OA_HTML/AppsLogin</a><br>

If your browser doesn't automatically redirect to its new location, click

<A HREF="http://myebs.regionalsub.regionalsub.oraclevcn.com:8000/OA_HTML/AppsLogin">here</A>.

</DIV>

</body>

</html>

Step 2: Prepare the Load Balancer Prerequisites

Before creating the load balancer, ensure that the following certificate-management components are available:

Ø An OCI Vault in which certificate-related keys will be protected

Ø A root certificate authority (CA)

Ø A certificate issued by the root CA

Create the Vault: The load balancer listener uses an SSL/TLS certificate and its private key to terminate encrypted client connections. It can then establish the configured connection to the authorized backend server.

In the OCI Console, navigate to Identity & Security and then Vault. Create a Vault and a master encryption key to protect the certificate key material. In this example, the master key uses the RSA algorithm with a 2,048-bit key length, as shown below.

Create the Root Certificate Authority

Under Identity & Security, select Certificate Authorities, as shown below.

Enter a meaningful common name for the certificate authority.

If Not Valid Before is left blank, the CA becomes valid immediately after creation. Select the Vault created in the preceding step. This example uses the ECDSA algorithm for the CA key.

For this test configuration, issuance rules and revocation can remain disabled. Review the settings, and then create the certificate authority. For production use, configure issuance and revocation controls in accordance with your organization’s security policy.

Create the Server Certificate

Use the root certificate authority created above to issue the certificate that will be assigned to the load balancer listener. Complete the fields shown in the OCI workflow, review the configuration, and create the certificate.

Step 3: Create the Load Balancer

From the Networking menu in the OCI Console, create a load balancer by following the workflow shown below.

In this example, websubnet is the public subnet used by the load balancer. Create this subnet before creating the load balancer.

The default bandwidth of 100 Mbps is used for this configuration.

Select the backend server from the appropriate compartment, and set the backend port to 4443 for HTTPS traffic.

Configure the health check with the protocol and port that match the endpoint being tested. The health check confirms that the load balancer can reach the backend server and receive a valid response.

Select the backend set. Although this example contains only one backend server, the network security rules must still allow traffic from the public load balancer subnet to the private subnet that hosts the backend.

On the Configure Listener page, select a Certificate Service-managed SSL certificate so that the listener can use the certificate created in the preceding steps. If you do not use an OCI-managed certificate, you must provide and manage your own certificate and private key.

Under Advanced SSL, select the certificate authority created earlier.

In the Manage Logging section, create a new log group if one does not already exist, and then complete the load balancer creation workflow.

Step 4: Configure Security Rules

Configure security rules for the following traffic flows:

1. Allow inbound client traffic from the internet to the public load balancer subnet on the listener port, and allow the required outbound traffic from the load balancer subnet to the private backend subnet.

2. Allow inbound traffic to the EBS backend from the load balancer subnet on the configured backend and health-check ports. Ensure that the corresponding outbound rules permit response traffic back to the load balancer subnet.

Attach the public-facing security rules to the load balancer subnet. In this example, the subnet is websubnet.

Next, attach the backend-facing security rules to the private subnet in which the EBS backend runs. In this example, the subnet is dbsubnet.

Validation and Troubleshooting

After completing the configuration, verify the backend health in the OCI Console. A healthy status confirms that the load balancer can reach the private EBS backend and that the configured health-check endpoint is responding.

When the load balancer’s public IP address was tested from a browser, the following timeout error occurred:myebs.regionalsub.regionalsub.oraclevcn.com took too long to respond.

ERR_CONNECTION_TIMED_OUT

The ERR_CONNECTION_TIMED_OUT message indicates that name resolution succeeded—for example, through the updated hosts file—but the browser could not establish a TCP connection to the public load balancer. This points to a routing, security-rule, firewall, or listener-access issue rather than a DNS-resolution failure.

In this case, the public load balancer subnet did not have a route to an Internet Gateway. Without that route, the subnet could not provide the required internet-facing return path.

Create or update the route table associated with the public load balancer subnet so that internet-bound traffic is routed through the Internet Gateway, as shown below. Also verify that the listener port is permitted by the applicable security rules.

After the Internet Gateway route was added and the network rules were verified, the public endpoint became reachable and the timeout error was resolved.

Explore Oracle Stuff

Sunday, September 27, 2026

Oracle E-Business Suite Load Balancer Setup in OCI