Workspace (RA) Hangs when Implementing Firewall

Recently, I was implementing RA through a firewall. I discovered that Workspace would hang during login.

Looking through the logs I noticed some stuck threads in the RAFrameworkWeb logs,

which is more than the configured time (StuckThreadMaxTime) of "600" seconds. Stack trace:Thread-204 "[STUCK] ExecuteThread: '12' for queue: 'weblogic.kernel.Default (self-tuning)'" <alive, in native, suspended, priority=1, DAEMON> {    java.net.PlainSocketImpl.socketConnect(PlainSocketImpl.java:???)....java.lang.Class@10a184ba[thin lock]    com.sqribe.WS.WebSQRIBE.loginToRepository(Unknown Source)

This means something is unable to connect during RA initialization. 

Checking the Windows firewall for dropped packets (after configuring logging of dropped packets)

2013-10-10 23:15:43 DROP TCP xx.xx.xx.xx xx.xx.xx.xx 5613 32631 48 S 3865585991 0 8192 - - - RECEIVE

Apparently, some higher level ports are being blocked... What is process is being blocked?

I looked further at the netstat output to see what ports were LISTENING on the node, 

Netstat -a -n -o 

  TCP    0.0.0.0:6801           0.0.0.0:0              LISTENING       9256
  TCP    0.0.0.0:6802           0.0.0.0:0              LISTENING       9256
  TCP    0.0.0.0:6803           0.0.0.0:0              LISTENING       9256
  TCP    0.0.0.0:6804           0.0.0.0:0              LISTENING       9256
  TCP    0.0.0.0:6805           0.0.0.0:0              LISTENING       9256
  TCP    xx.xx.xx.xx:30298   0.0.0.0:0              LISTENING       9256
  TCP    xx.xx.xx.xx:30332   0.0.0.0:0              LISTENING       9256
  TCP    xx.xx.xx.xx:30365   0.0.0.0:0              LISTENING       9256
  TCP    xx.xx.xx.xx:30400   0.0.0.0:0              LISTENING       9256
  TCP    xx.xx.xx.xx:30437   0.0.0.0:0              LISTENING       9256
  TCP    xx.xx.xx.xx:30472   0.0.0.0:0              LISTENING       9256
  TCP    xx.xx.xx.xx:30507   0.0.0.0:0              LISTENING       9256
  TCP    xx.xx.xx.xx:30540   0.0.0.0:0              LISTENING       9256
  TCP    xx.xx.xx.xx:30575   0.0.0.0:0              LISTENING       9256
  TCP    xx.xx.xx.xx:30611   0.0.0.0:0              LISTENING       9256

  TCP    xx.xx.xx.xx:30646   0.0.0.0:0              LISTENING       9256

There are a ton of 30k+ ports that that RA is listening on. Obviously, these are not being allowed through the firewall. The 9256 column is the PID, but also the common 6800 , 6801 ports identify this as the RA Framework Services. What is causing these higher number ports? 

Finally, after some digging in the KB,

How to Change BI+ EPM Workspace to No Longer Use Dynamic Port Allocation for Logins to Properly Configure the Firewall to Allow Connections. (Doc ID 1483777.1)

Hyperion BI+ - Version 11.1.2.0.00 to 11.1.2.2.000 [Release 11.1]

How to change BI+ EPM Workspace to no longer use dynamic port allocation for logins so you can properly configure the firewall to allow connections.

FIX

 1. Login to Workspace click  Navigate -> Administer -> R&A -> Web Applications
      Right click on Reporting and Analysis Framework Web-Application -> Select Properties -> Internal
        Change Pass Data Using Streams Instead Of Files to No -> click OK

 2. Restart RaFramework Web


Also, there is a small blurb in the EPM doc about this if you look carefully,