MICROS Retail OSCAR POS Port settings

For MICROS Retail OSCAR POS, unexpected offline condition depends in most cases on firewall settings, timeout settings, no. of connected clients and network traffic between clients and server.

If there is no traffic between client and server, but the server is still online (which is a normal case since the client normally establishes connections immediately after startup), both – client and server – send so called ping requests to each other and are waiting for the corresponding response. If the response does not arrive, they declare each other as offline.

If there is a firewall between both system units, it might happen that the normal communication can be made due to firewall rules that e.g. allow access to the server via port 6100 – 6103. Nevertheless, in such a configuration, ping requests can’t pass the firewall because for these requests different ports will be used.

The port used by ping client is normally a random port (on Windows normally a port between 1000 and 5000). During connect, client and server send their own ping server ports to each other to allow the other side to ping the own ping server. However, if the ports between 1000 and 5000 are blocked by the firewall, pings won’t succeed.

Nevertheless, it is possible to solve this situation by one of three ways:

• You can allow all UDP requests to ports between 1000 and 5000 to pass the firewall. In that case, the communication will work, but it opens such a big hole in the firewall that you can also disable the firewall completely.
• You can use a firewall like the Windows firewall that allows communication through the firewall on a per-process base. In that case, port numbers are irrelevant, communication should work as expected. But you are limited to use specific firewalls that perhaps aren’t those firewalls your customer likes to use.
• You can configure Oscar process units via Oscar.ini to use specific ports for their client and ping server UDP ports to allow passing the firewall. In that case, the firewall must be opened for specific additional ports per system unit. Which ports must be opened depends on which ports are free to be used by MICROS Retail OSCAR POS and how many processes are running on the system unit because each MICROS Retail OSCAR POS process must have its own port number range. For example, if you have a demon, a server and 2 clients, you need 4 port no. ranges, if you have only a demon and a client, you need only 2 port ranges (well, since the demon uses the Oscar network only to detect its configuration during startup, it might be enough to specify only the port ranges for the other process units because it probably does not matter if  the demon is not available for ping requests, so 3 and 1 port range would be effectively enough in the described scenarios).

For auto-start process units, you can set PORTBASEUNITn entries in oscar.ini of the corresponding system unit. For login clients, you can use PORTBASEUSER_name entries in the Oscar.ini files on all system units the corresponding user may signon to Oscar. For other process units (normally the demons), you can use PORTBASEUNASSIGNED in Oscar.ini.

For details please read the documentations MICROS Retail OSCAR POS Networking Environment Variables.

You can find out which ports are free with the command "netstat  an", but you should keep in mind that ports between 1000 and 5000 may not be used because each of these ports can just been used by other processes during startup of Oscar. In the nearer past, port numbers around 54000 have been found to be free for MICROS Retail OSCAR POS in most cases, so - for example – following values may be useful in Oscar.ini for a specific configuration:

For example:

A system unit S0 with process units 1 (a client), 2 (device server), 8 (server) and 9 (demon), S1 with process unit 11 (client), 12 (another client), 18 (backup server) and 19 (demon).

A system unit S2 with process unit 21 (client) and 29 (demon).

Additionally there are two login clients, one for user user John Doe, the other for Jane Doe.

Ports 54000 -54100 are free on all 3 computers. Furthermore, cash register clients use direct communication between each other for special functions like locking / unlocking tickets.

For the example above, the following entries should exist in the corresponding Oscar.ini files and in the process unit configuration:

On S0:

Oscar.ini:

PORTBASEUNIT1=54001

PORTBASEUNIT2=54020

PORTBASEUNIT8=54040

PORTBASEUSER_john.doe=54061

PORTBASEUSER_jane.doe=54062

Process unit configuration:

Process unit 1, Fixed port number: 54000

On S1:

Oscar.ini:

PORTBASEUNIT11=54002

PORTBASEUNIT12=54021

PORTBASEUNIT18=54040

PORTBASEUSER_john.doe=54061

PORTBASEUSER_jane.doe=54062

Process unit configuration:

Process unit 11, Fixed port number: 54001

Process unit 12, Fixed port number: 54020

On S2:

Oscar.ini:

PORTBASEUNIT21=54003

PORTBASEUSER_john.doe=54061

PORTBASEUSER_jane.doe=54062

Process unit configuration:

Process unit 21, Fixed port number: 54003

After starting Oscar e.g. on S0, you find in the output of netstat -an that several UDP ports between 54000 and 54040 are used, e.g. 54001 – 54020. The last used port depends on some program-internal settings and might be fixed or configurable. However, it is sure that the ping server port is always one of the first 4 of these ports.

Depending on whether outgoing and incoming or only incoming ports will be blocked by the firewall, it is necessary to define exceptions in the firewall for all these ports or at least for the first 4 ports.

Recommendation:

• If you use attribute Fixed port number in process unit configuration to avoid usage of a random port between 1000 and 5000, you should use that port + 1 as port base in Oscar.ini for that process. This reduces necessary firewall rules.
• Specify PORTBASEUSER_ entries on as few system units as possible (best: on only one system unit) because this is a security leak on all system units where no login client is running.
• Give all login clients the same PORTBASEUSER_ entries and the same Fixed port number entries if only one user may be logged in at the same time on each system unit. If our customer is working with system units where multiple users can be signed on at the same time, different entries will be necessary on these system units, making them less secure.
• Allow only those ports to pass the firewall that are used after you started Oscar. For example, if you configure Fixed port number 54000 and PORTBASEUNITn=54001 for system unit n, and after starting Oscar, you see that UDP ports 54000 – 54008 are in use, following firewall configurations are bad:
  
  
• Firewall open for ports 54000 – 54008 TCP and UDP: This allows any unauthorized software to pass the firewall through ports 54000-54008 TCP
• Firewall open for ports 54000 – 54010 UDP: This allows any unauthorized software to pass the firewall through ports 54009-54010 UDP

---

MICROS Retail Deutschland GmbH
Salzufer 8
D-10587 Berlin