Unable to connect to EBS DB instance PROD1 from our third party client

[sriram]

Greetings Erman,

Glad that, we have setup EBS 12.2 successfully two nodes rac4 and rac5.
GRID_HOME has listener.ora that has scan listener entries.
PROD1 and PROD2  (EBS RAC DB listener entries) are present under EBS RDBMS HOME:
/u01/apps/oracle/12.1.0/network/admin/<PROD1_rac4>/listener.ora

When i connect to PROD1 using virtual ip from our third party client using "system/manager", i get the following error:

<Message>Error 0x80004005 from OraOLEDB (SQL state: , Error number: 12537): ORA-12537: TNS:connection closed</Message>
                <Message>Failed to connect to the database, using connection string "Provider=OraOLEDB.Oracle;Data Source=(DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = 10.80.51.142)(PORT = 1522))(CONNECT_DATA = (SERVICE_NAME = PROD)(SERVER=dedicated)));".</Message>
                <Message>Error 0x80004005 "ORA-12537: TNS:connection closed" occurred while attempting to access "OraOLEDB".</Message>

In the Server Side, /u01/apps/oracle/diag/tnslsnr/rac4/prod/alert/log.xml, I see the error:

TNS-12546: TNS:permission denied
TNS-12560: TNS:protocol adapter error
TNS-00516: Permission denied

Can you please let me know, why i am not able to connect as system user also who has full access to PROD1 DB or PROD2 DB?

Thanks,
Sriram

Just a Note:
I have started a listener by the cluster database service "PROD" by copying above listener.ora into EBS RDBMS HOME /u01/apps/oracle/12.1.0/network/admin

Below are the listeners running:
[oracle@rac4 PROD1_rac4]$ ps -eaf | grep tns
root        22     2  0 May27 ?        00:00:00 [netns]
oracle    3791     1  0 May27 ?        00:00:06 /u01/app/12.1.0.2/grid/bin/tnslsnr MGMTLSNR -no_crs_notify -inherit
oracle    3868     1  0 May27 ?        00:00:06 /u01/app/12.1.0.2/grid/bin/tnslsnr LISTENER -no_crs_notify -inherit
oracle    3884     1  0 May27 ?        00:00:07 /u01/app/12.1.0.2/grid/bin/tnslsnr LISTENER_SCAN2 -no_crs_notify -inherit
oracle    3896     1  0 May27 ?        00:00:07 /u01/app/12.1.0.2/grid/bin/tnslsnr LISTENER_SCAN3 -no_crs_notify -inherit
oracle    4158     1  0 May27 ?        00:00:00 /u01/apps/oracle/fs1/EBSapps/10.1.2/bin/tnslsnr APPS_PROD -inherit
oracle   13070     1  0 May27 ?        00:00:02 /u01/apps/oracle/12.1.0/bin/tnslsnr PROD -inherit

[ErmanArslansOracleBlog]

Check whether the TCP.VALIDNODE_CHECKING is active on the database server.
If active then check whether IP address of the failing client is added in the TCP.INVITED_NODES list (located in the sqlnet.ora file). If not add the same.

tcp.validnode_checking = YES
tcp.invited_nodes = ( X.X.X.X, hostname, ... )

--Note that: servers should be Application server , database server and if needed some third party application servers, or tool such as Toad -- not recommended for Production.)
These validnode checking configurations can be done using Autoconfig also..
If the profile option “SQLNet Access” (FND_SQLNET_ACCESS) is set to “ALLOW_RESTRICTED” at the Site level when AutoConfig is run on the database server, AutoConfig will add IP restrictions to sqlnet.ora.

Ref: Erman Arslan's Oracle Blog + Troubleshooting Guide for ORA-12537 / TNS-12537 TNS:Connection Closed (Doc ID 555609.1)