Check the configuration of the scan listener by doing $ srvctl config scan_listener <scan_name>
The port if you did not change shouldmbe 1521 the tns that you provide to the client should have the scan address for the host name
You have to open the firewall for both the SCAN and VIP addresses, as the SCAN listener forwards the requests to the local listeners that listens on VIPs.
