This means that receiving ORA-12529 does not necessarily mean that there is something wrong with your rules. 12529 seems to be a kind of 'catch all error' when rule filtering fails. Look for nprffilter: entry in the trace file and start reading from there. I found this:
snlinGetAddrInfo: Invalid IP address string FOO
snlinGetAddrInfo: Name resolution failed for FOO
nprffilter: Unable to resolve to IP
nsglbfok: no rule match or an error from nprffilter
(Real hostname replaced and timestamps removed). Looking for 12529 or whatever code you receive in the trace-file and start reading backwards is also an option.