Managing Security Attributes for Recovery Service Subnet

Add, update, or remove the security attributes associated with a Recovery Service subnet.

Zero Trust Packet Routing Policies and Security Attributes for Recovery Service Subnet

You can use Zero Trust Packet Routing (ZPR), along with or in place of network security groups (NSG), to manage network access to OCI resources. To do this, define ZPR policies that govern how resources communicate with each other, and then add security attributes to those resources. For more information, see Zero Trust Packet Routing.

Recovery Service requires network access on ports 2484 and 8005 to communicate with a source database. Before you assign security attributes to a Recovery Service subnet, you must write the ZPR policies required to allow the network traffic between a source database and a Recovery Service subnet on ports 2484 and 8005.

ZPR Policy Format for Recovery Service

Use this format to define the ZPR policies for Recovery Service:

in <security attribute of database VCN> VCN 
allow <security attribute of database service> endpoints to 
connect to <security attribute of recovery service> endpoints 
with protocol='tcp/2484'

in <security attribute of database VCN> VCN 
allow <security attribute of database service> endpoints to 
connect to <security attribute of recovery service> endpoints 
with protocol='tcp/8005'

Caution:

If an endpoint has a Zero Trust Packet Routing (ZPR) security attribute, traffic to the endpoint must satisfy ZPR policies and also all NSG and security list rules. For example, if you are already using NSGs and you add a security attribute to an endpoint, all traffic to the endpoint is blocked. From then onward, a ZPR policy must explicitly allow traffic to the endpoint.

After you define the ZPR policies, add the security attributes to a Recovery Service subnet.

Using the Console

In the OCI Console, follow these steps to assign the security attributes to a Recovery Service subnet.

1. On the Recovery Service subnets list, select the Recovery Service subnet that you want to work with. See Listing Recovery Service Subnets for detailed steps to access the list page.
2. On the details page, go to the Security tab, select Add security attribute, and add the following information.
   • Security attribute namespace: A security attribute namespace is a container for a set of security attributes in Zero Trust Packet Routing (ZPR).
   • Security attribute key: The name for a specific security attribute.
   • Security attribute value: The value for a specific security attribute.

     The specified values must match an existing ZPR policy.

3. Select Add security attribute to add new attributes.
4. Click Add.
5. From the Action menu of a security attribute, select Edit to update an existing attribute or select Delete to delete it.

Note:

If you have permissions to create a resource, then you might also have permissions to add security attributes to that resource. To add a security attribute, you must have permissions to use the security attribute namespace. For more information about security attributes and security attribute namespaces, see Zero Trust Packet Routing. If you are not sure whether to add security attributes, skip this option or ask an administrator. You can add security attributes later.

Using the CLI

Use the oci recovery recovery-service-subnet create command or the oci recovery recovery-service-subnet update command and required parameters to manage the security attributes for a Recovery Service subnet.

Using the API

Run the CreateRecoveryServiceSubnet or UpdateRecoveryServiceSubnet API operation to manage the security attributes for a Recovery Service subnet.