Register a Recovery Service Subnet

Use this procedure to register a Recovery Service subnet.

Note:

Before you register a Recovery Service subnet:

• Ensure to open these network ports and configure the security rules for Recovery Service.

  • Port 2484 - Enables SQL*Net connections to the RMAN catalog which is used by Recovery Service.

  • Port 8005 - Enables backup traffic from the database to Recovery Service.

• Ensure that you have reviewed and confirmed the mandatory prerequisites described in Mandatory Requirements Checklist for Recovery Service.

• Ensure that you select an IPv4-only subnet for Recovery Service operations in your database VCN. Do not select an IPv6-enabled subnet as Recovery Service does not support using an IPv6-enabled subnet.

• For Oracle Databases deployed in OCI, if your backup subnet meets the recommended subnet size (at least 12 free IP addresses), then Recovery Service automatically registers the Recovery Service subnet. If you want to replace the subnet registered by Recovery Service, use the steps described in Add or Replace Subnets for a Recovery Service Subnet.

• If you have used network security groups (NSG) to implement the security rules for Recovery Service in the database VCN, then you must add the Recovery Service NSGs (maximum five) to the Recovery Service subnet, as described in step 8. The recommended subnet size is /24.

  Recovery Service supports these Oracle Multicloud Database services:

  • Oracle AI Database@Azure

  • Oracle AI Database@Google Cloud

  • Oracle AI Database@AWS

  Network ports 2484 and 8005 enable the network connectivity between Oracle AI Database@AWS and Recovery Service. In an existing OCI tenancy, ensure to open the network ports 2484 and 8005. In a new OCI tenancy, the same networks ports are open by default for Oracle AI Database@AWS.

  When you onboard an Oracle AI Database@AWS resource to Recovery Service, the service automatically registers the backup subnet as the Recovery Service subnet. You can either use the Recovery Service subnet that is already registered by the service or use the steps provided in this section to register your own Recovery Service subnet.

• Multiple protected databases can use the same Recovery Service subnet. In order to ensure that the required number of IP addresses are available to support the Recovery Service private endpoints, you can assign multiple subnets to a Recovery Service subnet that is used by more than one protected database.

1. On the Recovery Service subnets list page, select Register Recovery Service subnet. See Listing Recovery Service Subnets for detailed steps to access the list page.

2. Enter a name for the Recovery Service subnet. Avoid entering confidential information in the Name field.

3. Verify the compartment where you want to create the Recovery Service subnet. Use the Create in compartment field to select a different compartment, if necessary.

4. Select the Compartment that contains the virtual cloud network (VCN) that you want to use. You can select a VCN from only one compartment at a time.

5. Select the virtual cloud network.

6. Under Subnets, select these options:

   1. Select the Compartment that contains the private subnet that you want to use.

   2. Select the Subnet that you have configured for Recovery Service operations in the selected VCN.

7. (Optional) Select +Another Subnet to assign an additional subnet to the Recovery Service subnet.

   If a single subnet does not contain enough IP addresses to support the Recovery Service private endpoints, then you can assign multiple subnets. See About Using a Private Subnet for Recovery Service Operations for details.

8. Expand Advanced options to configure these options:

   • Network security groups

     If you have used network security groups (NSG) to implement the security rules for Recovery Service in the database VCN, then you must add the Recovery Service NSGs (maximum five) to the Recovery Service subnet. The Recovery Service NSG can reside in the same compartment or in a different compartment. However, the NSG must belong to the same VCN to which the specified subnet belongs.

     Use these steps to add the Recovery Service NSG to the Recovery Service subnet:

     1. In the Network security groups section, select Use network security groups to control traffic.

     2. Select the Recovery Service NSG you have created in the database VCN.

     3. Select +Another network security group to associate multiple NSGs (maximum five).

   • Security attributes

     (Optional) In the Security attributes section, you can add security attributes to restrict access to the Recovery Service subnet. See Managing Security Attributes for Recovery Service Subnet for details.

     Note:

     • If you have permissions to create a resource, then you might also have permissions to add security attributes to that resource. To add a security attribute, you must have permissions to use the security attribute namespace. For more information about security attributes and security attribute namespaces, see Zero Trust Packet Routing. If you are not sure whether to add security attributes, skip this option or ask an administrator. You can add security attributes later.

     • If an endpoint has a Zero Trust Packet Routing (ZPR) security attribute, traffic to the endpoint must satisfy ZPR policies and also all NSG and security list rules. For example, if you are already using NSGs and you add a security attribute to an endpoint, all traffic to the endpoint is blocked. From then onward, a ZPR policy must explicitly allow traffic to the endpoint.

   • Tags: (Optional) Add one or more tags to the resource. If you have permissions to create a resource, then you also have permissions to apply free-form tags to that resource. To apply a defined tag, you must have permissions to use the tag namespace. For more information about tagging, see Resource Tags. If you are not sure whether to apply tags, skip this option or ask an administrator. You can apply tags later.

9. Select Register.

   Note: A Recovery Service subnet must be associated with at least one subnet belonging to your database VCN.

You can replace a subnet or add more subnets to support the required number of private endpoints. See Add or Replace Subnets for a Recovery Service Subnet for details.

See Associate NSGs to a Recovery Service Subnet for detailed steps to add NSGs to an existing Recovery Service subnet.

Related Topics

• About Recovery Service Subnets