Configuring the Database Firewall and Its Traffic Sources on Your Network

Learn about configuring the Database Firewall and its traffic sources on your network.

About Configuring Oracle Database Firewall and Traffic Sources On Your Network

Learn about configuring Oracle Database Firewall and its traffic sources on the network.

During your planning of the network configuration, you must decide the Database Firewall deployment type. The following are the Database Firewall deployment types:

• Monitoring (Out-of-Band)

• Monitoring (Host Monitor)

• Monitoring / Blocking (Proxy)

You may also decide to use a firewall as a traffic proxy. The network configuration is impacted by whether the Database Firewall will operate in monitoring only or will include blocking mode as well.

You will use traffic and proxy sources of a Firewall to configure monitoring points for each target database you are monitoring with that firewall.

See Also: Configuring Database Firewall Monitoring Points

Configuring Network Settings

Learn about configuring network settings (traffic sources).

The installation process applies network settings like the IP address, network mask, and so on, to a network interface card (NIC), also referred to as a management interface. It also detects and lists all NICs.

Use the following steps to change the settings for the management interface or to configure any other available NIC that can be used as a traffic source:

1. Log in to the Oracle Database Security Central console as an administrator.

2. Select Database Firewalls. The Database Firewalls in the left navigation menu is selected by default.

3. Select the specific Database Firewall instance that you want to configure. The details of the specific Database Firewall instance are displayed in the main page.

4. In the Configuration section, select Network Settings to open the Network Settings dialog.

   The Network Settings dialog lists all the details like the current network settings, proxy ports, and traffic sources (network interface cards) of the specific Database Firewall instance.

5. If the Synchronize NICs button is disabled, proceed to the next step. If the Synchronize NICs button is enabled, select it, as the AVS detects NIC name changes in the Database Firewall which must be synchronized.

   1. Select a NIC name on the Database Firewall for all the devices. If a device is no longer available on the Database Firewall and is no longer required on the AVS, select not required.

   2. After mapping each device, select Save.

6. To make changes to the IP address or the network mask, select a network interface card in the Network Interface Card column.

7. In the Network Interface Settings dialog, edit the IP Address, Network Mask, or Gateway fields as necessary. A user friendly name can also be specified for the network interface card in the Network Interface Name field.

8. Select Save.

Configuring the Database Firewall As a Traffic Proxy

You can specify multiple ports to be used as different proxy monitoring points. After you set up the Database Firewall as a traffic proxy, your database clients connect to the database by using the Database Firewall proxy IP address and port.

1. Log in to the Oracle Database Security Central console as an administrator.

2. Select Database Firewalls.

   Database Firewalls is selected in the left navigation menu by default.

3. Select the Database Firewall instance that you want to configure as a proxy.

4. In the Configuration section, select Network Settings.

5. If the Synchronize NICs button is disabled, proceed to the next step. If the Synchronize NICs button is enabled, select it, as the AVS detects NIC name changes in the Database Firewall which must be synchronized.

   1. Select a NIC name on the Database Firewall for all the devices. If a device is no longer available on the Database Firewall and is no longer required on the AVS, select not required.

   2. After mapping each device, select Save.

6. In the Network Settings dialog box, select the network interface card in the Network Interface Card (NIC) column.

7. In the Network Interface Settings dialog box, select Add in the Proxy Ports section.

8. Enter the name and port number.

   When specifying a proxy mode target, you can enter one target address, consisting of IP:port:Oracle Service Name (OSN). The OSN can be left blank, meaning that all Oracle database services at the provided IP:port will be processed.

   Note:

   If you plan to monitor more than one OSN on a target database:

   • You can use one proxy port and specify multiple OSNs on the target database that are going to be processed. Specify the OSNs in a list delimited by the “" character. For example, target1\target2\target3.

9. (Optional) To specify more than one proxy port, select Add, and enter another port name and number.

10. Select Save.

11. The traffic proxy is now available to use in the Database Firewall monitoring point.

    See Also: Configuring Database Firewall Monitoring Points