Configuring Database Firewall for Databases That Use Native Network Encryption

Learn about monitoring native network encrypted traffic for Oracle Database.

You can monitor native network encrypted traffic for Oracle Database to obtain the name of the database user, operating system, and client program that originated a SQL statement, if this information is not available from the network traffic. This information is then made available in the reports.

Note: In order to fetch the session information successfully, the target database should have configuration to do a reverse DNS lookup under certain cases where client machine is a Windows instance or uses network host names.

To configure monitoring of native network encrypted traffic for Oracle Database, follow the steps in this section.

Step 1: Run the Oracle Advance Security Integration Script

Learn how to run the Oracle Advance Security integration script.

To run the Network Encryption integration script:

Download and uncompress the integration script:
1. Log in to Oracle Database Security Central Console as an administrator.
2. Select Targets.
3. Select Target Setup Script to download the integration script.
4. Move the downloaded .zip file to a location of your choice.
5. In this location, go to the oracle_user_privilege_scripts directory and extract the advanced_security_integration.sql file into a separate directory.
The directory now contains the uncompressed file: advanced_security_integration.sql.
Only perform this step if Database Vault is enabled on the target database.

If Database Vault is not enabled then the script you run in the following step creates the users.
1. Connect to the target database as a Database Vault Account Manager
2. Create a user:
```
CREATE USER <username> IDENTIFIED BY <password>
```
  The username and password created here will be used as <param1> and <param2>, respectively, in the following step when running the advanced_security_integration script.
3. Create an avsys user:
  - If your database is 18c or later:
```
CREATE USER avsys NO AUTHENTICATION ACCOUNT LOCK DEFAULT TABLESPACE SYSAUX;
```
  - If your database is older than 18c:
```
CREATE USER avsys IDENTIFIED BY VALUES 'S:100000000000000000000000000000000000000000700000000000000000' PASSWORD EXPIRE ACCOUNT LOCK DEFAULT TABLESPACE SYSAUX;
```
Run the following command as a user with privileges to create users and grant privileges.

sqlplus / as sysdba @advanced_security_integration <param1> <param2> <param3>

where <param1> is the schema or username

<param2> is the password to be set for the username

<param3> valid values are ASO and SESSION_INFO

(Recommended) Use ASO if you want to monitor native network encrypted traffic and fetch session information that is not captured from traffic.

Use SESSION_INFO if the traffic is plain text and you just want to retrieve session information like username, OS username, client program name, and so on.
Note:

The third parameter (<param3>) is mandatory. In case it is missed, the system prompts with a help message.

In case value of the third parameter (<param3>) is incorrect, the following help message is displayed:
```
Invalid value is provided for <param3>

The valid values are ASO, SESSION_INFO.

ASO retrieves oracle native network encryption key and session information

SESSION_INFO retrieves session information
```

Step 2: Provide the Database Firewall Public Key to Oracle Database

Learn how to provide Database Firewall public keys to Oracle Database.

In order to decrypt traffic using native network encrypted traffic for Oracle Database, you must provide the Database Firewall public key.

To provide the public key to the Oracle Database:

Log in to the Oracle Database Security Central console as administrator.
Select Database Firewall.
Select specific Database Firewall instance from the list.
Select Oracle Native Encryption under Configuration section.
Select Copy Key to copy the public key and paste it into a text file. For example, dbfw_public_key.txt.

Each Database Firewall has its own public key. In a case where you have Database Firewall high availability or monitoring point resiliency, when you have more than one Database Firewall monitoring this target, each Database Firewall public key must be copied and appended to the dbfw_public_key.txt file.

Note: For security purposes the dbfw_public_key.txt file must have the same access permissions as the sqlnet.ora file on the Oracle Database server.
Modify the sqlnet.ora file in the Oracle Database to include the public key. Optionally you can require native network traffic encryption:
1. Put the file you created in the earlier step on the Oracle Database server, preferably in the same directory as the sqlnet.ora file.
2. Open the sqlnet.ora file and append the following parameters (in this example the public key file is dbfw_public_key.txt):
```
SQLNET.DBFW_PUBLIC_KEY="/path_to_file/dbfw_public_key.txt"
```
3. Save and close the sqlnet.ora file.

See Also: Oracle Database Security Guide for more information on network encryption.

Step 3: Enable Native Network Encrypted Traffic Monitoring for Oracle Database

You can enable native network encrypted traffic monitoring for Oracle Database.

Follow the procedure in Monitor Native Network Encrypted Traffic Through Database Firewall for Oracle Databases to complete the configuration for Oracle Databases that use network encryption.