Configuring Encapsulated Remote Switched Port Analyzer with Database Firewall

Learn how to configure Database Firewall when the SQL traffic is mirrored using Encapsulated Remote Switched Port Analyzer.

Encapsulated Remote Switched Port Analyzer (ERSPAN) mirrors the traffic from one or more source ports and delivers the mirrored traffic to one or more destination ports on another device.

This functionality enables the Database Firewall to interpret the SQL traffic received. This functionality is available only in Monitoring (Out of Band) deployment mode of Database Firewall.

Configuring ERSPAN with Database Firewall includes the following steps on a high level:

  1. Configuring the ERSPAN source or the switch.

  2. Configuring the Database Firewall.

Configuring the ERSPAN source or the switch includes the following steps:

  1. Configure the network device or switch to span the SQL traffic to the target databases that are being monitored.

  2. Consider the following aspects during ERSPAN configuration:

    • Avoid spanning the database response traffic unless it requires to be analyzed.

    • Avoid spanning empty TCP packets. For example, empty ACK packets.

  3. Ensure the ERSPAN traffic is directed to the appropriate network interface card (NIC) configured on the Database Firewall.

Configuring the Database Firewall for this functionality includes the following steps:

  1. Configure the Database Firewall monitoring point only in Monitoring (Out of Band) mode.

  2. List all the IP addresses and ports of the SQL traffic expected from the target databases.

    Note: For Oracle Real Application Cluster databases, this is not just the scan IP addresses. It also includes all the relevant Oracle RAC nodes.

  3. Configure the Database Firewall monitoring point. During configuration, select the NIC to which the ERSPAN traffic is forwarded.

  4. The Database Firewall does not process the ERSPAN traffic by default. It has to be enabled on the Database Firewall monitoring points. Follow these steps to enable:

    1. Log in to the Database Firewall through SSH and switch to the root user.

      See Logging In to Oracle DBSecCentral Appliances Through SSH.

    2. Change to /var/dbfw/va directory.

    3. Identify the Database Firewall monitoring point by searching for the target name configured in the Audit Vault Server. Run the following command:

      grep -lr <TARGET NAME> *

    4. Find the monitoring point number from the output which contains the name and path of the configuration file. For example: 1/etc/appliance.conf. In this example, 1 is the monitoring point number.

    5. Find the target database va number from the output as well. It will be before the monitoring point number, i.e. va/1/etc/appliance.conf

    6. Enable ERSPAN in the Database Firewall monitoring point by editing the file: /var/dbfw/va/<N>/etc/appliance.conf where N is the instance number of the monitoring point assigned to the target database and va is the target database number.

    7. In the file, edit the setting: DAM_TRAFFIC_IS_ERSPAN="0" to DAM_TRAFFIC_IS_ERSPAN="1".

    8. Save the changes.

    9. Restart the Database Firewall processes so that the new configuration comes into effect. Run the command to restart: /usr/local/dbfw/bin/dbfwctl restart

  5. Verify the ERSPAN traffic received. Access the /var/log/messages file in the Database Firewall. Navigate and locate the string ODF-10524: Encapsulated protocol detected. This string is logged when the ERSPAN traffic is first received.

Related Topics