Configuring High Availability for Database Firewalls in Proxy Mode

Learn how to configure Database Firewall instances for high availability Monitoring / Blocking (Proxy) mode.

Oracle Oracle Database Security Central provides an option to set up the high availability configuration for multiple Database Firewall instances deployed in Monitoring / Blocking (Proxy) mode. These multiple instances are installed and configured independently.

Prerequisites

Install and register all Database Firewall instances that will be part of the high availability.
For each Database Firewall instance:
- The configuration of the monitoring points must be same. For example Database Firewall instances DBFW1 and DBFW2 should have the same number of monitoring points and the configuration of these monitoring points should also be the same.
- Deploy the same Database Firewall policy for a specific target. For example, deploy Database Firewall policy P1 (for target T1) on instances DBFW1 and DBFW2.

High availability configuration in proxy mode can be achieved in the following ways:

Through Client Configuration for Oracle Databases
Using DNS for Oracle and Other Database Types

Configuring High Availability for Database Firewall in Proxy Mode through Client Configuration

Learn how to configure high availability for two or more Database Firewall instances in proxy mode using the tnsnames.ora the for Oracle databases.

OCI (Oracle Call Interface) based clients use tnsnames.ora file to connect to Oracle database. The following parameters in this file should be modified as part of this configuration:

ADDRESS_LIST
CONNECT_TIMEOUT
LOAD_BALANCE

ADDRESS_LIST

Include addresses of all the Database Firewall instances in the ADDRESS_LIST. The client programs connect to the first Database Firewall instance. In case of a failed attempt, the client connects to the next instance in the order.

For example:

dbfw1=(DESCRIPTION=(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=192.0.2.1)(PORT=1111))

                                 (ADDRESS=(PROTOCOL=TCP)(HOST=192.0.2.2)(PORT=2222)))(CONNECT_DATA=(SERVICE_NAME=dbfwdb)))

where:

dbfw1 is referred to as net_service_name.

Host = 192.0.2.1 and Host = 192.0.2.2 are the IP addresses of Database Firewall instances configured for high availability.

If you are using SQLPlus* client, then use the following command:

sqlplus <username>/<password>@<net_service_name>

The SQLPlus* client attempts to connect to the first Database Firewall instance with IP 192.0.2.1. In case the first instance is down or not reachable, then the client attempts to connect to the second Database Firewall instance with IP address 192.0.2.2.

CONNECT_TIMEOUT

Use CONNECT_TIMEOUT (seconds) parameter to quickly detect if the Database Firewall instance is down.

For example:

dbfw1=(DESCRIPTION=(CONNECT_TIMEOUT=10)(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=192.0.2.1)(PORT=1111))(ADDRESS=(PROTOCOL=TCP)(HOST=192.0.2.2)(PORT=2222)))(CONNECT_DATA=(SERVICE_NAME=dbfwdb)))

The client attempts to connect to the first Database Firewall instance with IP 192.0.2.1. In case the first instance is down or not reachable, then the client waits for the duration (seconds) mentioned in the CONNECT_TIMEOUT parameter. In the above example it is 10 seconds. Next, the client attempts to connect to the second Database Firewall instance with IP address 192.0.2.2.

Note:

By default the value of CONNECT_TIMEOUT is 60 seconds.
Refer to Oracle Database Net Services Administrator's Guide for more details.

LOAD_BALANCE

Use LOAD_BALANCE parameter for client connections to connect to Database Firewall instances in a random sequence.

For example:

dbfw1=(DESCRIPTION=(ADDRESS_LIST=(LOAD_BALANCE=on)(ADDRESS=(PROTOCOL=TCP)(HOST=192.0.2.1)(PORT=1111))(ADDRESS=(PROTOCOL=TCP)(HOST=192.0.2.2)(PORT=2222)))(CONNECT_DATA=(SERVICE_NAME=dbfwdb)))

Here, clients will connect to either 192.0.2.1 or 192.0.2.2 in a random sequence.

Note:

When set to on, the LOAD_BALANCE parameter instructs clients to progress through the list of Database Firewall addresses in a random sequence. When set to off, instructs clients to try the addresses sequentially until one succeeds.
Refer to Oracle Database Net Services Administrator's Guide for more details.

Configuring High Availability for Database Firewall in Proxy Mode using DNS

Learn how to configure high availability for multiple Database Firewall instances in Monitoring / Blocking (Proxy) mode using DNS for Oracle and other database types.

Prerequisites

Install and register Database Firewall instances.
For each Database Firewall instance:
- The configuration of the monitoring points must be same. For example Database Firewall instances DBFW1 and DBFW2 should have the same number of monitoring points and the configuration of these monitoring points should also be the same.
- Deploy the same Database Firewall policy for a specific target. For example, deploy Database Firewall policy P1 (for target T1) on instances DBFW1 and DBFW2.
Client programs should be able to connect to the configured DNS server.

Setup a fully qualified Domain Name in DNS

Create a fully qualified domain name to represent IP addresses of the Database Firewall instances.
Configure the selected DNS server as the name resolution server on the client hosts.
Clients should use the fully qualified domain name in the connection string to connect to the Database Firewall instance.
For example, if you are using SQLPlus*, then follow these steps:
1. Start the SQLPlus* connection as sqlplus /nolog without the username or password.
2. Run the command: connect <username>/<password>@<fully qualified domain name>:<port/service>
DNS can be configured in one of the following ways:
1. Configure DNS to always connect to an ordered list of Database Firewall instances (for example DBFW1, DBFW2, etc). If a client is not able to connect to the first instance (DBFW1), then it attempts to connect to the second instance (DBFW2).
2. Configure DNS to use round-robin algorithm for connecting to Database Firewall instances.