Configuring High Availability for Database Firewalls

Learn how to manage, configure, switch roles, and unpair a Database Firewall pair.

High Availability for Database Firewall

Learn about high availability in Database Firewall.

High availability in Database Firewall ensures uninterrupted network event monitoring in the event of network or Database Firewall failure. It also ensures that the corporate security policies for monitoring the database targets are enforced at all times.

High availability for Database Firewall can be accomplished in the following two ways:

1. A pair of Database Firewall instances in Monitoring (Host Monitor) or Monitoring (Out of Band) modes.

2. Multiple Database Firewall instances operating in Monitoring/Blocking (Proxy) mode.

Prerequisite

First, create the Database Firewall instances and register them in the Oracle Database Security Central console. Afterward, configure these instances for high availability to ensure system resilience. Later, create monitoring points, register targets, and define policies for the Database Firewall instances configured for high availability.

Database Firewall instances can be paired with existing monitoring points in Monitoring (Host Monitor) or Monitoring (Out of Band) modes. See Configuring High Availability of Database Firewall Instances With Monitoring Points for more information.

High Availability in Monitoring (Host Monitor) Or Monitoring (Out of Band) Modes

In this configuration:

• High availability (primary and standby) is configured through Audit Vault Server.

• In case of Monitoring (Host Monitor) mode, the Host Monitor Agent is configured to capture and forward the traffic to the primary and standby Database Firewall instances.

• In case of Monitoring (Out of Band) deployment mode, the network switch is configured to mirror and forward the traffic to both the primary and standby Database Firewall instances.

• The configuration of targets, monitoring points, and policies is automatically applied to the primary and standby Database Firewall instances by Audit Vault Server.

The Audit Vault Server collects network events from the primary or standby Database Firewall instance. If the Audit Vault Server is unable to contact the primary Database Firewall for a specified period of time (default of 10 minutes), then the Audit Vault Server collects the network events from the standby Database Firewall. The Audit Vault Server deletes the network events from both instances of Database Firewall after storing the data in the Audit Vault Server repository.

High Availability in Monitoring/Blocking (Proxy) Mode

Database Firewall instances deployed in Monitoring/Blocking (Proxy) mode can be configured for high availability in the following ways:

1. Active (primary) and passive (standby)

2. Active and active

In active and passive configuration:

• Client programs are configured to connect to the primary Database Firewall instance. If the primary Database Firewall instance is not reachable or is down, then they connect to the standby.

• Audit Vault Server collects the network events from the Database Firewall instance (either active or passive) that receives the traffic.

In active and active configuration:

• Multiple Database Firewall instances can be part of this configuration.

• Client programs can connect to any of the active Database Firewall instances that are part of this configuration.

• Once a client establishes a session with an active Database Firewall instance, it communicates with the same instance throughout the session.

• Audit Vault Server collects the network events from all the active Database Firewall instances that are part of this configuration.

Related Topics

• Configuring Database Firewall

• Specifying the Audit Vault Server Certificate and IP Address

High Availability for Database Firewall in Host Monitor Agent or Out of Band Modes

Learn how to configure a Database Firewall high availability pair in Host Monitor Agent or Out of Band modes.

Prerequisites

• Register both of the Database Firewall instances in the Oracle Database Security Central console.

• If you have Audit Vault Servers in high availability mode, then you must provide the primary and standby Audit Vault Server’s IP address and certificate to each Database Firewall instance during registration.

• Pairing of Database Firewall instances with existing monitoring points is possible.

  1. Log in to the Oracle Database Security Central console as an administrator.

  2. Select Database Firewalls.

  3. In the left navigation menu, select High Availability.

  4. Select Create.

  5. In the Create Resilient Pair dialog, select the Database Firewall instances for Primary and Standby fields from the drop down list.

  6. Select Save.

  7. The pairing process of the Database Firewall instances is a background job. See the Jobs dialog in the Oracle Database Security Central console to check the status of high availability pairing. Locate for the job against the entry Create DBFW resilient pair. After completion of the pairing process, navigate to the Database Firewalls and then to High Availability in left navigation menu to verify the resilient pair.

Swapping Roles Between Primary and Standby Database Firewalls

Learn to swap the roles of primary and standby Database Firewall instances in a high availability.

1. Log in to the Oracle Database Security Central console as an administrator.

2. Select Database Firewalls.

3. In the left navigation menu, select High Availability.

4. Select the specific pair for which you want to swap roles.

5. Select Swap .

6. In the confirmation dialog, select OK.

   Note:

   In case of Database Firewall configured for high availability, the settings must be the same for all the Database Firewall instances. In the event of a failover, the standby Database Firewall instance becomes the primary. The SYSLOG settings on the standby Database Firewall instance are in effect. In this case, some SYSLOG settings and logging is turned off. This is done to avoid duplicate logs sent by both the instances.

   When the previous primary becomes active again, there is no transfer or sharing of settings between the Database Firewall instances. Manual modification of the rsyslog.conf must be avoided as any changes result in erasing the settings during the following failover. The actual saved values in the SYSLOG settings should not be changed on failover.

Unpair Primary and Standby Database Firewalls

Learn to unpair Database Firewall instances in high availability.

1. Log in to the Oracle Database Security Central console as an administrator.

2. Select Database Firewalls.

3. In the left navigation menu, select High Availability.

4. Select the specific pair of Database Firewalls that you want to unpair.

5. Select Unpair.

Configuring High Availability of Database Firewall Instances With Monitoring Points

Learn how to configure high availability in Database Firewall instances with monitoring points.

If there are monitoring points on the designated primary Database Firewall instance or on the standby instance, or on both, they can be paired. The existing monitoring points on the designated primary instance are replicated on the standby Database Firewall instance after pairing. Likewise, the existing monitoring points of the designated standby Database Firewall instance are replicated on the primary instance after pairing. The monitoring points are shared between the resilient pair.

If a target has monitoring points on both the Database Firewall instances, the configuration data of the monitoring points is merged. The data on the primary instance takes precedence.

Note:

Database Firewall instances can be paired with existing monitoring points in Monitoring (Host Monitor) or Monitoring (Out of Band) modes. This is not supported for Database Firewall instances deployed in Monitoring/Blocking (Proxy) mode. An error is displayed if an attempt is made to pair Database Firewall instances deployed in Monitoring/Blocking (Proxy) mode with existing monitoring points.

Unable to create resilient pair in Monitoring/Blocking(Proxy) mode.

1. Log in to the Oracle Database Security Central console as an administrator.

2. Select Database Firewalls.

3. In the left navigation menu, select High Availability.

4. Select Create.

5. In the Create Resilient Pair dialog, select the Database Firewall instances for Primary and Standby fields from the drop down list.

6. Select Save.

7. If there are monitoring points on the both the Database Firewall instances, the following a confirmation message is displayed:

   Pairing will merge settings of both monitoring points. Do you wish to continue?

8. Select OK to continue.

9. The following message is displayed:

   Request submitted successfully.

10. The pairing process of the Database Firewall instances is a background job. See the Jobs dialog to check the status of high availability pairing. Locate for the job against the entry Create DBFW resilient pair. After completion of the pairing process, navigate to the Database Firewalls and then to High Availability in left navigation menu to verify the resilient pair.