Database Firewall AVCLI Commands
The AVCLI Database Firewall commands enable you to configure the Database Firewall.
About the Database Firewall AVCLI Commands
The AVCLI database firewall commands enable you to perform tasks such as registering or altering a database firewall.
ALTER FIREWALL
Use the ALTER FIREWALL command to alter Oracle Database Firewall attributes.
The ALTER FIREWALL command alters the Database Firewall attributes.
Syntax
ALTER FIREWALL <firewall_name> SET <attribute>=value [, <attribute>=value]Arguments
| Argument | Description |
|---|---|
<firewall_name> |
The name of the Database Firewall. |
<attribute> |
The pair (attribute and new value) for the Database Firewall. Separate multiple pairs by a space on the command line. See Table A-4 for a list of attributes. |
Usage Notes
Table A-4 lists Database Firewall attributes that you can specify for the attribute=value argument.
Table 4 Oracle Database Firewall Attributes
| Parameter | Description |
|---|---|
NAME |
The new name of the Database Firewall. |
IP |
The IP address of the Database Firewall. |
CERTIFICATE_FIREWALL |
SHA-256 certificate fingerprint for Database Firewall trust confirmation. Required when changing the firewall IP address. |
Examples
avcli> ALTER FIREWALL sample_fw1 SET NAME=sample_newfw1;Database Firewall name changes from sample_fw1 to sample_newfw1.
avcli> ALTER FIREWALL sample_fw1 SET IP=192.0.2.169,CERTIFICATE_FINGERPRINT=001122...;avcli> ALTER FIREWALL sample_fw1 UPDATE CERTIFICATE FINGERPRINT 001122...Database Firewall IP address is set to 192.0.2.169.
CREATE RESILIENT PAIR
Use the CREATE RESILIENT PAIR command to create a resilient pair with two Oracle Database Firewall installations for high availability.
The CREATE RESILIENT PAIR command creates a resilient pair with two Database Firewalls for high availability.
Syntax
CREATE RESILIENT PAIR FOR FIREWALL PRIMARY <primary_firewall>
STANDBY <standby_firewall>Arguments
| Argument | Descriptions |
|---|---|
<primary_firewall> |
The name of the primary Database Firewall. Only this Firewall can generate syslog alerts |
<standby_firewall> |
The name of the standby Database Firewall. |
The pairing process of the Database Firewall instances is a background job. See the Jobs dialog in the Oracle Database Security Central console to check the status of high availability pairing. Locate for the job against the entry Create DBFW resilient pair. After completion of the pairing process, navigate to the Database Firewalls and then to High Availability in left navigation menu to verify the resilient pair.
Example
avcli> CREATE RESILIENT PAIR FOR FIREWALL PRIMARY sample_fw1 STANDBY sample_fw2;A resilient pair is created with primary Database Firewall sample_fw1 and standby Database Firewall sample_fw2.
DROP FIREWALL
Use the DROP FIREWALL command to drop a registered Oracle Database Firewall from Oracle Audit Vault Server.
The DROP FIREWALL command drops an already registered Database Firewall from the Audit Vault Server.
Syntax
DROP FIREWALL <firewall_name>Arguments
| Argument | Descriptions |
|---|---|
<firewall_name> |
The name of the Database Firewall. |
Example
avcli> DROP FIREWALL sample_fw;The Database Firewall sample_fw is dropped.
DROP RESILIENT PAIR
Learn to use the DROP RESILIENT PAIR command to drop a resilient pair that contains the specified Oracle Database Firewall.
The DROP RESILIENT PAIR command drops the resilient pair that contains the specified Database Firewall.
Syntax
DROP RESILIENT PAIR HAVING FIREWALL <firewall_name>Arguments
| Argument | Descriptions |
|---|---|
<firewall_name> |
The name of the Database Firewall. |
Example
avcli> DROP RESILIENT PAIR HAVING FIREWALL sample_fw1;The existing resilient pair that includes Database Firewall sample_fw1 is broken.
LIST FIREWALL
Use the LIST FIREWALL command to list all of the Oracle Database Firewall installations that are registered with an Oracle Audit Vault Server.
The LIST FIREWALL command lists all the Database Firewalls registered with the Audit Vault Server.
Syntax
LIST FIREWALLExample
avcli> LIST FIREWALL;A list of Oracle Database Firewalls that are registered with Oracle Audit Vault Server appears.
POWEROFF FIREWALL
You can use the POWEROFF FIREWALL command to turn off the power for a named Oracle Database Firewall that is registered with Oracle Audit Vault Server.
The POWEROFF FIREWALL command powers off a named Database Firewall that is already registered with the Audit Vault Server.
Syntax
POWEROFF FIREWALL <firewall_name>Arguments
| Argument | Descriptions |
|---|---|
<firewall_name> |
The name of the Database Firewall. |
Example
avcli> POWEROFF FIREWALL sample_fw;The Database Firewall sample_fw switches off.
REBOOT FIREWALL
Use the REBOOT FIREWALL command to reboot a named Oracle Database Firewall that is registered with Oracle Audit Vault Server.
The REBOOT FIREWALL command reboots a named Database Firewall that is already registered with the Audit Vault Server.
Syntax
REBOOT FIREWALL <firewall_name>Arguments
| Argument | Descriptions |
|---|---|
<firewall_name> |
The name of the Database Firewall. |
Example
REBOOT FIREWALL sample_fw;The Database Firewall sample_fw reboots.
REGISTER FIREWALL
Use the REGISTER FIREWALL command to register an Oracle Database Firewall that has a specific IP address with Oracle Audit Vault Server.
The REGISTER FIREWALL command registers the Database Firewall that has the specified IP address with the Audit Vault Server.
Syntax
REGISTER FIREWALL <firewall_name> WITH IP <ip_address> CERTIFICATE FINGERPRINT <sha256_fingerprint>Example
REGISTER FIREWALL sample_fw WITH IP 192.0.2.14 CERTIFICATE FINGERPRINT AA:BB:...:99;Arguments
| Argument | Descriptions |
|---|---|
<firewall_name> |
The Database Firewall name. |
<ip_address> |
The Database Firewall IP address. |
<sha256_fingerprint> |
The Database Firewall SHA256 Fingerprint. |
Usage Notes
The Database Firewall must be installed at the given IP address location.
To specify a firewall name with a space, enclose the entire string in quotes.
Example
avcli> REGISTER FIREWALL sample_fw WITH IP 192.0.2.14 CERTIFICATE FINGERPRINT AA:BB:...:99;Database Firewall sample_fw is installed at IP address 192.0.2.14.
SWAP RESILIENT PAIR
Learn how to use the SWAP RESILIENT PAIR command to swap Oracle Database Firewall installations that are part of a resilient pair that includes a named Oracle Database Firewall.
The SWAP RESILIENT PAIR command swaps Database Firewalls in a resilient pair that includes the named Database Firewall.
Syntax
SWAP RESILIENT PAIR HAVING FIREWALL <firewall_name>Arguments
| Argument | Descriptions |
|---|---|
<firewall_name> |
The name of the Database Firewall. |
Example
avcli> SWAP RESILIENT PAIR HAVING FIREWALL sample_fw1;In the existing resilient pair, Database Firewall sample_fw1, the primary and standby firewall roles are exchanged.
SHOW STATUS FOR FIREWALL
Learn how to use the SHOW STATUS FOR FIREWALL command to show the status for an Oracle Database Firewall installation.
The SHOW STATUS command displays the status for a particular Database Firewall.
Syntax
SHOW STATUS FOR FIREWALL <firewall_name>Arguments
| Argument | Descriptions |
|---|---|
<firewall_name> |
The name of the Database Firewall. |
Example
avcli> SHOW STATUS FOR FIREWALL sample_fw1;The running information for Oracle Database Firewall sample_fw1 appears.