Database Firewall Monitors AVCLI Commands

The Database Firewall monitoring points related AVCLI commands enable you to configure the Database Firewall.

About Database Firewall Monitors AVCLI Commands

The Database Firewall monitoring points related AVCLI commands enable you to create and manage Database Firewall monitoring points for protected targets.

ALTER DATABASE FIREWALL MONITOR

Use the ALTER DATABASE FIREWALL MONITOR command to alter monitoring points and their attributes.

The ALTER DATABASE FIREWALL MONITOR command alters the monitoring point and the related attributes.

Syntax

ALTER DATABASE FIREWALL MONITOR FOR TARGET <target name> USING FIREWALL <firewall name> SET <options>

Arguments

Argument	Description
firewall name	The name of the Database Firewall which is associated with the monitoring point.
target name	The name of the target which is associated with the Database Firewall monitoring point.
options	Every option must be in format. The following attributes can be included in options: MODE=Monitoring_Blocking_Proxy / Monitoring_Out_Of_Band / Monitoring_Host_Monitor PRESERVE_CONNECTION=TRUE/FALSE NETWORK_INTERFACE_CARD=new_network_interface_card DATABASE_RESPONSE=TRUE/FALSE FULL_ERROR_MESSAGE=TRUE/FALSE DATABASE_INTERROGATION=TRUE/FALSE DDI_DB_ADDRESS = DDI_DB_PORT = DDI_DB_NAME = DDI_DB_CREDENTIAL = ADD_ADDRESS= REMOVE_ADDRESS=
ADD_ADDRESS	The address of the target which needs to be monitored by the Database Firewall. The address needs to be in the following format: ip:port:[service]
REMOVE_ADDRESS	The address of the target which needs to be removed from being monitored by the Database Firewall.
NETWORK_INTERFACE_CARD	The new network interface card (or traffic source) for the Database Firewall monitoring point. For Monitoring_Host_Monitor deployment mode, provide the name of the network interface card which has an IP address configured. For Monitoring_Out_Of_Band deployment mode, you can specify multiple network interface cards in a space separated list.
MODE	The Database Firewall deployment mode. Valid modes are: Monitoring (Out-of-Band) Monitoring (Host Monitor) Monitoring / Blocking (Proxy)
PRESERVE_CONNECTION	True or False where True indicates that when the Database Firewall starts operating in monitoring and blocking mode (either because it had been changed from monitoring only mode, or because it has restarted), any existing connections passing through the firewall are allowed to continue. This favors availability over security, because the firewall cannot enforce policy on these connections. False indicates that any pre-existing connections are broken. The Database Firewall can then enforce the policy when clients reconnect. This is the default behavior.
DATABASE_RESPONSE	True or False indicates whether or not to activate database response monitoring function for the monitoring point.
FULL_ERROR_MESSAGE	True or False enables this option. This starts logging the error message associated with the error code.

Argument	Description
DB_ADDRESS_FOR_DECRYPTION	The address of the database for which the native network encrypted traffic monitoring needs to be enabled.
DB_PORT_FOR_DECRYPTION	The port number of the database for which the native network encrypted traffic monitoring needs to be enabled.
DB_NAME_FOR_DECRYPTION	The name of the database for which the native network encrypted traffic monitoring needs to be enabled.
DB_CREDENTIAL_FOR_DECRYPTION	The credentials used to connect to the database for which the native network encrypted traffic monitoring option needs to be enabled. The credentials must be specified in the format <user name>/<password>.
DECRYPT_WITH_NNE_KEY	True or False enables this option. This starts the native network encrypted traffic monitoring feature.
BLOCK_UNMATCHED_OSN	True or False enables this option. This blocks the connection with service names other than the ones that are mentioned in the target connection details.

Usage Notes

Attributes are specified by a comma separated list of key=value pairs. The following key values are supported:

Note:

• The ADD_ADDRESS and REMOVE_ADDRESS attributes are applicable for a single target only. It is not applicable for a RAC monitoring point.

• Only for monitoring (out-of-band) mode, you can specify multiple network interfaces cards. Otherwise, only one network interface card or traffic source can be used.

Examples

avcli> ALTER DATABASE FIREWALL MONITOR FOR TARGET target1 USING FIREWALL fw1 SET MODE=monitoring_out_of_band;

avcli> ALTER DATABASE FIREWALL MONITOR FOR TARGET target1 USING FIREWALL fw1 SET database_response=true, full_error_message=true;

avcli> ALTER DATABASE FIREWALL MONITOR FOR TARGET target1 USING FIREWALL fw1 SET add_address=1.2.3.4:1234:dbfwfb;

Specify multiple network interface cards when deploying in Monitoring (Out of Band) mode:

avcli> ALTER DATABASE FIREWALL MONITOR FOR TARGET mysource USING FIREWALL myfw SET network_interface_card=enp0s3 enp0s10, database_response=true, full_error_message=true;

CREATE DATABASE FIREWALL MONITOR

The CREATE DATABASE FIREWALL MONITOR command creates Database Firewall monitoring points to protect the targets.

The CREATE DATABASE FIREWALL MONITOR command creates a Database Firewall monitoring point with the specified name and protects the target with monitoring only, or monitoring and blocking mode.

Syntax

CREATE DATABASE FIREWALL MONITOR FOR TARGET <target name> USING FIREWALL <firewall name> WITH MODE <mode name> NETWORK INTERFACE CARD <network interface card> [PROXY PORT <proxy port number>] [ADD ADDRESS <ip:port[:service name | SID]>] [FOR TARGET MODE RAC]

Arguments

Argument	Descriptions
target name	The name of the target.
firewall name	The name of the Database Firewall.
network interface card name	The name of the network interface card (NIC). You may specify a bonded NIC. Only one NIC is allowed except in Monitoring_Out_Of_Band mode. For Monitoring_Out_Of_Band deployment mode, you can specify multiple network interface cards in a comma separated list. For Monitoring_Host_Monitor deployment mode, provide the name of the network interface card which has an IP address configured.
proxy port number	Proxy port number required only for Monitoring_Blocking_Proxy deployment mode.
mode name	The available deployment modes are: Monitoring_Blocking_Proxy Monitoring_Out_Of_Band Monitoring_Host_Monitor For Monitoring_Blocking_Proxy mode, both the network interface card and the proxy port must be specified and only one address can be added. For Monitoring_Out_Of_Band and Monitoring_Host_Monitor mode, the network interface card needs to be set and proxy port cannot be applied. One or more addresses can be added.
address	Ip address for the first Database Firewall monitoring point. It is mandatory for the first Database Firewall monitoring point for the specific target and Database Firewall. It is not allowed for the subsequent monitoring points being created. Format:
Ip	Ip address.
port	The port number
service name	The service name or SID of the Oracle Database. Note: If you plan to monitor more than one OSN on a target database: You can use one proxy port and specify multiple OSNs on the target database that are going to be processed. Specify the OSNs in a list delimited by the "|" character. For example, target1|target2|target 3.
FOR TARGET MODE RAC	Can be set only for Oracle Databases and if proxy port is set.

Examples

create database firewall monitor for target mysource using firewall myfw with mode Monitoring_Blocking_Proxy network interface card eth1 proxy port 1 add address 192.0.2.0:24:srcdb for target mode rac;

Creates a Database Firewall monitoring point for the Database Firewall instance myfw using the network interface card eth1 with port 1 and protects the target mysource with the mode Monitoring_Blocking_Proxy, adds address (host=192.0.2.0, port=24 and service=srcdb) as an Oracle RAC instance.

create database firewall monitor for target mysource using firewall myfw with mode Monitoring_Host_Monitor network interface card eth0 add address 192.0.2.1:1521:dbfwdb

Creates a Database Firewall monitoring point and monitors the target mysource for the Database Firewall instance myfw using network interface card eth0 in mode Monitoring_Host_Monitor; adds address (host=192.0.2.1, port=1521, service=dbfwdb).

create database firewall monitor for target mysource using firewall myfw with mode Monitoring_Out_Of_Band network interface card eth0

Creates a Database Firewall monitoring point and monitors the target mysource for the Database Firewall instance myfw using network interface card eth0 in the mode Monitoring_Out_Of_Band; assuming addresses have been added before in the first Database Firewall monitoring point for this target and the Database Firewall pair.

create database firewall monitor for target mysource using firewall myfw with mode Monitoring_Out_Of_Band network interface card enp0s3,enp0s10,enp0s9 add address 192.0.2.0:24:srcdb

Creates a Database Firewall monitoring point on Database Firewall myfw using network interface cards enp0s3, enp0s10, and enp0s9 and protects the target mysource in mode Monitoring_Out_Of_Band, adds address host = 192.0.2.0, port=24 and service = srcdb. Specifying multiple network interface cards in Monitoring_Out_Of_Band mode.

Result

In case the command is run successfully, the following output is displayed:

The command completed successfully.

In case the command is not successfully run, then an error is displayed. Here are some of the possible errors:

Error	Description
OAV-46501: invalid target: <target name provided>	The target name specified is invalid. Check for the correct name of the target, by running LIST TARGET command.
OAV-46501: invalid firewall: <firewall name provided>	The name of the Database Firewall instance specified is invalid. Check for the correct name of the Database Firewall instance by running LIST FIREWALL command.
OAV-46501: invalid monitor mode: <provided monitor mode name>. Monitor mode must be one of: Monitoring_Blocking_Proxy, Monitoring_Host_Monitor, Monitoring_Out_Of_Band.	The Database Firewall mode specified is invalid. The valid modes are: Monitoring_Blocking_Proxy, Monitoring_Host_Monitor, Monitoring_Out_Of_Band.
OAV-46501: invalid network interface card: <network interface card provided>	The name of the network interface card specified is invalid. Check for the correct name of the network interface card by running SHOW STATUS FOR FIREWALL command.
OAV-46501: invalid proxy port number: <proxy port number provided>	The proxy port number specified is invalid. Check for the correct proxy port number.
OAV-46991: Invalid option 'proxy port' for mode 'Monitoring (Out-of-Band) OAV-46991: Invalid option 'proxy port' for mode 'Monitoring (Host Monitor)	The proxy port number is specified for Monitoring_Out_Of_Band or Monitoring_Host_Monitor mode. Remove the proxy port number.
OAV-46648: Invalid value for 'proxy port'	The proxy port number is not specified for Monitoring_Blocking_Proxy mode.
OAV-47501: Traffic proxy <proxy name> is in use.	The proxy port number specified is being used by another Database Firewall monitoring point.
OAV-46504: duplicate proxy port numbers: <proxy port number provided as part of network interface card> and <proxy port number provided>	The proxy port is specified for the NETWORK INTERFACE CARD and PROXY PORT does not match. Provide a single proxy port number.
OAV-46995: At least one connection details required for the database firewall monitor	The address or connection detail is not specified for the first Database Firewall monitoring point for the specific target and pair of Database Firewall instances.
OAV-47709: Connection details cannot be changed if there is more than one database firewall monitor	The address or connection detail is specified before and cannot be changed again for the subsequent Database Firewall monitoring point for the specific target and pair of Database Firewall instances. Check the existing connection detail by running the LIST DATABASE FIREWALL MONITOR command.
OAV-47707: Invalid option 'FOR TARGET MODE RAC' for mode 'Monitoring (Out-of-Band)' OAV-47707: Invalid option 'FOR TARGET MODE RAC' for mode 'Monitoring (Host Monitor)'	Attempt to configure Monitoring_Out_Of_Band or Monitoring_Host_Monitor for Oracle RAC target instance which is not supported. Remove the option FOR TARGET MODE RAC or change the mode to Monitoring_Blocking_Proxy.
OAV-46535: failed to add target address: address <address provided> is used by Target <another target name>	The address or connection detail is already specified for another target being monitored.

See Also:

• LIST TARGET

• LIST FIREWALL

• SHOW STATUS FOR FIREWALL

• LIST DATABASE FIREWALL MONITOR

DROP DATABASE FIREWALL MONITOR

Use the DROP DATABASE FIREWALL MONITOR command to drop monitoring points.

The DROP DATABASE FIREWALL MONITOR command drops the monitoring point.

Syntax

DROP DATABASE FIREWALL MONITOR FOR TARGET <target name> USING FIREWALL <firewall name>

Arguments

Argument	Descriptions
firewall name	The name of the Database Firewall.
target name	The name of the target.

Examples

avcli> DROP DATABASE FIREWALL MONITOR FOR TARGET sample_source USING FIREWALL sample_fw;

avcli> DROP DATABASE FIREWALL MONITOR FOR TARGET target1 USING FIREWALL fw1;

The monitoring point is dropped.

LIST DATABASE FIREWALL MONITOR

Use the LIST DATABASE FIREWALL MONITOR command to list all of the monitoring points associated with either the Database Firewall or the target.

The LIST DATABASE FIREWALL MONITOR command lists the monitoring points associated with either the Database Firewall or the target.

Syntax

LIST DATABASE FIREWALL MONITOR FOR FIREWALL <firewall_name>

LIST DATABASE FIREWALL MONITOR FOR TARGET <target_name>

Arguments

Argument	Descriptions
firewall_name	The name of the Database Firewall.
target_name	The name of the target.

Example

avcli> LIST DATABASE FIREWALL MONITOR FOR FIREWALL sample_fw;

A list of all the monitoring points associated with the Database Firewall sample_fw appears.

avcli> LIST DATABASE FIREWALL MONITOR FOR TARGET sample_source;

A list of all the monitoring points associated with the target sample_source appears.

START DATABASE FIREWALL MONITOR

Learn how to use the START DATABASE FIREWALL MONITOR command to start a monitoring point that was previously suspended.

The START DATABASE FIREWALL MONITOR command starts a monitoring point that was previously suspended.

Syntax

START DATABASE FIREWALL MONITOR FOR TARGET <target name> USING FIREWALL <firewall name>

Arguments

Argument	Descriptions
firewall name	The name of the Database Firewall.
target name	The name of the target.

Examples

avcli> START DATABASE FIREWALL MONITOR FOR TARGET sample_source USING FIREWALL sample_fw;

avcli> START DATABASE FIREWALL MONITOR FOR TARGET target1 USING FIREWALL fw1;

The monitoring point is started.

STOP DATABASE FIREWALL MONITOR

Use the STOP DATABASE FIREWALL MONITOR command to stop a monitoring point.

The STOP DATABASE FIREWALL MONITOR command stops the monitoring point of the target.

Syntax

STOP DATABASE FIREWALL MONITOR FOR TARGET <target name> USING FIREWALL <firewall name>

Arguments

Argument	Descriptions
firewall name	The name of the Database Firewall.
target name	The name of the target.

Examples

avcli> STOP DATABASE FIREWALL MONITOR FOR TARGET sample_source USING FIREWALL sample_fw;

avcli> STOP DATABASE FIREWALL MONITOR FOR TARGET target1 USING FIREWALL fw1;

The monitoring point is stopped.