Managing the Oracle Database Firewall Network and Services Configuration

Learn how to manage the Oracle Database Firewall network and services configuration.

Configuring Network Settings for Oracle Database Firewall

Learn how to configure the network settings for Oracle Database Firewall.

The installer configures initial network settings for the Database Firewall during installation. You can change the network settings after installation.

To change the Database Firewall network settings:

Log in to the Oracle Database Security Central console as administrator.
Select Database Firewalls.
Select Database Firewall Monitoring and ensure all monitoring points are stopped.
Select the Database Firewall instance for which the network settings need to be configured or changed.
Select the Network Settings link under the Configuration section in the main page.
If the Synchronize NICs button is disabled, proceed to the next step. If the Synchronize NICs button is active, select it, as the AVS detects NIC name changes in the Database Firewall which must be synchronized.
1. Select a NIC name on the Database Firewall for all the devices. If a device is no longer available on the Database Firewall and is no longer required on the AVS, select not required.
2. After mapping each device, select Save.
In the Network Settings dialog, select a specific network interface.
In the Network Interface Settings dialog, complete the following fields as necessary:
- IP Address: The IP address of the network interface. If you want to use a different address, then you can change it here. The IP address is static and must be obtained from the network administrator.
  
  The network interface which has the same IP address as that of Database Firewall is the Management Interface. If the IP address of the Management Interface is changed, then the IP address of the Database Firewall is also changed.
- Network Mask: The subnet mask of the Database Firewall. If you want to use a different network mask, then you can change it here.
- Gateway: The IP address of the default gateway (for example, for internet access). The default gateway must be on the same subnet as the host. This is optional.
Select Save.

Note:

The following error may be encountered while changing the IP address of the Management Interface. This message can be ignored and no action is required.

Operation failed OAV-46981: Unable to connect to Database Firewall with IP

Configuring Network Services for Oracle Database Firewall

Learn about configuring network services for Oracle Database Firewall.

The network services configuration determines how administrators can access Oracle Database Firewall. See the guidelines to protect data and ensure that you take the appropriate security measures when configuring network services.

To configure network services for a Database Firewall:

Select Database Firewalls in the Oracle Database Security Central console.
In the left navigation menu, select Database Firewalls.
Select specific Database Firewall instance.
Under Configuration, select System Services.

In the System Services dialog, the following options are available:

DNS: If you require host names to be translated, then enter the IP address of at least one DNS server on the network. Select the checkbox for one or more DNS server entries, then enter the IP addresses of up to three DNS servers (DNS Server 1, DNS Server 2, and DNS Server 3). Keep DNS checkboxes unchecked if there is no DNS server. Otherwise, your system’s performance may be impaired.

If you want to use DNS, then ensure that the servers are reliable. If the DNS servers are unavailable, then many services on the Database Firewall do not work. For example, the Database Firewall may pass traffic that it would otherwise block.

SSH/SNMP: If you want to allow selected computers to have secure shell access to the Database Firewall, then select the SSH Access checkbox. You can select All to allow unrestricted access or select IP Addresses and enter their IP addresses separated by space or comma.

SSH setting can also be configured using command line interface. Use these commands for the same.

Task	Command
To display the current settings of SSH	`/opt/avdf/config-utils/bin/config-ssh show`
To allow unrestricted access from all systems	`/opt/avdf/config-utils/bin/config-ssh set access=all`
To block SSH access from all systems	`/opt/avdf/config-utils/bin/config-ssh set access=disabled`
To allow a selected computer to have secure shell access to the Database Firewall	`/opt/avdf/config-utils/bin/config-ssh set access=192.0.2.11`
To allow a multiple computers to have secure shell access to the Database Firewall	`/opt/avdf/config-utils/bin/config-ssh set access='192.0.2.11 192.0.2.12'`

SNMP Access: If you want to enable access to the network configuration of the Database Firewall through SNMP, then select the SNMP Access checkbox. You can select All to allow unrestricted access or select IP Addresses and enter their IP addresses separated by space or comma.

Select Save.

See Also: Protecting Your Data

Configuring SNMPv3 Users in Oracle Database Security Central

Learn how to configure SNMPv3 users.

Simple Network Management Protocol version 3 (SNMPv3) is an interoperable, standards-based protocol. SNMPv3 involves User-based Security Model (USM) for message security and the View-based Access Control Model (VACM) for access control. With USM, messages exchanged between the SNMP Manager and the SNMP Agent can have data integrity checking and data origin authentication. Oracle Database Security Central supports SNMPv3 as the default version. This topic contains the steps needed to configure SNMPv3 users for making use of the USM model of SNMPv3.

To create an SNMPv3 user, follow these steps:

Log in to the Database Security Central instance as root user.
Run the following command to turn off the snmpd service:
```
systemctl stop snmpd
```
Run the following command to create a new SNMP user:
```
net-snmp-create-v3-user -a SHA-512 -x AES
```
Enter the user name and authentication passphrase following the prompt.
Enter the encryption passphrase following the prompt. If you want to use the same passphrase for encryption, then press the Enter key to continue.
The following output confirms the user creation.
```
adding the following line to /var/lib/net-snmp/snmpd.conf:
createUser <user name> SHA-512 <password> AES <encryption password>
adding the following line to /etc/snmp/snmpd.conf:
rwuser <user name>
```
Note:

The new user created has read and write access by default. This can be modified to read only privileges. This can be done by modifying the file available at /etc/snmp/snmpd.conf:
```
rouser <user name>
```
In the configuration file, find the line or entry where rwuser <user name> is mentioned. Change the entry to rouser <user name> for read only access.
After the user is created, you can assign the user to an existing group. Or you can create a new group and assign the user.
1. Follow this step to assign the newly created user to an existing group. In Oracle Database Security Central, the default group name is notConfigGroup. Edit the /etc/snmp/snmpd.conf file and include the following line in the group creation table. Ensure the user name of the new user is under the UserName column.
```
#      groupName     securityModel  userName
group notConfigGroup     usm         <user name>
```
  Example of adding the user to a predefined group:
```
#      groupName     securityModel  userName
group notConfigGroup     usm         myUser
```
2. Follow this step to assign the newly created user to a new group.
```
#      groupName     securityModel  userName
group <new group name>     usm         <user name>
```
  Example of adding the user to a new group:
```
#      groupName     securityModel  userName
group newGroup     usm         myUser
```
Run the following command to start the snmpd service:
```
systemctl start snmpd
```
Run the following command to test and confirm that the SNMPv3 user is created and assigned to the group:
Note:

Install the net-snmp-utils package to run the following snmpwalk command. It is not installed as part of Audit Vault Server or Database Firewall installation by default. Other standard SNMP querying tools can also be used.
```
snmpwalk -v3 -u <user name> -a SHA -A "<authentication password>" -x AES -X "<privacy password>" -l authPriv <IP address of the system> <standard SNMP MIB>
```
For example:
```
snmpwalk -v3 -u myUser -a SHA -A "myAuthPassword" -x AES -X "myPrivacyPassword" -l authPriv 192.0.2.24 system
```