Specifying the Audit Vault Server Certificate and IP Address

You associate each Database Firewall with an Audit Vault Server so that the Audit Vault Server can manage the firewall. This association is part of the Database Firewall registration process. If you’re using a resilient pair of Audit Vault Servers or a RAC deployment for high availability, then you associate the firewall with both servers.

Note:

Complete the Database Firewall Post-Install Tasks before beginning this procedure.
Complete this procedure before you register the firewall on the Audit Vault Server. See Registering Database Firewall in Audit Vault Server for instructions.

Log in to the Oracle Database Security Central console as an administrator.
Find and copy the Audit Vault Server certificate and IP address.

For standalone Audit Vault Servers or primary Audit Vault Servers in a high availability environment:
1. Select Settings.
2. Select Security in the left navigation menu.
3. Select Certificate on the main page, and then select Server Certificate.
4. Copy the certificate.
For standby Audit Vault Servers in a high availability environment:
1. Select Settings.
2. Select System in the left navigation menu.
3. In the Configuration section, select High Availability.
4. Copy the standby server certificate and IP address.
Copy the server certificate of the Audit Vault Server into a file on the Database Firewall server.

Run the following commands to associate the primary or standby Audit Vault Server with the Database Firewall:

Task	Command
Display the Audit Vault Servers that are paired with the Database Firewall	`/opt/avdf/config-utils/bin/config-avs show`
Add or update the primary Audit Vault Server for the Database Firewall	`/opt/avdf/config-utils/bin/config-avs set avs=primary address= certificate=`
Add or update the standby Audit Vault Server for the Database Firewall	`/opt/avdf/config-utils/bin/config-avs set avs=secondary address= certificate=`

Run the following command to get the Database Firewall certificate SHA-256 fingerprint. Record the fingerprint because you must provide it when you register the Database Firewall with the Audit Vault Server to verify that the correct Database Firewall is being registered:
```
openssl x509 -in /usr/local/dbfw/etc/ca.crt -noout -fingerprint -sha256
```
Run the following command to synchronize the system clocks of the Database Firewall server and the Audit Vault Server.
```
/opt/avdf/config-utils/bin/config-ntp set servers=<Comma separated IP addresses or hostnames of NTP servers> sync_on_save=true enabled=true
```
See CONFIG-NTP for more information about this command.

Note: To perform the same procedure by using the Oracle Database Security Central console, see Setting the Date and Time in Database Firewall.

To remove the primary or standby Audit Vault Server from the Database Firewall, use the following commands.

Task	Command
Remove the primary Audit Vault Server from the Database Firewall	`/opt/avdf/config-utils/bin/config-avs delete avs=primary`
Remove the standby Audit Vault Server from the Database Firewall	`/opt/avdf/config-utils/bin/config-avs delete avs=secondary`