12 Using Target System Connection Initiation
Learn how to allow Oracle GoldenGate to replicate into a more secure network or server where communication must be established from the target back to the source system..
When a target system resides inside a trusted intranet zone, initiating connections from the source system (the standard Oracle GoldenGate method) may violate security policies if the source system is in a less trusted zone. It also may violate security policies if a system in a less trusted zone contains information about the ports or IP address of a system in the trusted zone, such as that normally found in an Oracle GoldenGate Extract parameter file.
In this kind of intranet configuration, you can use a passive-alias Extract configuration. Connections are initiated from the target system inside the trusted zone by an alias Extract group, which acts as an alias for a regular Extract group on the source system, known in this case as the passive Extract. Once a connection between the two systems is established, data is processed and transferred across the network by the passive Extract group in the usual way.
- An Oracle GoldenGate user starts the alias Extract on the trusted system, or an
AUTOSTART
orAUTORESTART
parameter causes it to start. - GGSCI on the trusted system sends a message to Manager on the less trusted system to start the associated passive Extract. The host name or IP address and port number of the Manager on the trusted system are sent to the less trusted system.
- On the less trusted system, Manager starts the passive Extract, and the passive Extract finds an open port (according to rules in the
DYNAMICPORTLIST
Manager parameter) and listens on that port. - The Manager on the less trusted system returns that port to GGSCI on the trusted system.
- GGSCI on the trusted system sends a request to the Manager on that system to start a Collector process on that system.
- The target Manager starts the Collector process and passes it the port number where Extract is listening on the less trusted system.
- Collector on the trusted system opens a connection to the passive Extract on the less trusted system.
- Data is sent across the network from the passive Extract to the Collector on the target and is written to the trail in the usual manner for processing by Replicat.
Topics:
- Configuring the Passive Extract Group
- Configuring the Alias Extract Group
- Starting and Stopping the Passive and Alias Processes
- Managing Extraction Activities
- Other Considerations when using Passive-Alias Extract
Parent topic: Securing the Classic Architecture
12.1 Configuring the Passive Extract Group
The passive Extract group on the less trusted source system will be one of the following, depending on which one is responsible for sending data across the network:
-
A solo Extract group that reads the transaction logs and also sends the data to the target, or:
-
A data pump Extract group that reads a local trail supplied by a primary Extract and then sends the data to the target. In this case, there are no special configuration requirements for the primary Extract, just the data pump.
Note:
The passive Extract group is only available in the Oracle GoldenGate CA.
To create an Extract group in passive mode, use the standard ADD EXTRACT
command and options, but add the PASSIVE
keyword in any location relative to other command options. Examples:
ADD EXTRACT fin, TRANLOG, BEGIN NOW, PASSIVE, DESC 'passive Extract' ADD EXTRACT fin, PASSIVE, TRANLOG, BEGIN NOW, DESC 'passive Extract'
To configure parameters for the passive Extract group, create a parameter file in the normal manner, except:
-
Exclude the
RMTHOST
parameter, which normally would specify the host and port information for the target Manager. -
Use the optional
RMTHOSTOPTIONS
parameter to specify any compression and encryption rules. For information about theRMTHOSTOPTIONS
options, see Reference for Oracle GoldenGate.
Parent topic: Using Target System Connection Initiation
12.2 Configuring the Alias Extract Group
The alias Extract group on the trusted target does not perform any data processing activities. Its sole purpose is to initiate and terminate connections to the less trusted source. In this capacity, the alias Extract group does not use a parameter file nor does it write processing checkpoints. A checkpoint file is used only to determine whether the passive Extract group is running or not and to record information required for the remote connection.
Note:
The alias Extract group is only available in the Oracle GoldenGate CA.To create an Extract group in alias mode, use the ADD EXTRACT
command without any other options except the following:
ADD EXTRACTgroup
, RMTHOST {host_name
|IP_address
} , MGRPORTport
[, RMTNAMEname
] [, DESC 'description
']
The RMTHOST
specification identifies this group as an alias Extract, and the information is written to the checkpoint file. The host_name
and IP_address
options specify the name or IP address of the source system. MGRPORT
specifies the port on the source system where Manager is running.
The alias Extract name can be the same as that of the passive Extract, or it can be different. If the names are different, use the optional RMTNAME
specification to specify the name of the passive Extract. If RMTNAME
is not used, Oracle GoldenGate expects the names to be identical and writes the name to the checkpoint file of the alias Extract for use when establishing the connection.
Error handling for TCP/IP connections is guided by the TCPERRS
file
on the target system. It is recommended that you set the response values for the
errors in this file to RETRY
. The default is
ABEND
. This file also provides options for setting the number of
retries and the delay between attempts. For more information about error handling
for TCP/IP and the TCPERRS
file.
Parent topic: Using Target System Connection Initiation
12.3 Starting and Stopping the Passive and Alias Processes
To start or stop Oracle GoldenGate extraction in the passive-alias Extract configuration, you must start or stop the alias Extract group from GGSCI on the target.
START EXTRACT alias_group_name
or,
STOP EXTRACT alias_group_name
The command is sent to the source system to start or stop the passive Extract group. Do not issue these commands directly against the passive Extract group. You can issue a KILL EXTRACT
command directly for the passive Extract group.
When using the Manager parameters AUTOSTART
and AUTORESTART
to automatically start or restart processes, use them on the target system, not the source system. The alias Extract is started first and then the start command is sent to the passive Extract.
Parent topic: Using Target System Connection Initiation
12.4 Managing Extraction Activities
Once extraction processing has been started, you can manage and monitor it in the usual manner by issuing commands against the passive Extract group from GGSCI on the source system. The standard GGSCI monitoring commands, such as INFO
and VIEW REPORT
, can be issued from either the source or target systems. If a monitoring command is issued for the alias Extract group, it is forwarded to the passive Extract group. The alias Extract group name is replaced in the command with the passive Extract group name. For example, INFO EXTRACT
alias
becomes INFO EXTRACT
passive.
The results of the command are displayed on the system where the command was issued.
Parent topic: Using Target System Connection Initiation
12.5 Other Considerations when using Passive-Alias Extract
When using a passive-alias Extract configuration, these rules apply:
-
In this configuration, Extract can only write to one target system.
-
This configuration can be used in an Oracle RAC installation by creating the Extract group in the normal manner (using the
THREADS
option to specify the number of redo threads). -
The
ALTER EXTRACT
command cannot be used for the alias Extract, because that group does not do data processing. -
To use the
DELETE EXTRACT
command for a passive or alias Extract group, issue the command from the local GGSCI. -
Remote tasks, specified with
RMTTASK
in the Extract parameter file and used for some initial load methods, are not supported in this configuration. A remote task requires the connection to be initiated from the source system and uses a direct connection between Extract and Replicat.
Parent topic: Using Target System Connection Initiation