Hi,
We are preparing for a new installation with RSA 7.1.1 connecting to a remote Oracle Database Enterprise Edition 12.2.0.1.0.
The database team has informed us that they will only accept secure connections.
Do any of you know if we have to make any updates to the IG&L installation so that it can make secure connection?
Rgds
Sunita
Hi Sunita, could you provide more details on the secure connection settings required by your DBA? Do you have any specific JDBC connection URL provided by the database team?
Also note that Oracle 12.2 is a little different than the supported version of Oracle 12.1 on 7.1.1. You will need to configure a few additional database parameters to ensure good performance:
Hello Helmy,
Thank you for your reply.
Our DB team has informed that on their side there are three settings that control this:
"SQLNET.ENCRYPTION_SERVER=requested
SQLNET.ENCRYPTION_TYPES_CLIENT=(aes256,aes192,aes128)
SQLNET.ENCRYPTION_TYPES_SERVER=(aes256,aes192,aes128)
Specifying it on the server-side causes all of the sql*net traffic to be encrypted.
With jdbc thin, the default value for the client value of “SQLNET.ENCRYPTION_SERVER” is “ACCEPTED” – so it’ll automatically encrypt.
Found the manual that explains all this: https://docs.oracle.com/database/121/JJDBC/clntsec.htm#JJDBC28313
"
We should be able to update some of the oracle connectivity configuration after the installation but our concern is:Will the out of the box installation succeed knowing the requirements on the Oracle end.
Our database farm supports Oracle12.2. so we are thinking of going with Customer Supplied Database on 7.1.1
Another thing to consider is "Is SSL really required between the application and the database?". Since IGL has a lot of reads and write, that too with large volumes of data, there can be potential degradation of performance.
Hello Pradeep,
Our database farm sits on a different network compartment that where RSA IG&L will go. As of today only SSL connections are allowed on the database side.
Understood
Even though technically feasible in my opinion, I am unsure if this will survive the patches and updates. This is something the product should be supporting as an option at the time of installation.
I have two things to add here:
Our enterprise architecture includes a database farm so need to comply and setup remote db for RSA IG&L.
On your second point, I do see the Oracle 12.2.0.1 on the RSA7.1.1 support matrix with Customer supplied database. See attachment. Let me know if I am overlooking something.
Having a remote database is a very valid and common setup that many customers have. My point was that in most of those cases, both database and application servers would be on the same network segment, or at within the same data centre. Separating both servers doesn't mean it won't work, but it will definitely have an impact on application stability based on the network stability and latency.
As for Oracle 12.2, sorry if I was confusing but I didn't mean it is not supported. My comment around Oracle 12.2 was only regarding the extra required optimizer settings mentioned in the KB article able.
What is not the supported in this setup the JDBC level encryption. It hasn't been qualified or tested by RSA and therefore performance and stability cannot be guaranteed.
Thanks for your comments Helmy. I will come back and post with installation outcomes.
Rgds
Sunita
I have two things to add here: