5
Oracle Net

Oracle Net is an Oracle product providing network communication between Oracle applications, Oracle Servers and Oracle Gateways across different systems.

This chapter contains the following sections:

• Checklists for Oracle Net

• Oracle Net and SQL*Net Introduction

• Oracle Net Overview

• Configuring Oracle Net

• Advanced Security Encryption

• Setting Up Advanced Security Encryption for Test

• Testing Advanced Security Encryptions

Checklists for Oracle Net

Use the following checklists when you are installing and configuring Oracle Net.

Checklist for Configuring Oracle Net

Step 1: Modify listener.ora file

Step 2: Modify tnsnames.ora file

Checklist for Advanced Networking Option Encryption

Setting Up Advanced Security Encryption for Test

Step 1: Set Advanced Security Encryption Parameters for the Gateway

Step 2: Set Advanced Security Encryption Parameters for the Integrating Oracle Server

Testing Advanced Security Encryptions

Step 1: Connect Gateway and Integrating Oracle Server

Step 2: Reset Configuration Parameters on the Gateway

Oracle Net and SQL*Net Introduction

Oracle Net provides connectivity to the Gateway through the use of Protocol Adapters, SQL*Net, and the TNS Listener.  Configuration of Oracle Net is backwards compatible with past versions of SQL*Net.  A new facility called Heterogeneous Services (HS) has been added to both Oracle Net and the Gateway to improve the throughput of SQL*Net data.  For additional information, refer to Oracle Net Administrator's Guide and Oracle9i Heterogeneous Services.

Oracle Net Overview

Oracle Net is a required Oracle product supporting network communications between Oracle applications, Oracle servers, and Oracle gateways across different CPUs or operating systems.  It also supports communication across different Oracle databases and CPUs providing distributed database and distributed processing capabilities.

Oracle Net also allows applications to connect to multiple Oracle servers or gateways across a network, selecting from a variety of communications protocols and application program interfaces (APIs) to establish a distributed processing and distributed database environment.

A communications protocol is a set of implemented standards or rules governing data transmission across a network.  An API is a set of subroutines providing an interface for application processes to the network environment.

Distributed Processing.

Dividing processing between a front-end computer running an application and a back-end computer used by the application is known as distributed processing.  Oracle Net enables an Oracle tool or application to connect to a remote computer containing an Oracle server or Oracle gateway.

Distributed Database

Several databases linked through a network, appearing as a single logical database, are known as a distributed database.  An Oracle tool running on a client computer or on an Oracle server running on a host computer can share and obtain information retrieved from other remote Oracle servers.  Regardless of the number of database information sources, you might only be aware of one logical database.

Terminology for Oracle Net

The following terms are used to explain the architecture of Oracle Net for AIX-Based Systems (64-bit):

host is the computer the database resides on and that runs the Oracle server or gateway. 

client (task) is the application using a Oracle Net driver to communicate with the Oracle server or gateway.

protocol is a set of standards or rules governing the operation of a communication link. 

driver is the part of Oracle Net supporting a given network protocol or communication method.

network is a configuration of devices and software connected for information interchange. 

Configuring Oracle Net

The gateway must be defined to the TNS listener, and a service name must be defined for accessing the gateway.

Step 1: Modify listener.ora file

Add an entry for the gateway to the listener.ora file.  For example:

(SID_DESC=
          (SID_NAME=sidname)
          (ORACLE_HOME=/oracle/tg4drda/9.0.1)
          (PROGRAM=drdahoa1.sh))

Refer to Appendix B, "Sample Files", for a sample listener.ora file.

Note: The PROGRAM=drdahoa1.sh parameter is required.  It specifies to the listener the name of the gateway Startup Shell Script.

Step 2: Modify tnsnames.ora file

Add a gateway service name to the tnsnames.ora file on the system where your integrating Oracle Server resides.  Specify the service name in the USING parameter of the database link defined for accessing the gateway from the Oracle 9i Server.

You can use the IPC protocol only if the integrating Oracle Server and the gateway reside on the same machine.  If you use the IPC protocol adapter, then add an entry like this to tnsnames.ora:

linkname1 = (DESCRIPTION=
                   (ADDRESS= 
                        (PROTOCOL=IPC)
                        (KEY=ORAIPC))
                   (CONNECT_DATA=(SID=sidname))
                   (HS=)
           )

where:

linkname1 is the name used to define the database link referencing the gateway.

ORAIPC is the IPC key defined in the listener.ora file for the IPC protocol.

sidname is your gateway SID, the same SID that you used for the entry in your listener.ora file.

If you are using the TCP/IP protocol adapter, then add this entry to tnsnames.ora:

linkname2 = (DESCRIPTION=
              (ADDRESS=
                 (PROTOCOL=TCP)
                 (PORT=port)
                 (HOST=hostname))
              (CONNECT_DATA=(SID=sidname))
              (HS=)
            )

where:

linkname2 is the name used to define the database link referencing the gateway.

port is the default Oracle TCP/IP port number (1541).

hostname is the name of your host system.

sidname is your gateway SID.

Refer to "Sample Oracle Net tnsnames.ora File" for a sample tnsnames.ora file.  For more information about configuring SQL*Net, refer to Understanding SQL*Net and Oracle Net Administrator's Guide.

Advanced Security Encryption

Oracle Net supports the CHECKSUM command and the Export encryption algorithms.  The following sections describe a basic method of verifying this feature if it is used at your site.  The easiest way to determine if Advanced Security encryption is attempting to work is to deliberately set wrong configuration parameters and attempt a connection between the server and client.  Incorrect parameters cause the connection to fail.

After receiving the expected failure message, set the configuration parameters to the correct settings and try the connection again.  Encryption is working properly if you receive no further error messages.

Setting Up Advanced Security Encryption for Test

The following procedures test Advance Security encryption by the above method.  The incorrect parameter settings produce error 12660

1. Set Advanced Security encryption parameters for the gateway

2. Set Advanced Security encryption parameters for the integrating Oracle Server

   Note: The international or export version of Advanced Security encryption supports the following encryption types: des40 rc4_40

Step 1: Set Advanced Security Encryption Parameters for the Gateway

Edit the Oracle Net configuration file on the AIX system (gateway system) to add the following parameters and values:

SQLNET.CRYPTO_CHECKSUM_SERVER = REJECTED
SQLNET.ENCRYPTION_SERVER = REJECTED
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (MD5)
SQLNET.ENCRYPTION_TYPES_SERVER = (DES40,RC4_40)
SQLNET.CRYPTO_SEED = "abcdefg123456789"

The value shown for SQLNET.CRYPTO_SEED is only an example.  Set it to the value you want.  Refer to the Advanced Security Administrator's Guide for more information.

Step 2: Set Advanced Security Encryption Parameters for Integrating Oracle Server

Edit the Oracle Net configuration file on the integrating Oracle Server system to add the following parameters:

SQLNET.CRYPTO_CHECKSUM_CLIENT = REQUIRED
SQLNET.ENCRYPTION_CLIENT = REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_CLIENT = (MD5)
SQLNET.ENCRYPTION_TYPES_CLIENT = (DES40,RC4_40)
SQLNET.CRYPTO_SEED = "abcdefg123456789"

The value shown for SQLNET.CRYPTO_SEED is only an example.

Testing Advanced Security Encryptions

After completing Steps 1 and 2 to set up Advanced Security encryption, you are ready to test the operation of the Advanced Security encryption by using the following steps:

1. Connect gateway and integrating Oracle Server

2. Reset configuration parameters on the gateway

Step 1: Connect Gateway and Integrating Oracle Server

Use SQL*Plus to logon to the integrating Oracle Server.  Access the gateway through a database link.  You should receive the following error:

ORA-12660: Encryption or crypto-checksumming

Step 2: Reset Configuration Parameters on the Gateway

Change the following Advanced Security encryption parameters on the gateway to:

SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
SQLNET.ENCRYPTION_SERVER = REQUIRED

Attempt the connection between the gateway and the integrating Oracle Server again.  If no error message is returned and the connection completes, then you can assume Advanced Security encryption is working properly.