You configure the computer that hosts Oracle Connection Manager by setting parameters in the cman.ora file. The cman.ora file resides on the computer that hosts Oracle Connection Manager, and is located in the ORACLE_HOME/network/admin directory. Oracle Connection Manager will not start if the cman.ora file does not exist. This file includes the following components:

• Listening endpoint

• Access control rule list

• Parameter list

Each Oracle Connection Manager configuration is encapsulated within a single name-value (NV) string, which consists of the preceding components.

One computer can host any number of Oracle Connection Managers, each with its own entry in the cman.ora file. When defining more than one Oracle Connection Manager in the file, you can assign a default by giving only one a fully qualified host name.

You can specify multiple rules for both client and Oracle Connection Manager Control utility (CMCTL) connections. The following guidelines apply when making changes:

• You must enter at least one rule for client connections and one rule for CMCTL connections. Omitting a rule results in the rejection of all connections for the rule type omitted.

• Oracle Connection Manager does not support wildcards for partial IP addresses. If you use a wildcard, then use it in place of a full IP address. The IP address of the client may be, for example, (SRV=*).

• Oracle Connection Manager supports only the /nn notation for subnet addresses. In Example 10-1, in the first rule, /24 represents a subnet mask that comprises 24 left-most bits. Only the first 24 bits in the client's IP address are compared with the IP address in the rule.

Example 10-1 shows a cman.ora file that contains a configuration entry for an Oracle Connection Manager called CMAN1.

CMAN1=
  (CONFIGURATION=
    (ADDRESS=(PROTOCOL=tcp)(HOST=proxysvr)(PORT=1521))
    (RULE_LIST=
      (RULE=(SRC=192.0.2.32/24)(DST=sales-server)(SRV=*)(ACT=accept)
        (ACTION_LIST=(AUT=on)(MCT=120)(MIT=30)))
      (RULE=(SRC=192.0.2.32)(DST=proxysvr)(SRV=cmon)(ACT=accept)))
    (PARAMETER_LIST=
      (MAX_GATEWAY_PROCESSES=8)
      (MIN_GATEWAY_PROCESSSES=3)))
       

Example 10-1 shows the following rules:

• In the first rule in the example, the following parameters are set:

  • SRC=192.0.2.32/24 is for client connections. It designates the IP address of the client, or source.

  • DST=sales-server designates the destination host name. The ACT parameter specifies the action, that is, accept, reject, or drop. The ACTION_LIST parameter sets attributes for a connection if it is accepted, enabling you to override default parameter settings on a connection-by-connection basis.

• In the second rule, the following parameters are set:

  • SRC=192.0.2.32 and DST=proxysvr represent the same server, indicating that Oracle Connection Manager and CMCTL must reside on the same computer.

  See Also:

  "Enabling Access Control"

Table 10-1 describes the rule-level parameters in the cman.ora file.

You can define multiple rules in the RULE_LIST. The action (ACT) in the first matched RULE is applied to the connection request. If no rules are defined, then all connections are rejected.

In the following example, client computer client1-pc is denied access to the service sales.us.example.com, but client 192.0.2.45 is granted access to the service db1.

(RULE_LIST=
  (RULE=(SRC=client1-pc)(DST=sales-server)(SRV=sales.us.example.com)(ACT=reject))
  (RULE=(SRC=192.0.2.45)(DST=192.0.2.200)(SRV=db1)(ACT=accept)))

In order to configure Oracle Connection Manager you must configure the proxy server, database, and clients. The following topics describe the general procedure:

• Configuring the cman.ora file for the Oracle Connection Manager Host
  
• Configuring Clients for Oracle Connection Manager
  
• Configuring the Oracle Database Server for Oracle Connection Manager
  
• Configuring Oracle Connection Manager in Traffic Director Mode
  

In some database connection environments, a client and database may use different versions of the IP protocol so that complete connectivity does not exist. In this case at least two hops in the connection use different versions of the IP protocol. For example, a request passes from an IPv4 source to an IPv6 destination, from an IPv6 source to an IPv4 destination, or from IPv6 to IPv6 through an IPv4 network.

You can use Oracle Connection Manager as a network bridge between IPv4 and IPv6. To serve as a bridge, Oracle Connection Manager must run on a dual-stack host configured with at least one IPv4 interface and at least one IPv6 interface.

Use the Oracle Connection Manager filtering feature to filter based on an IPv6 address. You can base rules on complete or partial IP addresses. Figure 10-1 shows the format of an IPv6 address.

Figure 10-1 IPv6 Address Format

Description of "Figure 10-1 IPv6 Address Format"

The numbers at the top of the diagram indicate the number of bits in the address. Each hexadecimal character in an IPv6 address represents 4 bits. Bits 4-16 are the Top-Level Aggregation Identifier (TLA ID) portion of the address. Bits 25-49 are the Next-Level Aggregation Identifiers (NLA ID).

For example, in the address 2001:0db8::203:BAFF:FE0F:C74B, the binary representation of the first four hexademical characters (2001) is as follows:

0010000000000001

Thus, the first 3 bits in the address are 001. The TLA ID portion of the address is 0000000000001.

The following procedure describes how to create a rules filter for IPv6 address:

1. Navigate to the cman.ora file located in the ORACLE_HOME/network/admin directory.

2. Open the cman.ora file with a text editor.

3. Create a RULE in the RULE_LIST based on IPv6 address format.

   For example, assume that the source host is an IPv6-only host with address 2001:0db8::203:BAFF:FE0F:C74B, whereas the destination is an IPv4-only host named SALESL1593. You configure Oracle Connection Manager as an IPv6-to-IPv4 bridge by creating one of the following rules:

   Type of Rule	Description	Example
   Filter based on subnet ID	Filtering is based on the 64 bits up to and including the subnet ID	(RULE = (SRC = 2001:0db8::203:BAFF:FE0F:C74B/64) (DST = SALESL1593) (SRV = SALES) (ACT = ACCEPT) (ACTION_LIST = (AUT=ON)(MOCT=10)(MIT=30)(CONN_STATE=YES)) )
   Filter based on NLA ID	Filtering is based on the 48 bits up to and including the NLA ID	(RULE = (SRC = 2001:0db8::203:BAFF:FE0F:C74B/48) (DST = SALESL1593) (SRV = SALES) (ACT = ACCEPT) (ACTION_LIST = (AUT=ON)(MOCT=10)(MIT=30)(CONN_STATE=YES)) )
   Filter based on TLA ID	Filtering is based on the 16 bits up to and including the TLA ID	(RULE = (SRC = 2001:0db8::203:BAFF:FE0F:C74B/16) (DST = SALESL1593) (SRV = SALES) (ACT = ACCEPT) (ACTION_LIST = (AUT=ON)(MOCT=10)(MIT=30)(CONN_STATE=YES)) )
   Filter based on number of bits	Filtering is based on the first 60 bits of the address	(RULE = (SRC = 2001:0db8::203:BAFF:FE0F:C74B/60) (DST = SALESL1593) (SRV = SALES) (ACT = ACCEPT) (ACTION_LIST = (AUT=ON)(MOCT=10)(MIT=30)(CONN_STATE=YES)) )

The Oracle Connection Manager Control utility enables you to administer Oracle Connection Manager. When you issue commands from the operating system, the basic syntax for this utility is as follows:

cmctl [command] [argument1 . . . argumentN] [-c instance_name]

In the preceding command, -c specifies the Oracle Connection Manager instance. You are prompted for the password if one has been set.

For example, the following command starts the listener, Connection Manager Administration (CMADMIN), and gateway processes for an instance named cman1:

cmctl STARTUP -c cman1

You can also issue Oracle Connection Manager utility commands at the CMCTL prompt. To obtain the prompt, enter cmctl with no arguments at the operating system command line. The utility may prompt for a password if Oracle Connection Manager was installed with secure installation option. When you run CMCTL, the utility is started, and you can enter the necessary commands from the CMCTL prompt. The following is an example of the CMCTL prompt:

cmctl
CMCTL> STARTUP

Oracle Connection Manager in Traffic Director Mode is a proxy that is placed between supported database clients and database instances.

A current database OCI client or supported older version OCI client (Oracle Database 11g Release 2 (11.2) and later) can connect to Oracle Connection Manager in Traffic Director Mode. Oracle Connection Manager in Traffic Director Mode provides improved high availability (HA) (planned and unplanned), connection multiplexing support, and load balancing. This feature also provides an inband client notification mechanism to deliver planned shutdown for Oracle Connection Manager (CMAN) down and service down events to the OCI client. Additional CMAN parameters must be specified in the cman.ora configuration file to configure Oracle Connection Manager in Traffic Director Mode.

To configure CMAN to act as an Oracle Connection Manager in Traffic Director Mode, new parameters such as tdm and tdm_threading_model must be added in the cman.ora configuration file. Oracle Connection Manager (CMAN) is the standard Oracle Net proxy for both Oracle RAC and non-RAC databases.

The databases that Oracle Connection Manager in Traffic Director Mode connects to must have a user, for example,tdm with the CONNECT THROUGH privilege granted to connect as application users. Oracle Connection Manager in Traffic Director Mode uses proxy authentication and connects as this user.

In this release, Oracle Connection Manager in Traffic Director Mode furnishes support for:

• Transparent performance enhancements and connection multiplexing

• Zero Application Downtime 

  • Planned database maintenance or PDB relocation 

  • Unplanned database outages for read-mostly workloads  

• High Availability of Oracle Connection Manager in Traffic Director Mode, this means no single point of failure

• Security and Isolation

Modes of Operation

• Pooled Connection mode

  This includes any application using the following database client releases:

  • OCI and Open Source Drivers (11.2.0.4 and later)

  • JDBC (12.1 and later)

  • ODP.NET (12.2 and later) 

  In addition, applications must be Database Resident Connection Pool (DRCP) aware. This means specifying (SERVER=POOLED) in the application's connect string.

• Non-pooled Connection (or Dedicated) mode

  This includes any application using database client releases 11.2.0.4 and later. In this mode, some capabilities such as connection multiplexing are not available. 

Transparent Performance Enhancements and Session Multiplexing

• Statement caching, rows prefetching and Result set caching are auto-enabled for all mode of operations.

• Database session multiplexing (pooled mode only) using the proxy resident connection pool (PRCP, a proxy mode of DRCP). Applications get transparent connect-time load balancing and run-time load balancing between TDM and Database.

• Multiple Oracle Connection Manager in Traffic Director Mode instances: applications get increased scalability through client-side connect time load balancing or load balancer (BigIP, NGINX, others)

Zero Application Downtime - Planned Database Maintenance or PDB Relocation

• Pooled mode

  Oracle Connection Manager in Traffic Director Mode responds to ONS events for planned outages and re-directs work. The connections are drained from the pool on Oracle Connection Manager in Traffic Director Mode when the request completes.

  Service relocation support is available for database release 11.2.0.4 and later.

  PDB Relocation: Oracle Connection Manager in Traffic Director Mode responds to in-band notifications when a PDB is relocated, even when ONS is not configured (18.1 and later for server only) 

• Non-pooled or Dedicated mode

  No request boundary information is received from the client. Oracle Connection Manager in Traffic Director Mode supports planned outage for many applications (as long as only simple session state and cursor state need to be preserved across the request or transaction boundaries). This involves the following:

  • Stop Service or PDB at Transaction Boundary or Leverage Oracle Database 18c  “Continuous Application Availability” to stop service at request boundary.

  • Oracle Connection Manager in Traffic Director Mode leverages “TAF Failover Restore” to reconnect and restore simple states.

Unplanned Database Outages

For both pooled and non-pooled (dedicated) modes, Oracle Connection Manager in Traffic Director Mode supports unplanned outage for read–mostly applications by leveraging “TAF Failover Restore” to restore simple session state or cursor state and replay SELECT statements and first DML statement.

Security and Isolation

Oracle Connection Manager in Traffic Director Mode provides:

• Database Proxy supporting TCP/TCPS and protocol conversion

• Firewall based on IP address, Service name and SSL/TLS wallets

• Tenant isolation in a multitenant environment

• Protection against denial-of-service and fuzzing attacks 

• Secure tunneling of database traffic across on-premises database and Oracle Cloud

High Availability of Oracle Connection Manager in Traffic Director Mode