OCI Security rules for SQL Always On

Posted on Jan, 14 2021 By Maciej Dadok-Grabski

Security rules in Oracle Cloud Infrastructure (OCI) allow you to specify inbound and outbound traffic rules for your VCN (Virtual Cloud Network). They operate at the subnet level and are used to control traffic flow between resources within the VCN, and between the VCN and the internet.

Security rules consist of the following components:

• Protocol: The protocol that the rule applies to, such as TCP or UDP.
• Source: The source of the traffic, which can be a range of IP addresses, a specific security list, or all sources.
• Destination: The destination of the traffic, which can be a range of IP addresses, a specific security list, or all destinations.
• Destination port range: The range of destination ports that the rule applies to.
• Action: The action to take when the rule is matched, such as allowing or denying the traffic.

Security rules are evaluated in the order that they are listed, and the first rule that matches the traffic is applied. You can use security rules to allow or deny specific traffic, or to allow all traffic and then use other security measures, such as network security groups (NSGs) or firewall appliances, to control and monitor the traffic.

Active Directory

As a best practice, all the domain controllers should be in a subnet that either has no external IP addresses or has no access from the internet. As a result, you might want to enable OCI security rules to communicate between your subnets and the Active Directory subnets. However, be aware that this still opens potential paths of attack from those subnets. Therefore, it’s a best practice to open only the following ports between the subnets:

OCI security rules for Domain Controllers subnet

Further, you need to open ports for SQL Server Availability Groups.

OCI security rules for SQL Server Always On subnet

References:

• https://docs.oracle.com/en-us/iaas/Content/Network/Concepts/securityrules.htm