【RAC】RAC 实现IP访问控制

   关于oracle实现ip 访问控制的资料见我的另一篇文章《 sqlnet.ora 访问控制策略》

相对与单节点的oracle ，11gr2 rac中，listener是 配置在 GRID_HOME，而不是ORACLE_HOME,所以我们要修改的sqlnet.ora文件是在GI_HOME/network/admin目录下的而非ORACLE_HOME/network/admin 目录。

实验环境：

数据库版本 11.2.0.1.0

rac1 10.250.7.225

rac2 10.250.7.249 vip 10.250.7.112

rac3 10.250.7.241

1 最初的配置，tcp.invited_nodes只包含rac1，rac2两个节点的ip,不包含rac3的ip

grid@rac1:/opt/11202/11.2.0/grid/network/admin>vim sqlnet.ora 

NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)

tcp.validnode_checking=yes

#允许访问的ip

tcp.invited_nodes =(10.250.7.225,10.250.7.249)

ADR_BASE = /opt/rac/grid

grid@rac2:/opt/11202/11.2.0/grid/network/admin>vim sqlnet.ora       

NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)

tcp.validnode_checking=yes

#允许访问的ip

tcp.invited_nodes =(10.250.7.249,10.250.7.225)

ADR_BASE = /opt/rac/grid

2 在rac3 上进行测试tnsping rac1 rac2 

oracle@rac3:/opt/oracle/11.2.0/alifpre/network/admin>tnsping rac1

TNS Ping Utility for Linux: Version 11.2.0.1.0 - Production on 15-DEC-2011 16:19:46

Copyright (c) 1997, 2009, Oracle.  All rights reserved.

Used parameter files:

/opt/oracle/11.2.0/alifpre/network/admin/sqlnet.ora

Used TNSNAMES adapter to resolve the alias

Attempting to contact (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = 10.250.7.225)(PORT = 1521))) (CONNECT_DATA = (SID = rac1)))

TNS-12547: TNS:lost contact

oracle@rac3:/opt/oracle/11.2.0/alifpre/network/admin>tnsping rac2

TNS Ping Utility for Linux: Version 11.2.0.1.0 - Production on 15-DEC-2011 16:19:48

Copyright (c) 1997, 2009, Oracle.  All rights reserved.

Used parameter files:

/opt/oracle/11.2.0/alifpre/network/admin/sqlnet.ora

Used TNSNAMES adapter to resolve the alias

Attempting to contact (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = 10.250.7.112)(PORT = 1521))) (CONNECT_DATA = (SID = rac2)))

TNS-12547: TNS:lost contact

分别修改rac1 rac2 的 sqlnet.ora文件

grid@rac2:/opt/11202/11.2.0/grid/network/admin>vim sqlnet.ora       

NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)

tcp.validnode_checking=yes

#允许访问的ip

tcp.invited_nodes =(10.250.7.249,10.250.7.241)

ADR_BASE = /opt/rac/grid

3 修改之后必须重启监听，(这个对于生产库比较麻烦,最造成操作期间的新连接失败)

grid@rac2:/opt/11202/11.2.0/grid/network/admin>srvctl stop listener 

grid@rac2:/opt/11202/11.2.0/grid/network/admin>srvctl start listener

grid@rac1:/opt/11202/11.2.0/grid/network/admin>vim sqlnet.ora        

NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)

tcp.validnode_checking=yes

#允许访问的ip

tcp.invited_nodes =(10.250.7.225,10.250.7.241)

ADR_BASE = /opt/rac/grid

重启监听！

grid@rac1:/opt/11202/11.2.0/grid/network/admin>srvctl stop listener  

grid@rac1:/opt/11202/11.2.0/grid/network/admin>srvctl start listener

4 再次进行测试：

oracle@rac3:/opt/oracle/11.2.0/alifpre/network/admin>tnsping rac2

Attempting to contact (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = 10.250.7.112)(PORT = 1521))) (CONNECT_DATA = (SID = rac2)))

OK (0 msec)

oracle@rac3:/opt/oracle/11.2.0/alifpre/network/admin>tnsping rac1

Attempting to contact (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCP)(HOST = 10.250.7.225)(PORT = 1521))) (CONNECT_DATA = (SID = rac1)))

OK (10 msec)

成功配置！