0

I would like to understand which network requirements are needed following the least privilege needed policy in order to perform a DUPLICATE DATABASE UNTIL SCN in this scenario

My environment is Azure, and I have Oracle 12.2 and a RMAN Catalog in 19c

Production Network ( Subscription Azure Pro )

Server A -- Database A 
Server B -- Database B 

Server X -- Database X -- RMAN Catalog

Backups are taken in Servers A and B on a daily basis following an incremental strategy. The pieces are stored in a BLOB storage account which is presented as a local FS in each of the servers.

QA Network ( Subscription Azure QA )

Server C -- Database C 
Server D -- Database D

There's network connectivity at the moment between the Production Subscription and the QA Subscription, but it is blocked by a Firewall. The idea is to request the necessary firewall rules in order to perform DUPLICATE RMAN without connecting to the Target Databases ( Servers A and B ). I know it is possible, as the documentation states

If you are performing a backup based RMAN duplicate and using a recovery catalog as well, it is not required to connect to the source database as TARGET in RMAN. This technique is advantageous where network connections from the auxiliary host to the source database are restricted or prone to intermittent disruptions. In duplication without a TARGET connection, the source database is unaffected by the duplication.

If I follow this scenario, I would need, at least 2 Firewall rules between the subscriptions:

  • Network connectivity between QA Server C and RMAN CATALOG ( ssh 22 and database port )
  • Network connectivity between QA Server D and RMAN CATALOG ( ssh 22 and database port )

However, how are the backup pieces moved to the target servers ? That is the part I don't get it. If the backup pieces are stored on the Servers A and B, should I request Firewall rules also for the Production Serves A and B ?

I mean, I understand RMAN will know where the pieces are stored, but they are in the Servers A and B. Either I have to move the pieces to the target databases and use the option backup location or I am missing something.

I would appreciate some insights here, as I can't find in the documentation anything regarding on how using this technique is literally restoring the pieces.

If I did not explain something right, let me know Thank you

Improve this question

1 Answer 1

Reset to default
0

I do not remember the rman command hearth, but it should be something like:

DUPLICATE DATABASE prod TO dupdb
DBID 8675309 # DBID of source database
SPFILE
UNTIL SCN;

The "only useful information" you can find in source database is DBID. When you provide DBID using command, rman can fetch all the remaining information form catalog.

So just omit FROM ACTIVE DATABASE clause and do provide DBID to rman.

Improve this answer
6
  • my question is focus on what firewall rules should be requested, but mostly how RMAN performs the duplicate if the backup pieces are stored on each server. If I don't have network communication between the target and the source, how the process really works ? Should I move the backup pieces to the target server ?
    – Roberto Hernandez
    Oct 5, 2021 at 12:14
  • You might not need any connectivity between source and target database. When you have backups in NetBackup/TSM/shared NFS then you can fetch all information from catalog. So all you need is access to catalog. When cloning from active database then control file/spfile is pushed, but datafile is pulled. Or maybe vice-versa. But you need SqlNet connectivity to be opened both directions. .
    – ibre5041
    Oct 5, 2021 at 12:36
  • When cloning from backups then backups are fetched from backup (source database does not send them). rman either uses plugin and fetches them from (virtual) tape or from shared filesystem. Catalogue just contains filenames of backup pieces for particular DBID.
    – ibre5041
    Oct 5, 2021 at 12:36
  • Ok, therefore I can't do it. The backups are stored in Local FS using BLOB Azure storage. Azure BLOB can't be shared across different subscriptions, therefore I need to have connection to target in order for make a duplicate PITR. Thank you, that clarifies. It is what I thought anyway,
    – Roberto Hernandez
    Oct 5, 2021 at 13:12
  • I face similar issue in my garage. Yes we need to get fire wall connection to source servers as the backup piecies are stored in local FS.
    – sarat
    Oct 8, 2021 at 13:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.