Networking Overview - books.mhprofessional.combooks.mhprofessional.com/downloads/products/... · In...

Chapter1

Networking Overview

01_CH01/VelpuriX 2/8/02 10:13 AM Page 3

hat does it mean to say that the Internet has become so prominent in the last decade? It means that humans are perfecting the art ofnetworking computers. Being part of a network helps you to accessinformation on other computers, lets other people access yourinformation, and allows people on the network to share devices

like printers.There are several ways to connect from one computer to another computer or to

a network. A typical network connection may be a

� Link between the input/output (I/O) ports of two computers using a singlecable.

� Private network using a modem or an Integrated Services Digital Network(ISDN) adapter or a Network Interface Card (NIC).

� Network using a Virtual Private Network (VPN) connection.

In this chapter we give you an overview of network configurations and thesolutions provided by Oracle to manage networks. The topics covered in thischapter include

� Networking challenges in the business environment

� Network configurations

� Oracle’s solution to networking issues

Networking Challenges in the Business EnvironmentNetworking has changed drastically over the last few years. The importance andpresence of networks are growing. With the growth of the e-commerce model, newbusiness requirements have been created. The success of this e-commerce businessdepends on how business Web sites provide reliable connectivity and availability.The sites should be up and running around the clock. To meet the thousands ofsimultaneous Internet connections, scalability, performance, reliability, and securityare key factors to be considered.

In this business model, implementing a successful networking environment is abig challenge. Many issues have to be considered before designing a networkenvironment. A few of these issues are discussed in the following section.

4 OCP Oracle 9i Database: Fundamentals I1 Exam Guide

W


Considerations for Configuring the Network EnvironmentProper configuration of the network is most crucial in maintaining a network for anyenterprise. Prior to setting up the network environment, you must consider variousissues that would influence the design of the network. The type of network requireddepends on the business rules. Is it a small network with few clients or a complexnetwork with a large number of clients and servers? The protocols supported by theenvironment also need to be identified. You will need to assess if your networkrequires a single protocol or if you would require multiple protocol support.

You must understand and plan for the future growth of your network as well.This would have a profound impact depending on whether the network would bestatic or expanding dynamically. The various available configuration options forsetting up the network environment have to be clearly defined and the best optionchosen. You should also consider the number of routers, switches, or hubs that yourequire for your intranet. If connecting to the Internet, you should consider thevarious security options.

Maintaining the NetworkEstimating the growth of your network and implementing methods to successfullyincorporate the changes in the network environment are key to successfullymaintaining your network. You must figure out the growth of the network byunderstanding in advance the type of technology to be implemented: client-server(or simple), N-tier, or complex networks. You must estimate the number of clientsand servers to be added to the network and further draw statistics pertaining to thefrequency at which upgrades occur to the network.

Tuning the NetworkTuning the network for the better propagation of data across different nodes is animportant step in successful maintenance. The process involving effective tuning,troubleshooting, and monitoring depend greatly on the number of users,transactions, and nodes; the location of the node’s routers, switches, hubs; and theavailability of the network.

Implementing Security in the NetworkThe most crucial aspect of a network is the implementation of secured links acrossnodes. This primarily is a business requisite. You must know the level of security thatneeds to be implemented and whether the transmission of data is secure dependingon its sensitivity. You should be aware of the tools available to you for implementingvarious levels of network security.

Networking Overview 5


Integrating Legacy SystemsThe factors involving the integration of legacy systems with the networkingenvironment are significant. You must be aware of the various proprietary protocolssupported with the legacy systems and then work towards further integration.

All the previous issues are just a few among the many that must be consideredwhen designing a networking environment.

Network ConfigurationsDepending on the business requirements, you can establish a simple network, an N-tier network, or a complex network. The configuration you choose should dependon your business requirements. A brief description of each of the previouslymentioned network configurations is provided in this section.

Simple NetworkIn a simple network, the clients connect directly to the database server using a givennetwork protocol. The simple network is also referred to as the client-serverarchitecture or the two-tier architecture. The client and server should use the samenetwork protocol. The simple network environment is best suited for an environmentwhere the number of clients is small. With the PC revolution, the client-serverarchitecture has become very popular with businesses.

Although it is very easy to manage a client-server environment, the simplenetwork is not scaleable. If you add a large number of clients to the network, and allthe clients are accessing the database server, the server may not be able to handleall the requests, as there will be bottlenecks. As a result, this will become anineffective network. This is a major drawback of the simple network architecture.The simple network is still very much preferred for small businesses with a smallnumber of clients and servers. Figure 1-1 shows the simple network architecture.

NOTEA simple network in a large and widely distributedenvironment is very difficult to manage with respectto software version control, security, andconfiguration maintenance.

N-Tier NetworkThe drawback of the simple network can be overcome with the N-tier networkarchitecture, as it introduces one or more servers or agents between the client andthe database server. The middle tier is known as the agent or the application tier. The



N-tier network provides for centralized maintenance. If you have an environmentwhere hundreds or thousands of users require simultaneous connections to theserver, the N-tier architecture would suit you best.

The agent in the N-tier network provides translation services to the client-serverenvironment or acts as a bridge between protocols. The agent also acts as atransaction-processing monitor to balance the load of requests between servers andprovides the intelligent agent services like mapping a request to a number ofdifferent servers, collating the results and returning a single response to the client.Figure 1-2 shows the N-tier network architecture.


FIGURE 1-1. Simple network architecture

FIGURE 1-2. N-tier network architecture


Complex NetworkIf your business requirement includes the maintenance of large-scale distributeddatabase systems, it requires different hardware and operating systems usingmultiple protocols, and these systems are located in different geographicallocations, you will need to design a complex network. This kind of solution issuitable for large and global companies in a heterogeneous environment. Figure 1-3 show the complex network architecture.


FIGURE 1-3. Complex network architecture

Apple Talk

DECIPX/SPX

TCP/IP

IBM/SNA


Oracle’s Solution to Networking IssuesTo interact with the Oracle database server from the client applications, a method ofconnection is required. Oracle offers Oracle Net to provide the connectivitysolutions in a distributed, heterogeneous computing environment regardless ofvendor, operating systems, or hardware architecture. It eases the complexities ofnetwork configurations, management, and performance. It also improves thediagnostic capabilities. Oracle Net should be located on each of the machines inthe network. Once the network session establishes a connection between a clientand server, Oracle Net acts as a data courier between the two. Oracle Net is thenetworking solution for Oracle9i.

Oracle Net also provides a data conversion facility between two nationallanguage character sets. For example, interaction between two machines that usedifferent character sets, such as a European language on one machine and an Asianlanguage on another machine, is possible with Oracle Net. It can also provideinteraction between different computer architecture character sets, such as ASCIIand EBCDIC. The extensive national-language character set enables Oracleapplications to be deployed globally on any environment.

Oracle Net FeaturesOracle Net sits on top of a given protocol, providing transparency to the machinesthat are conversing. This section discusses the connectivity, manageability,scalability, and security features of Oracle Net.

ConnectivityOracle Net provides for transparent client-server application connectivity andincludes a rich set of networking services. It is responsible for establishing andmaintaining network sessions between a client and the database server and forexchanging data between them. Oracle Net provides support to most of theindustry-standard network protocols.

Oracle Net’s data conversion is invisible to the user and to the application.Without any extra burden on the network infrastructure, Oracle Net can interoperateacross different types of computers, operating systems, and networks totransparently connect any combination of PC, UNIX, and legacy system.

Oracle Net is layered on top of a network protocol that determines howapplications access the network and how data is subdivided into packets fortransmission across the network.

NOTESPX/IPX will no longer be supported with Oracle9i.



ManageabilityFor easy configuration and management of networking components, Oracle Netoffers a number of manageability features. This section discusses some of thesefeatures.

Location Transparency To access an Oracle database, clients need to provide aservice name to identify this database. The information about the database serviceand its location in the network is transparent to the client because the informationneeded to make a connection is stored in a repository. The repository can berepresented by one or more naming methods. Oracle Net offers several types ofnaming methods that support a localized configuration on each client or acentralized configuration that can be accessed by all the clients in the network.Easy-to-use graphical user interfaces (GUIs) enable you to manage data stored in thenaming methods.

Centralized Configuration and Management To manage huge networkingenvironments, administrators need to be able to easily specify and modify thenetwork configuration in a centralized repository. To meet this requirement, OracleNet configuration provides the capability to store information in an LightweightDirectory Access Protocol (LDAP)-compliant directory service.

The support of LDAP-compliant directory servers provides a centralized vehiclefor managing and configuring a distributed Oracle network. The directory can act asa central repository for all data on database network components, user andcorporate policies, and user authentication and security, thus replacing client-sideand server-side localized configuration files. To access this information, all systemson the heterogeneous network can refer to the directory.

Easy Client Configuration The key to managing huge networks with potentiallythousands of clients is to have the ability to change network preferences easily.Oracle Net provides a variety of naming solutions designed to give customers a highdegree of flexibility in how they integrate Oracle services into their dynamicenvironments. The naming solutions for a dynamic, enterprise-wide network areOracle Names and LDAP-based directory services.

Trace Assistant The Trace Assistant is a diagnostic tool that decodes Oracle Nettrace files and provides an analysis of the network to identify possible bottlenecks.You should use the Trace Assistant when you have problems while configuring ormaintaining your networks. This tool will be obsolete in future releases of Oracle.

Internet and Intranet ScalabilityOracle Net provides scalability features that enable you to maximize systemresources and improve performance. These features are described here.



Shared Server Oracle’s shared server (previously called Multi-threaded Server[MTS]) architecture increases the scalability of applications and the number ofclients simultaneously connecting to the database. It can enable existingapplications to scale up without making any changes to the application itself.Shared server is ideal for configurations with a large number of connections, thereason being that it reduces the number of processes that the server OS has tomanage in contrast to a dedicated server. Shared server is well suited for bothInternet and intranet environments.

Virtual Interface The Virtual Interface (VI) protocol reduces the overhead ofTCP/IP by eliminating intermediate copies and by transferring most of the messagingburden away from the CPU and onto the network hardware. The result is a low-latency, high-throughput interconnect protocol that reduces the amount of CPUcycles dedicated to messaging. This increases the performance between applicationWeb servers and the Oracle databases.

Network SecurityThe significant factor influencing the database user in a secure network environmentis granting and denying access to the database. Oracle Net enables various databaseaccess controls by enabling firewall access control and protocol access control.Oracle’s Connection Manager (CMAN) can also be configured to grant or rejectaccess to a particular database service or you can alternately implement the systemfirewall access control mechanism. You can enable various filtering rules byspecifying the clients’ or servers’ hostnames or IP addresses or the database servicenames. For information on Connection Manger functionality, see the “ConnectionManager” section later in this chapter.

Oracle NamesOracle Names reduces the administrative overhead, which is primarily due toconfiguring and maintaining client-server networks. It centrally defines the serviceaddresses, inter-database links, net service names (aliases), and client configurationprofiles through the Oracle Enterprise Manager utility. Oracle Names supportshierarchical naming structures. It enables the enterprises to set up the administrativeauthority to be distributed among different regions. Figure 1-4 shows the OracleNames server architecture.

Connection Manager (CMAN)Oracle CMAN is a router that enables the propagation of requests to either theintermediate destination or to the destination server. CMAN enables the clients totake advantage of its advanced capabilities such as connection multiplexing, accesscontrol, and protocol conversion. CMAN can filter connections based on origin,



destination, or database service names. This is an important configuration feature torestrict remote access to data.

CMAN can provide access to services via the Internet while maintaining totalaccess control using the access control feature. This feature enables you to controlaccess to specific servers in a network where TCP/IP is predominant. This can beachieved by setting the appropriate “accept” rules. Clients who need to establish aconnection must meet the criteria of the rules set in order to gain access to theservice. Figure 1-5 shows the CMAN architecture.

NOTEMultiplexing using CMAN is only available forTCP/IP.


FIGURE 1-4. Oracle Names server

Database

Registration

Oracle NameServer

ResponseRequest Conne

ction

Client


Oracle Advanced SecurityWith the continuing growth of distributed systems involving numerous databasesand applications comes an ever-increasing challenge of user authentication and usermanagement. To meet this challenge of enterprise user management, Oracleprovides methods of encryption, authentication, and authorization, along withintegrated security and directory services, called the Oracle Advanced Security.

Oracle Advanced Security runs on top of Oracle Net to deliver securitysolutions to the Oracle network and beyond through the integration of industrystandards for encryption, authentication, and remote access. Oracle providessecurity solutions by offering Secure Sockets Layer (SSL) and Remote AuthenticationDial-In User Service (RADIUS) protocol adapters, enterprise user management byoffering integrated security, and directory services through the Oracle InternetDirectory (OiD).


FIGURE 1-5. CMAN

Client

Client

Client

WebBrowser

WebBrowser

OracleServer

Server

Analysis ConnectionIntranet

Internet

Internet

Intranet

CMAN


Oracle Advanced Security provides a comprehensive suite of security features toprotect enterprise networks and securely extend corporate networks to the Internet.It provides a single source of integration with network encryption and authenticationsolutions, single sign-on services, and security protocols. By integrating industrystandards, it delivers unparalleled security to the Oracle network.

Features of the Oracle Advanced SecuritySome of the features provided by the Oracle Advanced Security Option (ASO) aredescribed in this section.

Data Privacy Oracle Advanced Security protects the privacy of datatransmissions through encryption methods like RSA encryption, DES encryption,and Triple-DES encryption. The selection of the network encryption method is a userconfiguration option, providing varying levels of security and performance fordifferent types of data transfers.

Data Integrity To guarantee that the contents of the message received were notaltered from the contents of the original message sent, Oracle Advanced Securitycan generate a cryptographically secure message digest using MD5 or SHAencryption algorithms and include it with each message sent across a network.

Authentication To verify the identity of a user or a device in a computer system,Oracle Advanced Security provides enhanced user authentication through severalthird-party authentication services as well as the use of SSL and digital certificates.Many Oracle Advanced Security authentication methods use centralizedauthentication. This can give you a high confidence in identifying users, clients, andservers in a distributed environment. Having a central facility authenticate allmembers of the network (clients to servers, servers to servers, and users to bothclients and servers) is one effective way to address the threat of nodes on a networkfalsifying their identities.

Single Sign-On Single sign-on lets a user access multiple accounts andapplications with a single password. Once authenticated, subsequent connectionsto the database or applications occur transparently. Oracle Advanced Securitysupports Kerberos, CyberSafe, DCE, and SSL-based single sign-on authentication.

Authorization Using the authentication methods supported by Oracle AdvancedSecurity significantly enhances user authorization, a function of Oracle9i roles andprivileges. For example, on certain operating systems, such as Solaris, OracleAdvanced Security supports authorization with DCE.



LDAP-Based Directory ServiceOracle Net supports a centralized, LDAP-compliant enterprise directory-servicesolution for managing network resources. The support for directory services, such asOiD, will provide a centralized vehicle for managing and configuring a distributed,heterogeneous network.

Before this chapter ends, we would like to briefly discuss a few importantfeatures that will be referred to in later chapters.

Oracle Internet Directory (OiD)OiD is a standards-based LDAP directory that leverages the scalability, highavailability, and security features of the Oracle database. OiD enables you toefficiently administer the employees, customers, suppliers, and partners that needaccess to your applications. The product provides a single, centralized repository forall user data. It enables sites to manage user identities, roles, authorization andauthentication credentials, and application-specific preferences and profiles in asingle repository.

Secure Sockets Layer (SSL)SSL is an industry-standard protocol for secure network connections over theInternet. Oracle Advanced Security implements the SSL protocol. It secures OracleNet connections and other protocols as well, including IIOP connections used withthin clients and Enterprise Java Beans. SSL uses digital certificates and a public keyinfrastructure (PKI) to provide the major pieces of security such as the authenticationof people and machines, encryption techniques for privatizing, and checksums forprotecting against data modification or snooping.

Remote Authentication Dial-In User Service (RADIUS)The RADIUS protocol is an industry standard for remote authentication andcontrolled access to networks. It is widely accepted because of its flexibility, itscapability to handle many devices, and its capability to provide user authentication,authorization, and accounting between a network client and an authenticationserver. The major benefit of RADIUS is it instantly integrates into existing systems bymaking the Oracle database server a RADIUS client, thereby capitalizing on theinfrastructure and investment that organizations have already made. The otherbenefit is the authentication of Oracle users by enabling support for authenticationtechnologies such as token cards, smart cards, and other challenging responsemechanisms.

Oracle Wallet ManagerThe Wallet Manager, which is part of Oracle’s SSL implementation, gives users (andadministrators of data servers) complete control over the contents of their wallets.



An Oracle wallet contains a user’s credentials, which are used for authenticating theuser to multiple services, such as data servers and application servers. The contentsof the wallet are encrypted with a key based on a user-specified password. Since thewallet is encrypted, it may be stored locally on a user’s disk or centrally in adirectory accessible via LDAP.

The user only needs to remember one password, which opens the wallet toaccess his or her credentials that can then be used to authenticate the user tomultiple services. And those services don’t need to store and manage localpasswords for users any longer.

Chapter Questions1. Which of the following statements is true?

A. Oracle Net resides only on client applications.

B. Oracle Net resides only on client machines.

C. Oracle Net resides on both client machines and database servermachines.

D. Oracle Net resides on the management server.

2. As a DBA in a mid-sized company, you realize that the number of usersaccessing the client-server application has increased dramatically. Whatare your valid options to scale the application to meet this increaseddemand?

A. Implement simple network architecture.

B. Implement N-tier network architecture.

C. Migrate the application to a server.

D. Migrate the application to each client.

3. Which of the following architectures is used to support the agent or theapplication tier?

A. Simple

B. Two-tier

C. N-tier

D. Client-server



4. Which of the following options would you choose to implement controlledaccess using remote authentication for your networks?

A. OiD

B. RADIUS

C. Wallet Manager

D. Oracle Names server

5. Which of the following reduces the overhead of using the TCP/IP protocol?

A. OCI

B. VI

C. UPI

D. SSL

6. Which of the following is not part of the functionality of Oracle Names?

A. Securing network connections over the Internet

B. Defining service addresses

C. Defining database links

D. The configuration and maintenance of client-server networks

7. Which Oracle Net tool would you use to analyze your Oracle networktrace files?

A. Net Manager

B. Connection Manager

C. Trace Assistant

D. Net Assistant

E. Names Server

8. Which of the following two options would you consider when estimatingthe anticipated workload during the design of your networkingenvironment?

A. User privileges

B. User training

C. Number of network administrators



D. Number of nodes

E. Network maintenance

F. Number of transactions

9. You must ensure that client requests through the network to remoteservers in your N-tier architecture are handled. Which middle-tiercomponent is placed between the client and the server to enable this?

A. Gateway

B. Adapter

C. Agent

D. Protocol

10. Which type of network is represented as a computational architecturewith client processes communicating directly with server processes?

A. N-tier

B. Complex

C. Simple

D. Single

E. Middle-tier



Answers to Chapter Questions1. C. Oracle Net resides on both client machines and database server

machines.

Explanation To interact with the server, client machines need Oracle Net.Similarly, the server needs Oracle Net to understand the requests from the client. So,Oracle Net should reside both on the server and client machines.

2. B. Implement a N-tier architecture.

Explanation An N-tier architecture has an agent placed between the server and theclient that can be used to load balance connection requests.

3. C. N-tier

Explanation Two-tier, simple networks and client-server mean the same thing; theclient communicates directly with the server. Oracle Names is a method used forname resolutions. An N-tier architecture has an agent placed between the serverand the client.

4. B. RADIUS

Explanation The Remote Authentication Dial-In User Service (RADIUS) protocol isan industry standard for remote authentication and controlled access to networks.

5. B. VI

Explanation Virtual Interface (VI) is introduced in Oracle 9i to reduce the overheadof TCP/IP. VI reduces the burden on TCP/IP by eliminating intermediate copies andby transferring most of the messaging burden away from the CPU and onto thenetwork hardware.

6. A. Securing network connections over the Internet

Explanation The last three options are part of the functionality of Oracle Names.Securing network connections over the Internet is done using SSL.

7. C. Trace Assistant

Explanation The Trace Assistant is a diagnostic tool that decodes Oracle Net tracefiles and provides an analysis of the network to identify possible bottlenecks.



8. D. and F. Number of nodes and the number of transactions

Explanation The number of transactions that the servers must process and the totalnumber of nodes that will be available provide a good estimate for future workload.

9. C. Agent

Explanation Agents are introduced in the N-tier architecture. They offer highscalability, request translation, and support of intelligent agent services.

10. C. Simple

Explanation A simple two-tier architecture is comprised of a client and a serverconnected through a network. In this environment both the client and the server usea similar protocol.



Networking Overview - books.mhprofessional.combooks.mhprofessional.com/downloads/products/... · In...

Documents

Transcript of Networking Overview - books.mhprofessional.combooks.mhprofessional.com/downloads/products/... · In...