• An ACL contains entries, which are called "ace", for "access control entries".

• You add entries to an ACL using the IP_ADD_ACE Procedure and IP_ADD_PDB_ACE Procedure. After calling these procedures, you call the COMMIT_ACL Procedure to send the updated ACL to the listeners. Similarly, if you remove entries from an ACL using the IP_REMOVE_ACE Procedure, IP_REMOVE_ACL Procedure, IP_REMOVE_PDB_ACE Procedure, or IP_REMOVE_PDB_ACL Procedure, you need to call theCOMMIT_ACL Procedure to update the ACL on the listeners.

• Access control must be enabled using the new FIREWALL endpoint attribute and the new LOCAL_REGISTRATION_ADDRESS_listenerName parameter. The configuration can be done manually in listener.ora or through the Server Control Utility (SRVCTL). Refer to the Oracle Database Net Services Reference and the Oracle Real Application Clusters Administration and Deployment Guide for configuration instructions.

• You can query the IP_ACL table to show the committed ACLs. But to see the ACLs that have been sent to the local listeners, you have to query the V$IP_ACL or GV$IP_ACL view. The IP_ACL table can contain ACLs that are not in [G]V$IP_ACL because the database services for those ACLs were not running at the time of the commit. When the services are running, you can call the COMMIT_ACL procedure again to send the committed ACLs in the IP_ACL table to the local listeners.

  In an Oracle RAC environment, GV$IP_ACL can be used to query ACLs across the database cluster, and V$IP_ACL to query ACLs in the connected instance.

The following example adds three access control entries to the ACL and commits them.

## Connect to DBSFWUSER
SQL> connect dbsfwuser/Welcome1
Connected.

## Create an ACL for database service SVC1
SQL> exec dbms_sfw_acl_admin.ip_add_ace('svc1','192.168.12.1');
PL/SQL procedure successfully completed.

SQL> exec dbms_sfw_acl_admin.ip_add_ace('svc1','192.168.12.2');
PL/SQL procedure successfully completed.

SQL> exec dbms_sfw_acl_admin.ip_add_ace('svc1','test02.example.com');
PL/SQL procedure successfully completed.

## Commit the ACLs to the DB ACL table.
## This sends the ACLs for running services to ALL local Listeners
SQL> exec dbms_sfw_acl_admin.commit_acl;
PL/SQL procedure successfully completed.

The following example retrieves the ACLs committed from the previous example.

SQL> select * from ip_acl;
SERVICE_NAME              HOST
-----------------------   -------------------
"SVC1.EXAMPLE.COM"        192.168.12.1
"SVC1.EXAMPLE.COM"        192.168.12.2
"SVC1.EXAMPLE.COM"        TEST02.EXAMPLE.COM

## View ACLs sent to the local Listeners
## NOTE: ACLs are sent ONLY to running services
SQL> select * from v$ip_acl;
SERVICE_NAME              HOST                   CON_ID
----------------------    -----------------      --------
SVC1.EXAMPLE.COM          192.168.12.1           1
SVC1.EXAMPLE.COM          192.168.12.2           1
SVC1.EXAMPLE.COM          TEST02.EXAMPLE.COM     1

The following example adds access control entries for pluggable database "PDB1" using various host formats.

SQL> exec dbms_sfw_acl_admin.ip_add_pdb_ace('pdb1','192.168.12.3');
PL/SQL procedure successfully completed.

SQL> exec dbms_sfw_acl_admin.ip_add_pdb_ace('pdb1','192.168.12.0/23');
PL/SQL procedure successfully completed.

SQL> exec dbms_sfw_acl_admin.ip_add_pdb_ace('pdb1','192.168.12.*');
PL/SQL procedure successfully completed.

SQL> exec dbms_sfw_acl_admin.commit_acl;
PL/SQL procedure successfully completed.