How to resolve ORA-24247: Network Access Denied by ACL

🌐 ORA-24247: Network Access Denied by ACL in Oracle – Explained & Resolved

When working with Oracle debugging features like DBMS_DEBUG_JDWP, you might encounter the following error:

ORA-24247: Network access denied by access control list (ACL)
ORA-06512: at "SYS.DBMS_DEBUG_JDWP", line 68
ORA-06512: at line 1

This blog will walk you through the cause and step-by-step resolution of this issue using Oracle Access Control Lists (ACLs).

---

❓ What Is Causing This Error?

• ACL Restriction: The database user is trying to initiate a network connection (e.g., for debugging), but no ACL grants access to the specified IP and port.
• Missing Privileges: The user may lack the connect or resolve privilege in the ACL linked to that host/port.

Example Failing Statement:

CALL DBMS_DEBUG_JDWP.CONNECT_TCP('10.1.1.1', '62918');

---

✅ Step-by-Step Solution

🔧 1. Create a New ACL

BEGIN
  DBMS_NETWORK_ACL_ADMIN.CREATE_ACL(
    acl         => 'debug_acl.xml',
    description => 'ACL for debugging',
    principal   => 'TEST',
    is_grant    => TRUE,
    privilege   => 'connect'
  );
END;
/

🔐 2. (Optional) Add PUBLIC Privilege

BEGIN
  DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(
    acl         => 'debug_acl.xml',
    principal   => 'PUBLIC',
    is_grant    => TRUE,
    privilege   => 'connect'
  );
END;
/

Note: This step is optional and should be used with caution.

🌍 3. Assign the ACL to the Host and Port

BEGIN
  DBMS_NETWORK_ACL_ADMIN.ASSIGN_ACL(
    acl         => 'debug_acl.xml',
    host        => '10.1.1.1',
    lower_port  => 62918,
    upper_port  => 62918
  );
END;
/

🔓 4. Add Resolve Privilege

BEGIN
  DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(
    acl        => 'debug_acl.xml',
    principal  => 'TEST',
    is_grant   => TRUE,
    privilege  => 'resolve'
  );
END;
/

💾 5. Commit the Changes

COMMIT;

---

🔍 Verifying ACL Configuration

📄 View Assigned ACLs:

SELECT acl, host, lower_port, upper_port
FROM dba_network_acls;

👤 View ACL Privileges:

SELECT acl, principal, privilege, is_grant
FROM dba_network_acl_privileges;

---

🎯 Final Result

With these ACL entries in place, the user TEST can now successfully call:

CALL DBMS_DEBUG_JDWP.CONNECT_TCP('10.1.1.1', '62918');

No more ORA-24247 errors! 🎉

---

🛡️ Best Practices

• Grant ACL privileges only to required users.
• Be cautious with PUBLIC access.
• Use specific host and port ranges instead of wildcards.
• Review ACL entries regularly for security audits.

Got questions or need help automating ACL configuration with a script or Ansible? Drop a comment or reach out! 🚀