Skip to main content

How to resolve ORA-24247: Network Access Denied by ACL

🌐 ORA-24247: Network Access Denied by ACL in Oracle – Explained & Resolved

When working with Oracle debugging features like DBMS_DEBUG_JDWP, you might encounter the following error:

ORA-24247: Network access denied by access control list (ACL)
ORA-06512: at "SYS.DBMS_DEBUG_JDWP", line 68
ORA-06512: at line 1

This blog will walk you through the cause and step-by-step resolution of this issue using Oracle Access Control Lists (ACLs).

❓ What Is Causing This Error?

  • ACL Restriction: The database user is trying to initiate a network connection (e.g., for debugging), but no ACL grants access to the specified IP and port.
  • Missing Privileges: The user may lack the connect or resolve privilege in the ACL linked to that host/port.

Example Failing Statement:

CALL DBMS_DEBUG_JDWP.CONNECT_TCP('10.1.1.1', '62918');

✅ Step-by-Step Solution

🔧 1. Create a New ACL

BEGIN
  DBMS_NETWORK_ACL_ADMIN.CREATE_ACL(
    acl         => 'debug_acl.xml',
    description => 'ACL for debugging',
    principal   => 'TEST',
    is_grant    => TRUE,
    privilege   => 'connect'
  );
END;
/

🔐 2. (Optional) Add PUBLIC Privilege

BEGIN
  DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(
    acl         => 'debug_acl.xml',
    principal   => 'PUBLIC',
    is_grant    => TRUE,
    privilege   => 'connect'
  );
END;
/

Note: This step is optional and should be used with caution.

🌍 3. Assign the ACL to the Host and Port

BEGIN
  DBMS_NETWORK_ACL_ADMIN.ASSIGN_ACL(
    acl         => 'debug_acl.xml',
    host        => '10.1.1.1',
    lower_port  => 62918,
    upper_port  => 62918
  );
END;
/

🔓 4. Add Resolve Privilege

BEGIN
  DBMS_NETWORK_ACL_ADMIN.ADD_PRIVILEGE(
    acl        => 'debug_acl.xml',
    principal  => 'TEST',
    is_grant   => TRUE,
    privilege  => 'resolve'
  );
END;
/

💾 5. Commit the Changes

COMMIT;

🔍 Verifying ACL Configuration

📄 View Assigned ACLs:

SELECT acl, host, lower_port, upper_port
FROM dba_network_acls;

👤 View ACL Privileges:

SELECT acl, principal, privilege, is_grant
FROM dba_network_acl_privileges;

🎯 Final Result

With these ACL entries in place, the user TEST can now successfully call:

CALL DBMS_DEBUG_JDWP.CONNECT_TCP('10.1.1.1', '62918');

No more ORA-24247 errors! 🎉

🛡️ Best Practices

  • Grant ACL privileges only to required users.
  • Be cautious with PUBLIC access.
  • Use specific host and port ranges instead of wildcards.
  • Review ACL entries regularly for security audits.

Got questions or need help automating ACL configuration with a script or Ansible? Drop a comment or reach out! 🚀

Labels:

Comments

Post a Comment

Popular posts from this blog

🚀 Automating Oracle Database Patching with Ansible: A Complete Guide

Oracle database patching has long been the bane of DBAs everywhere. It's a critical task that requires precision, expertise, and often results in extended maintenance windows. What if I told you that you could automate this entire process, reducing both risk and downtime while ensuring consistency across your Oracle estate? 💡 In this comprehensive guide, I'll walk you through a production-ready Ansible playbook that completely automates Oracle patch application using OPatch. Whether you're managing a single Oracle instance or hundreds of databases across your enterprise, this solution will transform your patch management strategy! 🎯 🔥 The Challenge: Why Oracle Patching is Complex Before diving into the solution, let's understand why Oracle patching is so challenging: 🔗 Multiple dependencies : OPatch versions, Oracle Home configurations, running processes ⚠️ Risk of corruption : Incorrect patch application can render databases unusable ⏰ Downtime requirements : Da...
Post a Comment
Read more

Oracle RAC Switchover & Switchback: Step-by-Step Guide

 Ensuring business continuity requires regular Disaster Recovery (DR) drills. This guide covers the Switchover and Switchback process between Primary (DC) and Standby (DR) databases . Pre-checks Before Performing Switchover Before starting the activity, ensure there are no active sessions in the database. If any are found, share the session details with the application team, get their confirmation, and terminate the sessions. Primary Database Name: PRIMARY Standby Database Name: STANDBY  Identify Active Sessions set lines 999 pages 999 col machine for a30 col username for a30 col program for a30 compute sum of count on report break on report select inst_id,username,osuser,machine,program,status,count(1) "count" from gv$session where inst_id=1 and program like 'JDBC%' group by inst_id,username,osuser,machine,program,status order by 1,2; select inst_id,username,osuser,machine,program,status,count(1) "count" from gv$session where inst_id=2 and program lik...
Post a Comment
Read more

Mastering Oracle RAC with SRVCTL Commands

Oracle Real Application Clusters (RAC) provide high availability, scalability, and manageability for databases. One of the most powerful tools for managing RAC databases is srvctl , a command-line utility that allows administrators to control various database services. This blog explores essential srvctl commands to help you efficiently manage Oracle RAC environments. 1. Checking Database Configuration and Status  List all available databases on the host:                  srvctl config database   Check the status of a specific database and its instances:                    srvctl status database -d <database_name>   Retrieve detailed status information about a database, including its instances and states:                    srvctl status database -d <database_name> -v 2. Stopping and Starting Databases   ...
Post a Comment
Read more