Oracle Audit Vault and Database Firewall (AVDF) Architecture and Deployment

Oracle AVDF Solution Overview

Oracle Audit Vault and Database Firewall (Oracle AVDF) is a comprehensive security platform designed to audit databases and monitor network-based activities. It serves as a central hub for managing the security posture of heterogeneous environments, providing visibility into both Oracle and non-Oracle assets across on-premises and Oracle Cloud Infrastructure (OCI) deployments.

Oracle AVDF supports the following target types:

• Databases: Oracle, Microsoft SQL Server, MySQL, and other non-Oracle database systems.
• Operating Systems: Monitoring of host-level activities for Linux, Unix, and Windows.
• Directory Services: Auditing of user management and access through services like Active Directory.
• Custom Targets: Handling of specialized data formats such as XML and JSON files.

The solution is highly flexible, available for traditional on-premises installation or via the Oracle Cloud Marketplace for rapid provisioning on OCI.

Core Architectural Components

The AVDF architecture is separated into specialized components to ensure both security and data processing performance.

• Audit Vault Server (The Central Brain):
  This component runs on the Oracle Linux operating system. It includes a data repository based on Oracle Database to manage the following features:

-     Audit data from Agents and network events from the Firewall.

-  Policies, system configurations, and user management data. Important system and network settings are also stored at the operating system level.

- A comprehensive reporting system: Activity, Compliance, Summary, and Security Assessment reports.

- Administration and Role Separation: Clear separation between Administrators (configuration and system management) and Auditors (monitoring, reporting, and alert handling).

- Storage and Backup: Supports periodic backup to NFS locations (recommended) or local disks. Historical data can be automatically archived to NFS (recommended), SCP, or SMB protocols.

• Database Firewall (The Network Shield):
  Operates as a SQL checkpoint for Clients/Applications. Based on policies, it performs five actions: Allow, Log, Alert, Substitute, and Block. All network events are sent from the Firewall to the Audit Vault Server for analysis.
• Audit Vault Agent & Agentless Collection:
  The data collection mechanism depends on the trail type:

-     Audit Vault Agent: Collects data from TABLE, DIRECTORY, SYSLOG, and EVENT LOG trails. In particular, for TRANSACTION LOG type collection (capturing “before and after” values), architects should note that both Audit Vault Agent and Oracle GoldenGate must be deployed on the same Remote Host to collect data from “integrated extract” files.

-     Agentless Collection: A built-in service within the Audit Vault Server, supporting up to 20 trails. Applicable only for Oracle Database (TABLE trails) and MS SQL Server (DIRECTORY trails).

-       Supported Target Types:

• Databases (Oracle, MS SQL Server, MySQL, SAP Sybase, etc.).
• Operating systems (Linux, Windows, Solaris, AIX).
• Directory Services (Active Directory, OpenLDAP).
• Custom targets (XML, JSON). 

Database Firewall Deployment Modes

Monitoring/Blocking Mode (Proxy Mode)

This is the only mode that allows direct intervention to Block or Substitute SQL traffic. Clients connect to the Firewall instead of the database; from the database server’s perspective, the Firewall is recognized as the client.

• Strategic Consideration:
  To optimize security, architects should configure the database to reject all connections that do not originate from the Database Firewall.
• NIC Configuration Models:

• Non-separated Proxy:
  Uses a single NIC called the Database Firewall management interface for both SQL traffic and administration. This may become a performance bottleneck and a security risk under heavy traffic loads.
• Non-separated Proxy with Dedicated NIC:
  Separates into two interfaces:

• Database Firewall traffic proxy (located in the database subnet for SQL processing).
• Database Firewall management interface (located in the management subnet).

• Network Separation Proxy:
  Uses a minimum of three NICs to fully separate the Client subnet, Database subnet, and Management subnet.

Monitoring Mode (Out-of-Band - OOB)

The Firewall passively monitors through mirrored traffic from a SPAN port, Network TAP, or Packet Replicator. This mode can only monitor and generate alerts; it cannot intervene (Block/Substitute) in the actual SQL traffic flow.

Monitoring Mode (Host Monitor)

Used when external network devices cannot be configured. A Host Monitor Agent is installed directly on the database server to capture traffic from the internal NIC and securely send it to the Database Firewall.

When to Choose Host Monitor Instead of Out-of-Band?

Out-of-Band deployment is generally the preferred approach because it maintains monitoring independence and avoids additional resource consumption on the database server.However, Host Monitor becomes mandatory in Cloud environments (where there is no access to physical switch configurations) or tightly restricted network infrastructures where SPAN/TAP configuration is not possible..

Ensuring Continuity with High Availability (HA)

To maximize reliability, Oracle AVDF supports a Primary-Standby model for both the Audit Vault Server and the Database Firewall.

• Architects can deploy HA for the Server only, the Firewall only, or both simultaneously to ensure end-to-end continuity of monitored data. 
• When the Primary system fails, the Standby system automatically takes over, ensuring uninterrupted audit logging and continued enforcement of network security policies. 

Conclusion

Oracle AVDF provides a comprehensive security solution by combining real-time network monitoring (Firewall) with in-depth audit log analysis (Audit Vault). This combination enables enterprises not only to detect abnormal external behaviors but also to tightly control internal access, meeting the strictest compliance standards in modern data environments.

References:

· Oracle Documentation. (2026). “Oracle Audit Vault and Database Firewall Documentation”
https://docs.oracle.com/en/database/oracle/audit-vault-database-firewall/index.html

· Oracle Documentation. (2026). “Oracle Audit Vault and Database Firewall Installation Guide”
https://docs.oracle.com/en/database/oracle/audit-vault-database-firewall/20/sigig/index.html

· Oracle Documentation. (2026). “Oracle Audit Vault and Database Firewall Administrator’s Guide”
https://docs.oracle.com/en/database/oracle/audit-vault-database-firewall/20/sigad/index.html