A Data Guard implementation requires two DB systems, one containing the primary database and one containing the standby database. When you enable Data Guard for a database, a new DB system with the standby database is created and associated with the primary database.

Requirement details are as follows:

• Both the DB systems must be in the same compartment.
• The database versions and editions must be identical. For 23ai databases, the primary and standby databases must be on the same major release version, while the standby database can be on a higher minor version.
• Data Guard does not support Oracle Database Standard Edition. (Active Data Guard requires Enterprise Edition Extreme Performance.)
• Each database in a Data Guard association must have a unique name (DB_UNIQUE_NAME) value that is not in use by other databases in the DB systems that house the Data Guard association. However, the primary and standby database can use the same database name DB_NAME value.
• The database edition determines whether Active Data Guard (ADG) can be used. ADG is only available with Enterprise Edition Extreme Performance. If you are using the BYOL licensing model and if your license does not include ADG, then you must ensure that ADG is not enabled when configuring Data Guard for Enterprise Edition Extreme Performance. Alternately, you can use Enterprise Edition or Enterprise Edition High Performance, which do not enable ADG by default. See Use Oracle Data Guard with the Database CLI.
• If your primary and standby databases are in the same region, then both must use the same virtual cloud network (VCN).
• If your primary and standby databases are in different regions, then you must peer the virtual cloud networks (VCNs) for each database. See Remote VCN Peering using an RPC.
• The primary and standby databases could be in a different region, but they must be in the same realm.
• The SYS password and the TDE wallet password of the primary and standby databases must all be the same.
• Cross-region Data Guard for a database protected by OCI Vault is only possible if the keys are stored in a virtual private vault.
• Configure the security list ingress and egress rules for the subnets of both DB systems in the Data Guard association to enable TCP traffic to move between the applicable ports. Ensure that the rules you create are stateful (the default).

  For example, if the subnet of the primary DB system uses the source CIDR 10.0.0.0/24 and the subnet of the standby DB system uses the source CIDR 10.0.1.0/24, then create rules as shown in the subsequent example.

Known Issues

• In a cross-region Data Guard, after you perform a switchover, you cannot rotate the Database KMS key on the new primary database.
• In a cross-region Data Guard, after you perform a switchover, you cannot create a PDB on the new primary database.

Security List for Subnet on the Primary DB System

Ingress Rules:
	Stateless: No
	Source: 10.0.1.0/24
	IP Protocol: TCPSource Port Range: All 
	Destination Port Range: 1521
	Allows: TCP traffic for ports: 1521

Egress Rules:
	Stateless: No
	Destination: 10.0.1.0/24 
	IP Protocol: TCP 
	Source Port Range: All
	Destination Port Range: 1521
	Allows: TCP traffic for ports: 1521	

Security List for Subnet on the Standby DB System

Ingress Rules:	
	Stateless: No
	Source: 10.0.0.0/24 
	IP Protocol: TCP 
	Source Port Range: All 
	Destination Port Range: 1521
	Allows: TCP traffic for ports: 1521

Egress Rules:
	Stateless: No
	Destination: 10.0.0.0/24 
	IP Protocol: TCP 
	Source Port Range: All
	Destination Port Range: 1521
	Allows: TCP traffic for ports: 1521	

For information about creating and editing rules, see Security Lists.

Oracle recommends that the DB system that contains the standby database be in a different availability domain from that of the DB system containing the primary database to improve availability and disaster recovery. If you enable Oracle Data Guard for a database and your standby database is in the same availability domain as the primary database (either by choice, or because you are working in a single availability domain region), then Oracle recommends that you place the standby database in a different fault domain from that of the primary database.