Connections to Autonomous Database are made either over the public Internet, optionally with Access Control Rules (ACLs) defined, or using a private endpoint inside a Virtual Cloud Network (VCN) in your tenancy.

When you specify a private endpoint configuration, this only allows traffic from the virtual cloud network you specify and blocks access to the database from all public IPs or VCNs. Configuring a private endpoint allows you to keep all traffic to and from your database off of the public internet. With a private endpoint, when public access is enabled with Allow public access, the instance has both a private endpoint and a public endpoint:

• The private hostname, endpoint URL, and private IP address allow you to connect to the database from the VCN where the database resides.

• The public hostname allows you to connect to the database from specific public IP addresses or from specific VCNs if those VCNs are configured to privately connect to Autonomous Database using a Service Gateway.

Many applications provide support for more than one connection type, but each type of connection to Autonomous Database uses certificate authentication and TCPS (Secure TCP) database connection using standard TLS 1.2. This ensures that there is no unauthorized access to the Autonomous Database and that communications between the client and server are fully encrypted and cannot be intercepted or altered.

Autonomous Database by default supports Mutual TLS (mTLS) connections (use port 1522 to connect with mTLS). You have the option to configure an Autonomous Database instance to support both mTLS and TLS connections (use port 1521 to connect with TLS).

There are advantages for clients using TLS authentication with Autonomous Database, including the following:

• TLS connections do not require that you download a wallet. For TLS connections using JDBC Thin Driver with JDK8 or higher, a wallet is not required. This includes connections coming from the clients such as SQL Developer and SQL Command Line (SQLcl).

• Clients connecting with TLS do not need to worry about wallet rotation. Wallet rotation is a regular procedure for mTLS connections.

• TLS connections can be faster (providing less connection latency). TLS authentication can provide reduced connection latency compared to mTLS.

• TLS and mTLS connections are not mutually exclusive. Mutual TLS (mTLS) authentication is enabled by default and always available. When you enable TLS authentication, you can use either mTLS or TLS authentication.

• Using TLS authentication does not compromise the fully encrypted end-to-end communication between a client and Autonomous Database.

• About Mutual TLS (mTLS) Authentication
  Using Mutual Transport Layer Security (mTLS), clients connect through a TCPS (Secure TCP) database connection using standard TLS 1.2 with a trusted client certificate authority (CA) certificate.
• About TLS Authentication
  Using Transport Layer Security (TLS), clients connect through a TCPS (Secure TCP) database connection using standard TLS 1.2. A client uses its list of trusted Certificate Authorities (CA)s to validate the server’s CA root certificate. If the issuing CA is trusted, the client verifies that the certificate is authentic.

Most organizations protect networks and devices on a network using a firewall.  A firewall controls incoming and outgoing network traffic using rules which allow the use of certain ports and access to certain computers (or, more specifically IP addresses or host names).  An important function of a firewall is to provide separation between internal networks and the public internet.

When Autonomous Database is configured for access using the public internet, you must configure the firewall to allow access to Autonomous Database servers.

To access the Autonomous Database from behind a firewall, the firewall must permit the use of the port specified in the database connection when connecting to the servers in the connection. Use port 1522 for Autonomous Database mTLS connections (you can see the port number in the connection string from the tnsnames.ora file in your credentials ZIP file). For example, see the port value in the following tnsnames.ora file:

db2022adb_high = (description = ( 
                address=(protocol=tcps)
                (port=1522)
                (host=adb.example.oraclecloud.com))
                (connect_data=(service_name=example_high.adb.oraclecloud.com))
                (security=(ssl_server_dn_match=yes)))

Your firewall must allow access to servers within the .oraclecloud.com domain using port 1522. To connect to Autonomous Database, depending upon your organization's network configuration, you may need to use a proxy server to access this port or you may need to request that your network administrator open this port.

Application Continuity masks outages from end users and applications by recovering the in-flight work for impacted database sessions following outages. Application Continuity performs this recovery beneath the application so that the outage appears to the application as a slightly delayed execution.

See Use Application Continuity on Autonomous Database for more information on Application Continuity.