Oracle 网络配置最佳实践

适用版本：Oracle Database 10g / 11g / 12c / 19c / 23ai 文档版本：v1.0 / 2026-07

---

1. 概述

Oracle 网络配置影响连接性能与安全[1]：

详细见：Oracle 网络配置与监听器、Oracle 监听器配置详解。

---

2. 监听器

2.1 多监听器

LISTENER_1521 =
  (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = oradb)(PORT = 1521)))
LISTENER_1522 =
  (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST = oradb)(PORT = 1522)))

2.2 LOCAL_LISTENER

ALTER SYSTEM SET local_listener = '(ADDRESS_LIST=(ADDRESS=(PROTOCOL=TCP)(HOST=oradb)(PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=oradb)(PORT=1522)))' SCOPE=SPFILE;

2.3 RAC SCAN

- 3 个 SCAN IP
- SCAN Listener
- 负载均衡

详细见：Oracle RAC 19c 部署详解。

---

3. 连接模式

3.1 Dedicated（默认）

- 每连接一进程
- OLTP
- 内存独占

3.2 Shared

ALTER SYSTEM SET shared_servers = 5;
ALTER SYSTEM SET dispatchers = '(PROTOCOL=TCP)(SERVICE=orclXDB)';

3.3 DRCP

ALTER SYSTEM SET enable_drcp = true;

3.4 选择

场景	模式
OLTP	Dedicated
大量连接	Shared
Web/PHP	DRCP

详细见：Oracle 网络架构与加密。

---

4. tnsnames.ora

4.1 基本

ORCL =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = oradb)(PORT = 1521))
    (CONNECT_DATA = (SERVER = DEDICATED)(SERVICE_NAME = orcl))
  )

4.2 RAC

ORCL =
  (DESCRIPTION =
    (ADDRESS_LIST =
      (LOAD_BALANCE = ON)
      (FAILOVER = ON)
      (ADDRESS = (PROTOCOL = TCP)(HOST = rac1-vip)(PORT = 1521))
      (ADDRESS = (PROTOCOL = TCP)(HOST = rac2-vip)(PORT = 1521))
    )
    (CONNECT_DATA =
      (SERVER = DEDICATED)
      (SERVICE_NAME = orcl)
      (FAILOVER_MODE = (TYPE = SELECT)(METHOD = BASIC)(RETRIES = 180)(DELAY = 5))
    )
  )

4.3 SCAN

ORCL =
  (DESCRIPTION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = rac-scan)(PORT = 1521))
    (CONNECT_DATA = (SERVER = DEDICATED)(SERVICE_NAME = orcl))
  )

4.4 EZConnect

sqlplus system/pwd@//oradb:1521/orcl
sqlplus system/pwd@oradb:1521/orcl

---

5. sqlnet.ora

5.1 命名

NAMES.DIRECTORY_PATH = (TNSNAMES, EZCONNECT, LDAP)

5.2 超时

SQLNET.INBOUND_CONNECT_TIMEOUT = 60
SQLNET.OUTBOUND_CONNECT_TIMEOUT = 60
SQLNET.RECV_TIMEOUT = 60
SQLNET.SEND_TIMEOUT = 60
SQLNET.EXPIRE_TIME = 10

5.3 加密

SQLNET.ENCRYPTION_SERVER = REQUIRED
SQLNET.ENCRYPTION_CLIENT = REQUIRED
SQLNET.ENCRYPTION_TYPES_SERVER = (AES256, AES192)
SQLNET.CRYPTO_CHECKSUM_SERVER = REQUIRED
SQLNET.CRYPTO_CHECKSUM_TYPES_SERVER = (SHA256)

详细见：Oracle 网络加密详解。

5.4 LDAP

NAMES.DIRECTORY_PATH = (LDAP, TNSNAMES, EZCONNECT)
NAMES.LDAP_AUTHENTICATE_BIND = 1
LDAP_DIRECTORY_ACCESS = PASSWORD

---

6. 服务

6.1 创建

EXEC DBMS_SERVICE.CREATE_SERVICE('oltp', 'oltp');
EXEC DBMS_SERVICE.START_SERVICE('oltp');

6.2 RAC

srvctl add service -db orcl -service oltp -preferred orcl1 -available orcl2
srvctl start service -db orcl -service oltp

6.3 属性

EXEC DBMS_SERVICE.MODIFY_SERVICE(
  service_name => 'oltp',
  goal => DBMS_SERVICE.GOAL_THROUGHPUT,
  clb_goal => DBMS_SERVICE.CLB_GOAL_SHORT,
  failover_method => 'BASIC',
  failover_type => 'SELECT'
);

---

7. 负载均衡

7.1 客户端

LOAD_BALANCE = ON

7.2 服务端

EXEC DBMS_SERVICE.MODIFY_SERVICE(
  service_name => 'oltp',
  clb_goal => DBMS_SERVICE.CLB_GOAL_SHORT
);

7.3 RLB

EXEC DBMS_SERVICE.MODIFY_SERVICE(
  service_name => 'oltp',
  goal => DBMS_SERVICE.GOAL_SERVICE_TIME
);

---

8. 故障转移

8.1 TAF

# tnsnames.ora
FAILOVER_MODE = (TYPE = SELECT)(METHOD = BASIC)(RETRIES = 180)(DELAY = 5)

8.2 TAC（19c+）

EXEC DBMS_APP_CONT.START_CONTINUITY(
  service_name => 'oltp',
  failover_type => 'TRANSACTION'
);

详细见：Oracle TAF 与 TAC 配置详解。

---

9. 连接池

9.1 DRCP

ALTER SYSTEM SET enable_drcp = true;

EXEC DBMS_CONNECTION_POOL.START_POOL;
EXEC DBMS_CONNECTION_POOL.ALTER_PARAM(NULL, 'MINSIZE', 10);
EXEC DBMS_CONNECTION_POOL.ALTER_PARAM(NULL, 'MAXSIZE', 100);

9.2 客户端

// .NET
Pooling=true;Min Pool Size=10;Max Pool Size=100;Connection Lifetime=300

// Java
oracle.jdbc.pool.OracleDataSource
setConnectionCachingEnabled(true);

---

10. 安全

10.1 IP 白名单

# sqlnet.ora
TCP.INVITED_NODES = (192.168.1.0/24, 192.168.2.10)
TCP.EXCLUDED_NODES = (192.168.3.0/24)
TCP.VALIDNODE_CHECKING = yes

10.2 SSL/TLS

# listener.ora
LISTENER =
  (DESCRIPTION = (ADDRESS = (PROTOCOL = TCPS)(HOST = oradb)(PORT = 1522)))

# sqlnet.ora
WALLET_LOCATION = (SOURCE = (METHOD = FILE)(METHOD_DATA = (DIRECTORY=/u01/wallet)))
SSL_CLIENT_AUTHENTICATION = FALSE

10.3 认证

SQLNET.AUTHENTICATION_SERVICES = (NTS)
# Kerberos
SQLNET.AUTHENTICATION_SERVICES = (KERBEROS5)

详细见：Oracle 安全深度解析。

---

11. CMAN

11.1 Connection Manager

- 代理
- 多路复用
- 防火墙

11.2 配置

# cman.ora
CMAN =
  (CONFIGURATION =
    (ADDRESS = (PROTOCOL = TCP)(HOST = cman-host)(PORT = 1630))
    (RULE_LIST =
      (RULE = (SRC = *)(DST = oradb)(SVC = orcl)(ACT = accept))
    )
  )

---

12. 监控

12.1 视图

SELECT service_name, status, instance_name FROM v$services;
SELECT * FROM v$listener_network;
SELECT * FROM v$session WHERE service_name = 'oltp';

12.2 日志

tail -f $ORACLE_BASE/diag/tnslsnr/oradb/listener/alert/log.xml

12.3 lsnrctl

lsnrctl status
lsnrctl services
lsnrctl ping

---

13. 性能

13.1 连接时间

- DNS
- 防火墙
- SSL 握手

13.2 并发

- processes
- shared_servers
- DRCP

13.3 网络

- 带宽
- 延迟
- MTU

---

14. 常见坑与排错

14.1 ORA-12541

- 监听器未启动
- 防火墙
- 端口

14.2 ORA-12154

- tnsnames.ora
- TNS_ADMIN
- 拼写

14.3 ORA-12514

- 服务未注册
- ALTER SYSTEM REGISTER

14.4 ORA-12516

- 进程数
- processes

---

15. 最佳实践

1. SCAN：RAC
2. 服务：业务
3. 负载均衡：性能
4. TAF/TAC：高可用
5. DRCP：Web
6. 加密：安全
7. IP 白名单：防护
8. 超时：保护
9. 监控：及时
10. 文档化：配置

---

16. 参考资料

[1] Oracle Database Net Services Administrator’s Guide 19c https://docs.oracle.com/en/database/oracle/oracle-database/19/netag/