MySQL Enterprise Firewall carry over to subsequent restarts, use the  GLOBAL  keyword rather than  PERSIST . See Section 13.7.6.1, “SET Syntax for Variable Assignment” . With the firewall installed, grant the appropriate privileges to the MySQL account or accounts to be used for administering it. The privileges depend on which firewall operations an account should be permitted to perform: Assigning Firewall Privileges Firewall Concepts The  FIREWALL_ADMIN  and  FIREWALL_USER  privileges can be granted only while the firewall is installed because the firewall component defines those privileges. Note •Grant the  EXECUTE  privilege for the firewall stored procedures in the  mysql  system database. These may invoke administrative functions, so stored procedure access also requires the privileges indicated earlier that are needed for those functions. •Grant the  FIREWALL_USER  privilege to any account that should have administrative access only for its own firewall rules. •Grant the  FIREWALL_ADMIN  privilege to any account that should have full adminstrative firewall access. (Some administrative firewall functions can be invoked by accounts that have  FIREWALL_ADMIN or  the deprecated  SUPER  privilege, as indicated in the individual function descriptions.) •Firewall Profiles •Firewall Statement Matching •Profile Operational Modes •Firewall Statement Handling When Multiple Profiles Apply The MySQL server permits clients to connect and receives from them SQL statements to be executed. If the firewall is enabled, the server passes to it each incoming statement that does not immediately fail with a syntax error. Based on whether the firewall accepts the statement, the server executes it or returns an error to the client. This section describes how the firewall accomplishes the task of accepting or rejecting statements. The firewall uses a registry of profiles that determine whether to permit statement execution. Profiles have these attributes: Firewall Profiles •The firewall supports account-based profiles such that each profile matches a particular client account (client user name and host name combination). For example, you can register one account profile for which the allowlist applies to connections originating from  admin@localhost  and another account profile for which the allowlist applies to connections originating from  myapp@apphost.example.com . •A scope of applicability. The scope indicates which client connections the profile applies to: •A current operational mode. The mode enables the profile to be used in different ways. For example: the profile can be placed in training mode to establish the allowlist; the allowlist can be used for restricting statement execution or intrusion detection; the profile can be disabled entirely. •An allowlist. The allowlist is the set of rules that defines which statements are acceptable to the profile. 1551