MySQL Enterprise Firewall 3. Switch the account profile to  PROTECTING  mode. When a client connects to the server using the account, the account profile allowlist restricts statement execution. 4. Should additional training be necessary, switch the account profile to  RECORDING  mode again, update its allowlist with new statement patterns, then switch it back to  PROTECTING  mode. Observe these guidelines for firewall-related account references: •Take note of the context in which account references occur. To name an account for firewall operations, specify it as a single quoted string ( ’ user_name @ host_name ’ ). This differs from the usual MySQL convention for statements such as  CREATE USER  and  GRANT , for which you quote the user and host parts of an account name separately ( ’ user_name ’@’ host_name ’ ). •The firewall assesses statements against accounts represented by actual user and host names as authenticated by the server. When registering accounts in profiles, do not use wildcard characters or netmasks: The requirement for naming accounts as a single quoted string for firewall operations means that you cannot use accounts that have embedded  @  characters in the user name. •Suppose that an account named  me@%.example.org  exists and a client uses it to connect to the server from the host  abc.example.org . •The account name contains a  %  wildcard character, but the server authenticates the client as having a user name of  me  and host name of  abc.example.com , and that is what the firewall sees. •Consequently, the account name to use for firewall operations is  me@abc.example.org  rather than me@%.example.org . The following procedure shows how to register an account profile with the firewall, train the firewall to know the acceptable statements for that profile (its allowlist), and use the profile to protect MySQL against execution of unacceptable statements by the account. The example account,  fwuser@localhost , is presumed for use by an application that accesses tables in the  sakila  database (available at https:// dev.mysql.com/doc/index-other.html). Use an administrative MySQL account to perform the steps in this procedure, except those steps designated for execution by the  fwuser@localhost  account that corresponds to the account profile registered with the firewall. For statements executed using this account, the default database should be sakila . (You can use a different database by adjusting the instructions accordingly.) 1. If necessary, create the account to use for executing statements (choose an appropriate password) and grant it privileges for the  sakila  database: 2. Use the  sp_set_firewall_mode()  stored procedure to register the account profile with the firewall and place the profile in  RECORDING  (training) mode: 3. To train the registered account profile, connect to the server as  fwuser  from the server host so that the firewall sees a session account of  fwuser@localhost . Then use the account to execute some statements to be considered legitimate for the profile. For example: 1560 CREATE USER ’fwuser’@’localhost’ IDENTIFIED BY ’ password ’; GRANT ALL ON sakila.* TO ’fwuser’@’localhost’; CALL mysql.sp_set_firewall_mode(’fwuser@localhost’, ’RECORDING’); SELECT first_name, last_name FROM customer WHERE customer_id = 1; UPDATE rental SET return_date = NOW() WHERE rental_id = 1; SELECT get_customer_balance(1, NOW());