MySQL Enterprise Firewall 5. Invoke  sp_set_firewall_mode()  again, this time switching the account profile to  PROTECTING mode: CALL mysql.sp_set_firewall_mode(’fwuser@localhost’, ’PROTECTING’); Important Switching the account profile out of  RECORDING  mode synchronizes its cached data to the  mysql  system database tables that provide persistent underlying storage. If you do not switch the mode for a profile that is being recorded, the cached data is not written to persistent storage and is lost when the server is restarted. 6. Test the account profile by using the account to execute some acceptable and unacceptable statements. The firewall matches each statement from the account against the profile allowlist and accepts or rejects it: •This statement is not identical to a training statement but produces the same normalized statement as one of them, so the firewall accepts it: mysql>  SELECT first_name, last_name FROM customer WHERE customer_id = ’48’; +------------+-----------+ | first_name | last_name | +------------+-----------+ | ANN | EVANS | +------------+-----------+ •These statements match nothing in the allowlist, so the firewall rejects each with an error: •If the  mysql_firewall_trace  system variable is enabled, the firewall also writes rejected statements to the error log. For example: mysql>  SELECT first_name, last_name FROM customer WHERE customer_id = 1 OR TRUE; ERROR 1045 (28000): Statement was blocked by Firewall mysql>  SHOW TABLES LIKE ’customer%’; ERROR 1045 (28000): Statement was blocked by Firewall mysql>  TRUNCATE TABLE mysql.slow_log; ERROR 1045 (28000): Statement was blocked by Firewall [Note] Plugin MYSQL_FIREWALL reported: ’ACCESS DENIED for fwuser@localhost. Reason: No match in allowlist. Statement: TRUNCATE TABLE ‘mysql‘ . ‘slow_log‘’ These log messages may be helpful in identifying the source of attacks, should that be necessary. The firewall account profile now is trained for the  fwuser@localhost  account. When clients connect using that account and attempt to execute statements, the profile protects MySQL against statements not matched by the profile allowlist. It is possible to detect intrusions by logging nonmatching statements as suspicious without denying access. First, put the account profile in  DETECTING  mode: Then, using the account, execute a statement that does not match the account profile allowlist. In DETECTING  mode, the firewall permits the nonmatching statement to execute: CALL mysql.sp_set_firewall_mode(’fwuser@localhost’, ’DETECTING’); mysql>  SHOW TABLES LIKE ’customer%’; +------------------------------+ | Tables_in_sakila (customer%) | +------------------------------+ | customer | 1562