topic Re: Confirm about Oracle DB Listener: TCP/1521 requirement in Network Access Control

Confirm about Oracle DB Listener: TCP/1521 requirement

masyamad — Fri, 08 Jun 2018 05:41:11 GMT

Hi,

Table.2 on the installation guide 2.4 shows Mnt requires TCP/1521 for Oracle DB Listener.

But the picture on the same page "Cisco ISE 2.4 Node Communication" shows not Mnt but PSN require the port.(PSN to PIP).

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24…

* There is no TCP/1521 communication from/to MnT.

Which really requires the port?

Re: Confirm about Oracle DB Listener: TCP/1521 requirement

hslai — Fri, 08 Jun 2018 14:41:23 GMT

PIP stands for policy information point, such as AD/LDAP. In particular, ISE supports 5 favors of ODBC sources, which includes Oracle DB and that data source may listen on either the default TCP/1521 or another port. Thus, it's the connections will be outbound from a PSN and the data source listening on such port but not a PSN.

Re: Confirm about Oracle DB Listener: TCP/1521 requirement

masyamad — Sat, 09 Jun 2018 07:00:30 GMT

Thanks. I understand what the picture is meaning.

* PSN --------> TCP/1521 on External Servers

However still want to know what the table2 means.

Table.2 shows not PSN but MnT has TCP/1521 connection.

https://www.cisco.com/c/en/us/td/docs/security/ise/2-4/install_guide/b_ise_InstallationGuide24/b_ise_InstallationGuide24…

The connection (TCP/1521 on Mnt -----> XXXX server) doesn't appear on the picture.

Is the connection really required for MnT operation? And What is the destination of the 1521 connection from Mnt?

Re: Confirm about Oracle DB Listener: TCP/1521 requirement

hslai — Sat, 09 Jun 2018 15:56:36 GMT

1521/TCP is inbound to MnT but not outbound from MnT. I think the picture on PAN -> MnT should replace tcp/1528 with tcp/1521.

Re: Confirm about Oracle DB Listener: TCP/1521 requirement

masyamad — Sun, 10 Jun 2018 07:49:22 GMT

Understand,thanks! The information is needed for upstream firewall requirement. I'll forward the info to my customer.

Re: Confirm about Oracle DB Listener: TCP/1521 requirement

masyamad — Mon, 18 Jun 2018 06:02:26 GMT

Sorry for bothering you again. But I got new question from my customer.

Could you tell me the purpose of the TCP1521 connection from PAN to MnT?

They wants to know why all interfaces on MnT must open the port so asked me the purpose of the TCP connection.

* The guide shows not only g0/Bond0 but also others(g1-5/bond1-2) have to open the port.

Re: Confirm about Oracle DB Listener: TCP/1521 requirement

hslai — Wed, 20 Jun 2018 23:30:15 GMT

You are correct that usually this is going PPAN (g0/bond0) -> MnT (g0/bond0). The table 2 shows it open but not actually used.

Re: Confirm about Oracle DB Listener: TCP/1521 requirement

masyamad — Thu, 21 Jun 2018 03:37:55 GMT

Thanks. Usually I and my customer refer the port list to consider upstream firewall policy, so it would be great if we can find only necessary TCP/UDP ports for ISE correct operation. Anyway I'll transfer the info to my end customer.