topic Re: ASA and Oracle 10.x sqlnet protocol in Network Security

ASA and Oracle 10.x sqlnet protocol

r.spiandorello — Mon, 11 Mar 2019 10:53:59 GMT

Hi, do you know about incompatibility between oracle 10.x on linux and ASA 7.2.x version ?

The same application runs with PIX 6.3(4)

thank you in advance, but with ASA the session allows traffic flow but remains in idle state after particular commands.

How to avoid it ?

greatings

Re: ASA and Oracle 10.x sqlnet protocol

r.spiandorello — Wed, 08 Aug 2007 11:23:36 GMT

Hi, do you think the new 7.0(7) ASA GD version could solve the incompatibility ?

Could it be an MSS related matter ?

thanks

Re: ASA and Oracle 10.x sqlnet protocol

r.spiandorello — Thu, 09 Aug 2007 07:43:46 GMT

Hi, looking in CS-MARS syslog server I've found some "deny connection - no xlate" to the sqlnet destination port and some "Deny packet due to security polixy" to high ports of related connections.

Could it be related to sqlnet inspection ?

tkanks

Re: ASA and Oracle 10.x sqlnet protocol

r.spiandorello — Thu, 09 Aug 2007 12:35:47 GMT

Hi, I've found the matter happens only when the sql*net session remains on the tcp 1521 port.

In other words, the idle session happens when the listener doesn't request a redirection (with a redirect command).

thanks in advance

Re: ASA and Oracle 10.x sqlnet protocol

diogo — Wed, 15 Aug 2007 10:44:06 GMT

I believe its is a problem relate to the SQLNET fixup.

I'm having a similar problem with the FWSM inspect for sqlnet.

one solution would be to disable the fixup and permit all used ports for sqlnet. Not only the initial 1521, but all the ranga that is open after the initial negotiation..

Re: ASA and Oracle 10.x sqlnet protocol

r.spiandorello — Fri, 24 Aug 2007 12:05:55 GMT

hi, all IP protocol is opened, after the sql*net acl, but nothing.

Now I'm looking for the 1521 port persistence, in other words no redirect sql command found.

gatings