topic ASA 9.1 Problems with Oracle Database in Network Security

ASA 9.1 Problems with Oracle Database

jss.cisco — Tue, 12 Mar 2019 03:07:20 GMT

Hi Everyone,

Having a strange problem. We recently migrated from FWSM to ASA-5585X running 9.1(2). Since we did that, we are having problems from an APP server in DMZ-A talking to a DB server in DMZ-B. The error we are getting in Oracle is ORA-12592: Bad Packet. Reading about this is says it could be the network, and our DBA's are telling us they saw the error for the first time about 4 hours after our firewall migration. To note, SQL inspect is OFF. We have done captures on each server, and on egress and ingress interfaces, but do not see anything special.

Anyone have any ideas?

ASA 9.1 Problems with Oracle Database

malshbou — Wed, 20 Nov 2013 16:13:10 GMT

As you collected the ingress and egress captures, please search for the TCP URGENT flag (wireshark filter

tcp.flags.urg==1 ), and check if it is used by the orable apps . The ASA by default clears this flag, so if your app uses this flag (as many oracle apps do) , you need to configure a tcp-map to allow it.

Regards.
Mashal Shboul

ASA 9.1 Problems with Oracle Database

david.tran — Wed, 20 Nov 2013 23:27:09 GMT

Please use this post: https://supportforums.cisco.com/thread/2212146

You can fix the issue on the ASA or you can do that at the database server. I personally think this should be fixed at the database server level by enabling SQL*net keep alive to maintain stability rather than depending on the firewall

ASA 9.1 Problems with Oracle Database

jss.cisco — Thu, 21 Nov 2013 13:08:43 GMT

Thanks - this is good info. I will create the service policy and see what happens.

ASA 9.1 Problems with Oracle Database

jss.cisco — Thu, 21 Nov 2013 13:09:22 GMT

Very good article - thanks. I will add these options to my service policy and see what happens.