Can I disable "inspect sqlnet?"

epatrickwhite — Tue, 12 Mar 2019 02:52:10 GMT

In a recent Cisco Security Advisory (Advisory ID: cisco-sa-20131009-asa) there is a "SQL*Net Inspection Engine Denial of Service Vulnerability" identified. I plan to follow the upgrade process to resolve this, however, I will not be able to perform the upgrade for a couple of weeks.

The temporary work around suggested is to disable SQL*Net inspection:

ciscoasa(config)# policy-map global_policy
ciscoasa(config-pmap)# class inspection_default
ciscoasa(config-pmap-c)# no inspect sqlnet

This seems simple enough, but I am banging my head on the desk trying to figure out how this will affect any database traffic that may be going through these interfaces. If the default sqlnet inspection is disabled does that mean I need to add explicit ACL entries per interface to allow that traffic? I've reviewwed the information from this thread: https://supportforums.cisco.com/thread/2005571

I know there are SQL and Oracle databases on this particular segment, but what confuses me is that there are no rules configured to NAT anything right now. Is there some sort of way to see if any traffic even matches that default inspection so I know whether it's doing anything right now?

I seem to be overthinking this because I keep going in circles with my own reasoning. I'm not sure what config information to include with my question. I can tell you that there are many interfaces in use. There is no NAT. There are mulitple security levels.

Thank you in advance.

Can I disable "inspect sqlnet?"

Patrick Moubarak — Tue, 15 Oct 2013 16:01:58 GMT

you can check the number of packets (if any) that matched that inspection:

show service-policy

Patrick

Can I disable "inspect sqlnet?"

epatrickwhite — Tue, 15 Oct 2013 18:52:21 GMT

Patrick,

Thank you! This was exactly what I was asking for. In my post I asked the question "Is there some sort of way to see if any traffic even matches that default inspection."

That is all I needed. I don't know why I couldn't find how to show this information.

topic Can I disable "inspect sqlnet?" in Network Security

Can I disable "inspect sqlnet?"

Can I disable "inspect sqlnet?"

Can I disable "inspect sqlnet?"