Initial connections to sql servers timeout through ASA

lcnorwood — Mon, 11 Mar 2019 23:46:22 GMT

I am on version 8.2(1) of ASA Code.

When accessing a SQL server on a secure internal interface,(Traffic is sourcing from DMZ) i'm getting some timeouts on the initial connection on port 1433. All subsequent connections work fine. Packet tracer shows the connection builds properly, and shouldn't have a connectivity issue. The problem server is a webserver that connects back through the firewall to access the SQL server on port 1433. We also have many other webservers in the DMZ which access the same SQL server, but do not have the same timeout issues.

Here are my timeouts, from the config

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

arp timeout 14400

I've seen a couple articles about increasing the tcp timeout to 3 hours for the DMZ interface, but I'm not sure that's the best idea.

Does anyone have an idea what might be wrong?

Re: Initial connections to sql servers timeout through ASA

Ramraj Sivagnanam Sivajanam — Sat, 25 Aug 2012 13:30:14 GMT

Hi Bro

Based on your problem description, I personally don't think this is an issue with your Cisco Firewall. The reason being, you said "The problem server is a webserver that connects back through the firewall to access the SQL server on port 1433. We also have many other webservers in the DMZ which access the same SQL server, but do not have the same timeout issues."

Since all the other Web Servers in DMZ has no issues accessing the SQL server except for this particular one, then what I would propose you to do is to perform 2 packet captures from within the Cisco Firewall i.e. from the non-working Web Server to the SQL server and from a working Web Server to the SQL server and compare the packet capture output. Chances are this could be an application scripting issue. Let me know how it goes.

If you're not sure on how to perform packet captures from within your Cisco Firewall, please refer to this URL;

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080a9edd6.shtml

topic Re: Initial connections to sql servers timeout through ASA in Network Security

Initial connections to sql servers timeout through ASA

Re: Initial connections to sql servers timeout through ASA