topic Re: PIX 506 x Siebel Application in Network Security

PIX 506 x Siebel Application

jrmendes — Fri, 21 Feb 2020 08:02:48 GMT

Hi,

I have a IPsec tunel from a remote site (PIX 506) to a 3020 Concentrator. Users use all applications without problem except Siebel (client server application with database access). It seems that Siebel creates secondaries dynamic TCP connections and PIX is droping these packets. As these connections are not stablished before, PIX is dropping these packets. I have the message 106015 in the log file. According PIX documentation ´If the SYN flag is not set, and there is not an existing connection, the firewall discards the packet´.

Does someone have a tip to overcome this situation ?

Thanks

Re: PIX 506 x Siebel Application

owillins — Tue, 05 Apr 2005 17:19:54 GMT

The document IP Security Troubleshooting - Understanding and Using debug Commands has more information on troubleshooting IPSec.

http://www.cisco.com/warp/customer/707/ipsec_debug.html

Re: PIX 506 x Siebel Application

fedrodri — Wed, 06 Apr 2005 01:06:33 GMT

Hi,

Have you think about using the 'established' command? It permits "return connections on ports other than those used for the originating connection based on an established connection" (from the Command Reference).

-- PIX Command Reference, version 6.3:

http://cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/cmdref/df.htm#wp1028903

Please be aware of the security risks this implies...

Example (assuming initial connection behind PIX, to Siebel server behind concentrator):

established tcp 0 siebel-port permitfrom tcp siebel-second-channel-src-port permitto tcp siebel-second-channel-dst-port

Hope that helps!

Federico Rodriguez