topic Re: PIX V8.04 Update - Sqlnet Problem in Network Security

PIX V8.04 Update - Sqlnet Problem

r.bender — Mon, 11 Mar 2019 13:48:13 GMT

After upgrading our PIX 515E from V7.22 to V8.04 everything but one protocol seems to work fine. When trying to make an Sqlnet connection through the firewall a syslog error is kicked out: "PIX-4-507001: Terminating TCP-Proxy connection from outside:x.x.x.x/1534 to inside:y.y.y.y/2778 - reassembly limit of 8192 bytes exceeded". A packet capture shows the client and server talking, even after the error.

Anyone seen this before?

Thanks.

Re: PIX V8.04 Update - Sqlnet Problem

suschoud — Tue, 23 Sep 2008 20:07:55 GMT

When sqlnet inspection is applied as in your case, the ASA will proxy the TCP stream to make

sure the traffic arrives in order. When performing this, the firewall must buffer any

fragmented packets, but only have a limited size buffer of 8192 bytes. It is this limit

that is being hit in your case.

There is currently a feature request to have this limit changed, but at this point it is

just a request.

CSCsl15229

As a workaround, you can try disabling the inspection for this particular server.

##########

ASA-5520-CSC-Standalone(config)# access-list sqlnet-list deny tcp any host 128.104.44.41 eq

554$

ASA-5520-CSC-Standalone(config)# access-list sqlnet-list permit tcp any any eq 1521

ASA-5520-CSC-Standalone(config)# class-map sqlnet-class

ASA-5520-CSC-Standalone(config-cmap)# match access-list sqlnet-list

ASA-5520-CSC-Standalone(config-cmap)# policy-map global_policy

ASA-5520-CSC-Standalone(config-pmap)# class inspection_default

ASA-5520-CSC-Standalone(config-pmap-c)# no inspect sqlnet

ASA-5520-CSC-Standalone(config-pmap-c)# class sqlnet-class

ASA-5520-CSC-Standalone(config-pmap-c)# inspect sqlnet

ASA-5520-CSC-Standalone(config-pmap-c)#

############

Do rate helpful posts.

Regards,

Sushil

Re: PIX V8.04 Update - Sqlnet Problem

Michael.Tuggle — Fri, 03 Oct 2008 14:18:45 GMT

I am looking at upgrading from 7.2.4 to 8.0.4 and was wondering if you were just recieving the syslog messages or if it was killing your connections between the client and server. Also did you find a fix? Any input would be helpful.

Re: PIX V8.04 Update - Sqlnet Problem

Matthew Warrick — Fri, 03 Oct 2008 14:31:18 GMT

When we upgraded to 8.0.4 we had to disable the sqlnet inspect because it was impacting connectivity. There is no fix for this at the moment that I am aware of.

Re: PIX V8.04 Update - Sqlnet Problem

r.bender — Sun, 05 Oct 2008 04:14:17 GMT

I was getting syslog messages until I applied V8.0(4)3. This interim patch stopped the syslog errors and helped the commuincation a little but the the connection still did not function properly. The firewall appeared to be sending resets and killing the traffic. Cisco has indicated the this will be fixed in V8.0(4)6 but did not know when it would be released. I keep checking. For now I have rolled back to the known working V7.22.

Re: PIX V8.04 Update - Sqlnet Problem

msdesai — Tue, 07 Oct 2008 00:27:29 GMT

You can try disabling the rtsp inspect.

Please refer to below URL:

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807c35e7.shtml#prob

HTH

Re: PIX V8.04 Update - Sqlnet Problem

r.bender — Tue, 07 Oct 2008 13:15:09 GMT

I tried that and no effect.

Re: PIX V8.04 Update - Sqlnet Problem

Michael.Tuggle — Tue, 07 Oct 2008 14:53:48 GMT

Does the ASA have the same problem. We have the ASA 5520 and I know there is a good bit of differences between the ASA OS and the Pix OS even if they are running the same version.

Re: PIX V8.04 Update - Sqlnet Problem

r.bender — Tue, 07 Oct 2008 16:33:26 GMT

I do not know. I have not tried this with the ASA. I hope to when I get a chance. If you test this please let me know.

Thanks.

Re: PIX V8.04 Update - Sqlnet Problem

Michael.Tuggle — Thu, 09 Oct 2008 11:50:53 GMT

We are planning our upgrade at the end of the month so I will post the sqlnets results at that time.

Re: PIX V8.04 Update - Sqlnet Problem

jghope — Thu, 09 Oct 2008 13:32:45 GMT

Looks like we are hitting the same problem on a PIX running 8.0.4. Any news on the release date for 8.0.4(6)? I will try to apply the workaround this weekend.

Re: PIX V8.04 Update - Sqlnet Problem

r.bender — Thu, 09 Oct 2008 15:57:19 GMT

No news. They closed the case and told me to keep checking their website for the Interim release as they did not have a date for the release. It was still in the testing stages. So far it has not been released and I check the site every week. Please let me if you find a work around that works.

Thanks.

Re: PIX V8.04 Update - Sqlnet Problem

Matthew Warrick — Thu, 09 Oct 2008 19:20:44 GMT

Leveraging my advanced services contract I was just able to obtain a copy of asa804-6-k8.bin today which is supposed to resolve this issue.

I'd hit up TAC again and escalate this through the system until they give you access to the interim release as well I guess.

Good luck!

Re: PIX V8.04 Update - Sqlnet Problem

r.bender — Thu, 09 Oct 2008 19:38:04 GMT

I did not know you could do that. If you are going to apply the update please let me know if it seems to fix the issue. That will save me some time. 😉

Re: PIX V8.04 Update - Sqlnet Problem

Matthew Warrick — Thu, 09 Oct 2008 19:49:57 GMT

Will do, however it takes about 2 weeks to get the approvals to get it into production around here lol.

Re: PIX V8.04 Update - Sqlnet Problem

jghope — Fri, 17 Oct 2008 06:51:28 GMT

The workaround worked fine - had to tweak an access rule as well. Will go for the software update as soon as possible

Re: PIX V8.04 Update - Sqlnet Problem

Michael.Tuggle — Mon, 27 Oct 2008 12:51:59 GMT

Just to let you know I performed the update this weekend and ran into the same SQL-NET inspection issue with the ASA. Like everyone else disabled SQL-NET inspection to resolve the issue.

Re: PIX V8.04 Update - Sqlnet Problem

peteruwa — Wed, 29 Oct 2008 14:07:07 GMT

Hi Mic,

I am about upgrading our PIX from 7.0(4) -> 7.2x - 8.0x but afraid of the issues discussed on this subject. Do you advice that I go ahead to 8.0x or just upgrade to 7.2x and wait until these issues are resolved.

Regards

peter

Re: PIX V8.04 Update - Sqlnet Problem

Michael.Tuggle — Wed, 29 Oct 2008 14:35:11 GMT

Basically the work around is to turn off SQLNet inspection. This worked with no problem in our environment. Cisco has released an interim fix for the issue, 8.0.4.8. I am not applying the fix but am waiting until 8.0.5 is released, which Cisco assured me will contain the fix. Cisco did not give a specific time for the next release but said it would probably be in the next couple of months. I would say unless you are looking at something specific to 8.0x code, like a SSL VPN feature, EIGRP, etc.., I would hold off on upgrading to 8.0x until 8.0.5 is released. I had 7.2.4 before the upgrade and it seemed to be a very stable release. I will say the SSL VPN features in 8.0 are far better than 7.X code. Any way good luck with whatever you decide.

Re: PIX V8.04 Update - Sqlnet Problem

peteruwa — Wed, 29 Oct 2008 16:04:28 GMT

Mic,

Thanks for the advice. I think I will go with the 7.2.4 and wait as suggested.

Regards

Peter