Re: Pix command question

Bob Smith said:
> Does the "fixup protocol sqlnet" command only apply to Oracle or does it
> apply to other DB's like MS-SQL ?  Cisco doc's seem to only allude to
> Oracle.  If so and we add a "fixup protocol sqlnet <MS-SQL port>" to our
> config are there any gotcha's anyone knows about?

Its probably not going to work with MS-SQL. In Oracle's SQL*Net the client
connects to server port 1521 and negotiates a secondary port to connect to
the actual database ( a bit like ftp does ). The server passes a port
number back to the client and the client reconnects to this port. The PIX
analyses the data packets looking for the pattern specifying the secondary
port, and when it sees it it implicitly permits the client to connect to
that secondary port ie. it performs a "fixup" for the port.

Unless MS-SQL does the same negotiation with the same protocol and same
data patterns then the PIX won't pick it up. I don't know how MS-SQL
connects, but I suspect all you need is a plain ole access-list permitting
the client through to the singular server port.

Kerry

-- 
Kerry Thompson, CCNA CISSP
Information Systems Security Consultant
http://www.crypt.gen.nz  kez@crypt.gen.nz