RE: securing Oracle tnslistener on firewall.

Hy John,

The only way to properly filter SQL ports dynamically assigned by Oracle
is to run an "ALG" (Application Layer Gateway) on your firewall. ALG is
also called "Application Filter". The ALG will allow the firewall to
parse the SQL packet at level 7 (application layer) and to understand
which dynamic ports have been negociated between the client and the
server. Dynamic port opening on firewall is also called "pinholing".

Most of the time, the ALG for Oracle is called "SQL Net v2". On Juniper
Ntescreen for instance, you set the "Application" field to "SQLNetv2"
and it allows the Netscreen to dynamically open Oracle ports.

Hope this helps,

R,

Js Meurisse - CISSP.



On 6 Dec 2005 16:03:01 -0000, mjohn2000_99@yahoo.com
<mjohn2000_99@yahoo.com> wrote:
> Hello friends,
> My oracle people tell me to open up all TCP high ports to allow SQL
communication. I see a security issue there because it would open up
about 60K ports.
> My test shows that the only port used by TNS listener is 1521. But,
oracle people claim that when there is need for many connections, oracle
would spawn more dedicated process for each connection and redirect
connections to random high ports. My research showed that claim is
correct. But, it is a risky thing to open up too many ports.
> Please advise me how I can make the SQL communication secure. If u
know any article explain the security, please point me on that
direction.
> Thank you....
> John