In a recent Cisco Security Advisory (Advisory ID: cisco-sa-20131009-asa) there is a "SQL*Net Inspection Engine Denial of Service Vulnerability" identified. I plan to follow the upgrade process to resolve this, however, I will not be able to perform the upgrade for a couple of weeks.
The temporary work around suggested is to disable SQL*Net inspection:
ciscoasa(config)# policy-map global_policy
ciscoasa(config-pmap)# class inspection_default
ciscoasa(config-pmap-c)# no inspect sqlnet
This seems simple enough, but I am banging my head on the desk trying to figure out how this will affect any database traffic that may be going through these interfaces. If the default sqlnet inspection is disabled does that mean I need to add explicit ACL entries per interface to allow that traffic? I've reviewwed the information from this thread: https://supportforums.cisco.com/thread/2005571
I know there are SQL and Oracle databases on this particular segment, but what confuses me is that there are no rules configured to NAT anything right now. Is there some sort of way to see if any traffic even matches that default inspection so I know whether it's doing anything right now?
I seem to be overthinking this because I keep going in circles with my own reasoning. I'm not sure what config information to include with my question. I can tell you that there are many interfaces in use. There is no NAT. There are mulitple security levels.
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :