Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Can I disable "inspect sqlnet?"

In a recent Cisco Security Advisory (Advisory ID: cisco-sa-20131009-asa) there is a "SQL*Net Inspection Engine Denial of Service Vulnerability" identified.  I plan to follow the upgrade process to resolve this, however, I will not be able to perform the upgrade for a couple of weeks.

The temporary work around suggested is to disable SQL*Net inspection:

ciscoasa(config)# policy-map global_policy
ciscoasa(config-pmap)# class inspection_default
ciscoasa(config-pmap-c)# no inspect sqlnet

This seems simple enough, but I am banging my head on the desk trying to figure out how this will affect any database traffic that may be going through these interfaces.  If the default sqlnet inspection is disabled does that mean I need to add explicit ACL entries per interface to allow that traffic?  I've reviewwed the information from this thread: https://supportforums.cisco.com/thread/2005571

I know there are SQL and Oracle databases on this particular segment, but what confuses me is that there are no rules configured to NAT anything right now.  Is there some sort of way to see if any traffic even matches that default inspection so I know whether it's doing anything right now?

I seem to be overthinking this because I keep going in circles with my own reasoning.  I'm not sure what config information to include with my question.  I can tell you that there are many interfaces in use.  There is no NAT.  There are mulitple security levels. 

Thank you in advance.

1 ACCEPTED SOLUTION

Accepted Solutions

Can I disable "inspect sqlnet?"

you can check the number of packets (if any) that matched that inspection:

show service-policy

Patrick

2 REPLIES

Can I disable "inspect sqlnet?"

you can check the number of packets (if any) that matched that inspection:

show service-policy

Patrick

New Member

Can I disable "inspect sqlnet?"

Patrick,

Thank you!  This was exactly what I was asking for.  In my post I asked the question "Is there some sort of way to see if any traffic even matches that default inspection." 

That is all I needed.  I don't know why I couldn't find how to show this information.

1645
Views
0
Helpful
2
Replies
CreatePlease login to create content