Cisco Support Community
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

sqlnet inspection with TNS redirects


Running default sqlnet inspection on ASA 7.2(3) for a multithread oracle DB. When the DB issues redirects for the connecting client sqlnet inspection drops the packet (packet captures and show service-policy confirm this). On investigation the redirect contains the following data which includes a FQDN and not an IP.


Is it possible for the ASA to perform a lookup against a FQDN when it receives such a packet? I suspect this would result in too long a processing delay. If it can't then it can't dynamically open the access for the new client request.

My understanding is that the ASA expects the format to be as below containing an ip not a FQDN


Disabling sqlnet inspection and creating an acl gets round the problem. Interestingly in 6.3(5) it seems this condition is handled differently with the redirect packet being allowed through back to the client however there won't be the slot created so in a way pointless the client getting the redirect.

Anyone come across this before?

thanks in advance


Re: sqlnet inspection with TNS redirects

sqlnet inspection simply NATs embedded IP addresses and opens embryonic connections for return traffic, it does not restrict sql commands.

CreatePlease to create content