SRX Services Gateway
Reply
Visitor
dfairchild
Posts: 3
Registered: ‎01-07-2010
0

sqlnet protocol and Oracle 10 problems

Has anyone had any luck on an SRX240 running JunOS 9.6 with sqlnet or oracle 10 databases running through it.

 

This has been worked on for quite some time on the DB side and they are finally pointing the finger at the firewalls. So we started looking at this today.

 

The only thing they could give us from the DB traces was that packets seem to be dropping randomly and Oracle claims not to many firewalls handle the sqlnet protocol well.

 

Is there an ALG for this in JunOS 9.6.

 

Also this is running through a Netscreen 208 that may be the cause as well.  The app server is in our DMZ and connects to the Databases on our PCI vlan which has an SRX 240 in front of it to keep it segragated fomr the rest of the network for compliance issues. The DMZ firewalls are Netscreen 208a. Getting replaced later this year with SRX650. But we have to get this DB working now.

Contributor
etaftm
Posts: 59
Registered: ‎11-22-2009
0

Re: sqlnet protocol and Oracle 10 problems

We had the same problem with our oracle server. The Juniper tech advised us to turn off the SQL ALG

 

set security alg sql disable

Trusted Contributor
dscott
Posts: 122
Registered: ‎03-17-2011
0

Re: sqlnet protocol and Oracle 10 problems

This fixed a problem I was having as well.  I'm just curious how you determined that the ALG was causing the problem?

Dustin

VCP-4/5, JNCIS-SEC, JNCIP-ENT
New User
Marcos Pawloski
Posts: 1
Registered: ‎08-04-2011
0

Re: sqlnet protocol and Oracle 10 problems

Hi, we have a juniper SSG-140 with Netscreen and a was having same problem with SQLNETv2  local or remote DB.

 

Sometimes we have a frozen connection or dropped packets, specially with complex queries or long procedures (ex. 22k lines)

 

This command  "set security alg sql disable" ( turn off the SQL ALG) solved the problem  fo us.

 

tks a lot

 

 

Marcos Pawloski

 

 

Juniper Employee
rayado
Posts: 50
Registered: ‎04-26-2010
0

Re: sqlnet protocol and Oracle 10 problems

Here are some reports I have collected from different source regarding recently reported SQL issue.... 

 

 

Report 1 Enabling the Structured Query Language (SQL) ALG on an SRX Series or J Series device, allows SQL*Net traffic in SQL redirect mode to traverse an SRX Series device by creating a TCP pinhole. If the SQL*Net traffic is not in redirect mode, it will not be handled by the SQL ALG and will instead be processed (and should be permitted specifically) by configured firewall policies.

Report 2

Oracle 9.2 and earlier, requires the SQL ALG to keep traffic from moving to random ports; however versions greater than 9.2 may have intermittent issues when the SQL ALG is applied. This is quite obvious in Oracle, as it reports checksum errors. The following workarounds can alleviate this issue:

  1. Disable SQL ALG globally using the set security alg sql disable command.
  2. Define an application which bypasses the SQL ALG. For more information, see KB15492 - [J-Series] [SRX] How to: Bypass an ALG by creating an "application ignore" or "alg ignore"....
  3. Configure Oracle to use a port other than TCP 1521 (see oracle for details) to bypass the SQL ALG.


Report 3

Packets dropped in SQL interleave mode. This problem has been addressed by PR 587126.

Report 4

SQL ALG is not working properly when data is transmitted over the control session. This problem has been addressed by PR 524444.

 

 

Hope this helps.

 

 

New User
Jay Dixon
Posts: 1
Registered: ‎12-11-2012
0

Re: sqlnet protocol and Oracle 10 problems

I've come across the same issue with an SRX550 cluster running 12.1R3.5 - all the logs were showing the traffic making it through successfully, could ping & ssh across same source/destination but the SQL connection just didnt work. disabled the SQL ALG and it all works fine now.

Copyright© 1999-2013 Juniper Networks, Inc. All rights reserved.