SQL PIX 515E Connection Problem 1

[berlingoff]

I have a Cisco PIX 515E. I have a web server running in the DMZ that makes an ODBC connection on port 1433 to an SQL server on our internal network. If there is no activity from the webpage, the web server is unable to connect to the SQL server until a connection is made from the SQL server to the web server. I usually do this by pinging from the internal server to the DMZ'ed server.

The rule in the PIX is to allow 1433 from the DMZ'ed machine to the SQL server inside.

Is there another rule that I need to create, or expand on the exisiting rule to keep this connection available at all times?

Thanks for any help.

 

[dopehead]

Is it MSSQL or Oracle ? you might need some "fixup protocol sqlnet 1433" command if its Oracle.

Maybe you could post your statics/access-lists ?

Jan


Network Systems Engineer
CCNA/CQS/CCSP/Infosec

 

[berlingoff]

Hope this information is enough. It is connecting to a Microsoft SQL server, not Oracle.

Thanks!

object-group service SQL tcp
port-object range 1433 1433

object-group network KT_Servers
network-object X.X.X.X 255.255.255.255
network-object X.X.X.X 255.255.255.255

name X.X.X.X KTWEB

access-list DMZ_access_in permit tcp host KTWEB object-group KT_Servers object-group SQL

 

[dopehead]

Looks ok, but did you use access-group to apply it to the DMZ ?
access-group DMZ_access_in in interface dmz

Jan


Network Systems Engineer
CCNA/CQS/CCSP/Infosec

 

[berlingoff]

Yes, I did apply it to the DMZ.

Like I said, the connection works, it just seems to timeout after a few hours of inactivity, and then I have to ping, or initiate some sort of connection from the internal server to the DMZ'ed one.

Thanks

Jason

 

[dopehead]

Oh, sorry didn't see that.
Well, the pix will always timeout your sessions after a certain amount of inactivity this cannot be disabled but it can be worked around. You need to enable some type of keepalive on your sql connection, it can be done you just need to search your documentation of your sql server.

Changing timeout values on the pix will only make the problem appear with more hours in between and not solve your problem.

Jan


Network Systems Engineer
CCNA/CQS/CCSP/Infosec