Description

This article describes the conditions required for SQL ALG.

Symptoms

To suggest when SQL ALG is needed, and when it can be disabled.

Solution

 

By default, in Oracle 10 and later releases, transmitting data with interleave mode (control and data on the same TCP port 1521) does not require SQL ALG. 

In short, SQL ALG is required only when Oracle SQL data is transmitted in redirect mode:

  • Oracle 9 or earlier is running.
  • Customized configuration on Oracle 10 or later to have data transmitted in redirect mode.


To check the related redirect counter on SRX, the following command is helpful:

For SRX Branch:

> request pfe execute command " show usp alg sql stats" target fwdd | grep REDIRECT

For SRX HE:

> start shell
% srx-cprod.sh -s spu -c "show usp alg sql stats" | grep REDIRECT

Example:

root@SRX> request pfe execute command " show usp alg sql stats" target fwdd | grep REDIRECT
GOT: LINE_NON_REDIRECT 0
GOT: LINE_NON_REDIRECT_BIG 0
GOT: LINE_REDIRECT_BIG 0
GOT: LINE_REDIRECT_INCOMPLETE1 0
GOT: LINE_REDIRECT_INCOMPLETE2 0
GOT: LINE_REDIRECT_INCOMPLETE3 0
GOT: LINE_REDIRECT_COMPLETE 0
GOT: LINE_REDIRECT_ERROR1 0
GOT: LINE_REDIRECT_ERROR2 0
GOT: LINE_REDIRECT_EX_ERROR1 0
GOT: LINE_REDIRECT_EX_ERROR2 0
GOT: LINE_REDIRECT_EX_COMPLETE 0
GOT: PACKETS_REDIRECT 0
GOT: PACKETS_REDIRECT_EX 0
GOT: PACKETS_REDIRECT_ERROR 0

There are two methods in SRX to disable SQL ALG:

  • Disable SQL ALG globally with the following command:
set security alg sql disable

  • Define an application that bypasses the SQL ALG. This is good for a site with a very old Oracle server that still requires ALG for data sessions.

set applications application SQL_no_alg application-protocol ignore
set applications application SQL_no_alg protocol tcp
set applications application SQL_no_alg destination-port 1521

set security policies from-zone untrust to-zone trust policy u-t match source-address any
set security policies from-zone untrust to-zone trust policy u-t match destination-address any
set security policies from-zone untrust to-zone trust policy u-t match application SQL_no_alg
set security policies from-zone untrust to-zone trust policy u-t then permit

Related Information