Description

This article describes a parsing error in the packet length of TNS packets if an SQL client uses version 12c. This error causes packet drop on the SQL ALG module. Two methods of disabling SQL ALG are described.

Symptoms

This issue occurs between Oracle client version 12c and Oracle server DB version 12.1.0.1, when SQL ALG is enabled by SRX. After an SQL connection is established between client and server, data traffic is transmitted through the SRX.  When the SRX receives SQL data traffic, it fails to parse the TNS header, which causes data traffic to become stuck for the remaining TCP stream.

Solution

From Oracle 12c onwards, the TNS message format has been changed in the packet length field of TNS packet header. Due to this change in TNS message format, SRX fails to parse the header which could cause packet drop according to the design of the SRX code. 

Currently there is no plan to enhance the SRX code to support this change on Oracle 12c, as the ALG is not needed in most situations. Beginning with Oracle 10, the default data transmit of the server is in interleave mode, which does not require a different port for the data session. Therefore, these new releases of Oracle (including 12c) do not need to open a  pinhole for data traffic, so SQL ALG is not necessary.  JTAC recommends disabling SQL ALG.

 There are two methods in SRX to disable SQL ALG:
 

  1. Disable SQL ALG globally with the   following command:

    set security alg sql disable
     

  2. Define an application that bypasses the SQL ALG. This is good for a site having a very old Oracle server that still requires ALG for data sessions.

    set applications application SQL_no_alg application-protocol ignore
    set applications application SQL_no_alg protocol tcp
    set applications application SQL_no_alg destination-port 1521

    set security policies from-zone untrust to-zone trust policy u-t match source-address any
    set security policies from-zone untrust to-zone trust policy u-t match destination-address any
    set security policies from-zone untrust to-zone trust policy u-t match application SQL_no_alg
    set security policies from-zone untrust to-zone trust policy u-t then permit

Important Note:

Per  PR1077810 , from the following Junos, SQL AGL is Disabled by default. 

  • 12.1X46-D40
  • 12.1X47-D25
  • 12.3X48-D20
  • 15.1X49-D10

Modification History

2020-03-18: Reviewed for accuracy and added link to PR

Related Information