1. Home
  2. Cisco Systems
  3. Does Pix 7.x break sqlnet/oracle?

Does Pix 7.x break sqlnet/oracle?

We've upgraded a Pix 525 from version 6.3.3 to 7.2.1 (and then to

7.2.1.19).

Since then upgrade sqlnet/oracle connections through the Pix are broken. These connections seem to be terminated prematurely and a trace file is generated on the server containing a "FATAL ERROR IN TWO-TASK SERVER - ksedmp: internal or fatal error" message. The client receives a an ORA-03113: end-of-file on communication channel."

These symptoms can be reproduced on different oracle/instances running a simple query using SQL*Plus.

Configuring the pix with or without "inspect sqlnet" does not seem to make a difference.

Defining the SQLNET.EXPIRE_TIME in sqlnet.ora on the server also has no effect.

These connections were working perfectly on the same Pix running

6.3.x with "fixup sqlnet".

The problem does not seem to happen if the result of the query contains only a few rows.

Any ideas?

Reply to
Gunnar Orvarsson
Loading thread data ...

Reply to
Barney

do you have the inspects enabled in the new code? What does a "show service-policy" show? Any drops?

Reply to
Brian V

I've the default inspects enabled (except estmp). Have tried both with and without inspecting sqlnet but it didn't make any difference. There are no drops to be seen when showing the service-policy.

Reply to
Gunnar Orvarsson

I've tried capture on the pix. There are no packets dropped, but I noticed that a single packet using the TCP urgent flag is coming from the client and being cleared before leaving the outbound interface for the server. Don't know if this is significant but if this behaviour is different between pix 6.x and 7.x it might be worth looking into.

Reply to
Gunnar Orvarsson

Problem solved.

Allowing the urgent flag to pass trough for sqlnet traffic seems to do the trick! I've no idea why sqlnet is using this flag but I think it should be documented somewhere that clearing this flag does not work for sqlnet (at least not for the 9.2.0 version we're using).

Reply to
Gunnar Orvarsson

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.