| 12.1 |  | Advanced Protocols |
| 12.1.5 |  | SQL*Net fixup configuration |

| SQL*Net is a protocol that an Oracle database uses to communicate between client and server processes. The protocol consists of different packet types that the PIX Security Appliance handles to make the data stream appear consistent to the Oracle applications on either side of the firewall.

SQL*Net poses a special problem when it is used in a network environment containing a firewall. This is because the protocol uses only one channel for communications. However, that channel can be redirected to a different port, and even more commonly to a different secondary server altogether.

When starting an SQL*Net connection, the client opens a standard TCP channel from one of its high-order ports to port 1521 on the server. The server then proceeds to redirect the client to a different port or IP address. The client tears down the initial connection and establishes the second connection.

For SQL*Net traffic, the PIX Security Appliance behaves in the following manner:

- For Outbound connections -
  - If all outbound TCP traffic is implicitly allowed, no special handling is required because the client initiates all TCP connections from the inside.
  - If all outbound TCP traffic is not implicitly allowed, the PIX Security Appliance opens a conduit for the redirected channel between the server and the client.
- For Inbound connections, if a conduit exists allowing inbound connections to an SQL*Net server, the PIX Security Appliance opens an inbound conduit for the redirected channel.

Figure illustrates the SQL*Net connection process. Notice that after the client sends the server the TCP connection request, the server replies by redirecting the client to port 1030. In order for the PIX Security Appliance to accommodate this behavior, the fixup protocol sqlnet command must be configured. The Command Reference looks at this command and its syntax in more detail.

| Lab Activity e-Lab Activity: fixup Command In this activity, the student will configure the PIX Security Appliance to "fixup" the SQL*NET protocol to support this additional port.