Re: Cisco ASA firewall: SQLnet inspection: buffer limit

[Chris Myers <clmmacunix () charter net>]

Although I would not argue the VPN solution being secure. The reason  
most do not do this is because thousands of web queries would take  
forever to process to a SQL server due to the encryption. It would  
have to be done at the client level as well, since you cannot  
terminate a LAN2LAN on a host, or an ISA server. This may have been a  
bad presumption on my part, but who said this was a database to a  
webserver. I see no indication that this is a public facing box on the  
internet. There are no IP addresses and no interfaces indicating so.  
This could be two firewalls deep for layered protection and could have  
a proxy front end, or a back-end frame-relay.


Thank You,

Chris Myers
clmmacunix () charter net

John 1:17
For the Law was given through Moses; grace and truth were realized  
through Jesus Christ.

   Go Vols!!!!

On Jan 16, 2009, at 6:06 AM, Morrow Long wrote:

> On Jan 15, 2009, at 2:45 PM, Chuck Swiger wrote:
> > The typical solution to accessing a database behind a firewall is  
> > to set up a VPN connection, and not to disable the firewall.
> >
> > Permitting the entire Internet to access your database means you  
> > are trusting Oracle's security.  Even if you don't care about the  
> > integrity of your data, you'd also put the machine running Oracle  
> > itself at risk of compromise as well:
>
> But what about the case where a web server on the DMZ network and  
> interface on a 3 (or more) interface
> firewall accesses an Oracle database server which is located on a  
> higher security level network protected
> by a different interface on the same firewall?
>
> The SQL query will also have to go through the firewall to go from  
> the DMZ WWW server to the DB server --
> I don't believe most experts would argue that the WWW server should  
> build a VPN connection to the
> database server on the more secure network.  In most cases you do  
> not want the public facing Web server
> to have unrestricted access to all of the ports on the DB server nor  
> unrestricted access to the network it is on.
>
> Morrow
>
> _______________________________________________
> firewall-wizards mailing list
> firewall-wizards () listserv icsalabs com
> https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards () listserv icsalabs com
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards