Re: Firewalls and Oracle

Scott,

My 2cents....

When you make a connection to the listener, say on port 1521 by default, the listener then turns around and spawns a port for the client to connect on, anywhere from port 10000-65000. The idea here is that the listener just listens, that's it...Now with a firewall, what you have done is probably opened 1521 so the connection makes it to the listener, but the port that the listener spawns to the client machine never makes it to the client , so you probably received ora 12203, which is normal...

You have a few options here...
The supported/most secure way is to use a sqlnet-compatible firewall, there are about a dozen or so available. If you are using Oracle8, you could set the use_shared_socket parameter to force Oracle to communicate always on port 1521, but there drawsbacks...

Scott Dunbar wrote:

> Hi,
> We are attempting to connect from an Oracle client to an Oracle
> server (all in the 8.1.x series) through a firewall. With a little
> experimentation it appears that the Oracle client does an initial
> connect() to the TNS listener but then an additional connection is
> made using an O/S assigned port. The problem is this second
> connection. Because it is O/S assigned it cannot be configured into
> the firewall. For a variety of reasons we have issues with using a
> "Net-8" compatible firewall (Oracle's solution).
>
> Is the number of this "return" port configurable? I'm guessing
> not as that could have the side affect of limiting (to one!) the
> number of clients that can be run on a particular box. Alternatively,
> is there a way to convince Oracle to use only one connection? As a
> side note, doesn't this scheme eat up file descriptors twice as fast
> as using the single connection? On most O/S's this isn't a big deal
> anymore but I guess SunOS 4.x (without DBE) scared me into being
> conservative with fd's.
>
> Thanks in advance for any information.
>
> --
> Scott Dunbar Global Commerce Systems
> dunbar_at_commerce.com Boulder, CO, USA
> HTML mail ok
>
Received on Thu Jun 24 1999 - 20:31:53 CDT