2012年3月7日星期三
First time use of Analysis Services
I'm trying to connect to Analysis Services from my computer using Management Studio. MSAS is on a server outside the firewall, so I cannot connect to it using Window Authenication. When I try to connecting to it the option of changing the authenication is grayed out. Can someone help me figure out how to do this?You might be able to get around it by making creating a user on the AS box with the same name and password as you. I've been able to do that successfully in some scenarios, but not always.
2012年2月24日星期五
Firewalls and SQL Server
What is involved in setting up a SQL Server with IIS where SQL Server is behind the firewall. I'm interested in high level configuration not codingWhat is involved in setting up a SQL Server with IIS where SQL Server is behind the firewall. I'm interested in high level configuration not coding
It's pretty straightforward (unless I am totally missing the point of your question). Your web server sits in a DMZ (an isolated network segment with internet connectivity). All traffic to/from this DMZ is filtered/blocked by a firewall. You then add a rule to the firewall to permit your web server to talk to the database server (usually this means permitting traffic over port 1433 from the web server to the database server).
Most firewalls are smart enough to handle the port negotiation process (whereby SQL Server accepts the incoming port 1433 and "hands-off" the connection to a mutually negotiated port). However, in some cases you will have to define additional ports to allow for this negotiation.
You would also be advised to put your DMZ behind a separate firewall blocking incoming traffic from the internet (eg. allowing only port 80 connections to your web server).
Finally, you may need to define an additional rule on the firewall between your internal network and the DMZ which would allow management of the IIS server (eg. allow port 3389 - Terminal Services - from your internal network).
Regards,
hmscott|||your reply was clear and helpful. This leads me to another question.
If say the IIS server gets hacked and the attacker gains control of the IIS server, can you comment on possible ways (if any) to get into the SQL Server?
Assuming:
- IIS code will access via application role
- Application role only has access to intended Stored Procedures
- Stored Procedures used by Application to Access SQL Server
Again looking for high level information.
For example I hear the term sql injection used sometimes which granting access via stored procedures should aleviate.|||Sql Injection is most often due to inappropriate use of parameters in urls or javascript/form variables. Sometimes the application just appends and executes data.
ex. select * from table where x = <some valuefrom the client>
If some one replaces the expected value (like id='fred') with ''fred';drop table sysobjects; commit'
You might get issues :>). If you expect a value, make sure it fits.
SP's are a good start, but if don't validate the values coiming back from a client, you can still get in trouble.
Obviously, you shouldn't be connecting as someone who can do real damage from an application. Assuming you validate the SQL, keep you systems patched, you should be ok. Note that the process for securing an application is NOT this simple, and every situation can have a 'gotcha' depending on what exactly it does. The principle Network and Application architects need to know exactly what they are doing. A forum post doesn't cover it.|||Your question and your assumptions lead in different directions. One thread is if the server is taken over, what exposure does your database have to a hacker? and the second thread is how do I prevent SQL injection attacks (which don't require the hacker to gain control over the server)?
For the first, don't store unencrypted passwords on the web server. Consider using COM+ objects as a "middle layer" on a separate server to access the database. Instantiate the COM+ objects from the IIS server. It's a pain, but it works. Mind you, I think they're called something else in ASP.NET, but I have no real experience in ASP.NET.
For the second case, you have to follow the advice someone else posted in another thread:
1. Validate user input
2. Check user input
3. Validate user input
4. Check user input
5. Validate user input
Validate. Rinse. Repeat.
I might suggest picking a copy of Michael Howard's "Designing Secure Web Based Applications". It's geared towards ASP and not ASP.NET (if I recall correctly), but it's got some really good material.
Regards,
hmscott
It's pretty straightforward (unless I am totally missing the point of your question). Your web server sits in a DMZ (an isolated network segment with internet connectivity). All traffic to/from this DMZ is filtered/blocked by a firewall. You then add a rule to the firewall to permit your web server to talk to the database server (usually this means permitting traffic over port 1433 from the web server to the database server).
Most firewalls are smart enough to handle the port negotiation process (whereby SQL Server accepts the incoming port 1433 and "hands-off" the connection to a mutually negotiated port). However, in some cases you will have to define additional ports to allow for this negotiation.
You would also be advised to put your DMZ behind a separate firewall blocking incoming traffic from the internet (eg. allowing only port 80 connections to your web server).
Finally, you may need to define an additional rule on the firewall between your internal network and the DMZ which would allow management of the IIS server (eg. allow port 3389 - Terminal Services - from your internal network).
Regards,
hmscott|||your reply was clear and helpful. This leads me to another question.
If say the IIS server gets hacked and the attacker gains control of the IIS server, can you comment on possible ways (if any) to get into the SQL Server?
Assuming:
- IIS code will access via application role
- Application role only has access to intended Stored Procedures
- Stored Procedures used by Application to Access SQL Server
Again looking for high level information.
For example I hear the term sql injection used sometimes which granting access via stored procedures should aleviate.|||Sql Injection is most often due to inappropriate use of parameters in urls or javascript/form variables. Sometimes the application just appends and executes data.
ex. select * from table where x = <some valuefrom the client>
If some one replaces the expected value (like id='fred') with ''fred';drop table sysobjects; commit'
You might get issues :>). If you expect a value, make sure it fits.
SP's are a good start, but if don't validate the values coiming back from a client, you can still get in trouble.
Obviously, you shouldn't be connecting as someone who can do real damage from an application. Assuming you validate the SQL, keep you systems patched, you should be ok. Note that the process for securing an application is NOT this simple, and every situation can have a 'gotcha' depending on what exactly it does. The principle Network and Application architects need to know exactly what they are doing. A forum post doesn't cover it.|||Your question and your assumptions lead in different directions. One thread is if the server is taken over, what exposure does your database have to a hacker? and the second thread is how do I prevent SQL injection attacks (which don't require the hacker to gain control over the server)?
For the first, don't store unencrypted passwords on the web server. Consider using COM+ objects as a "middle layer" on a separate server to access the database. Instantiate the COM+ objects from the IIS server. It's a pain, but it works. Mind you, I think they're called something else in ASP.NET, but I have no real experience in ASP.NET.
For the second case, you have to follow the advice someone else posted in another thread:
1. Validate user input
2. Check user input
3. Validate user input
4. Check user input
5. Validate user input
Validate. Rinse. Repeat.
I might suggest picking a copy of Michael Howard's "Designing Secure Web Based Applications". It's geared towards ASP and not ASP.NET (if I recall correctly), but it's got some really good material.
Regards,
hmscott
Firewall settings for msde
hi all,
i'm testing some of my applications w/c runs on MSDE on the new Windows XP Service Pack2, which actually entails newer & more secure firewall settings.
my application run on both the server & workstations only w/ the firewall switched off.
but the problem comes w/n i have the firewall settings switched on. the applications runs on the server but the workstation applications cannot.
how do i configure my workstations to be in the exception list on the firewall so they can access the server?
i'll already added the workstation's IP address & subnet but still i can't get it connect.
how do i configure my network to use TCP/IP protocol w/ a static port so i can add the workstations to the firewall's exceptions list.
thanks.
herbert
hi Herbert,
"herbert" <praetorean.tech@.graffiti.net> ha scritto nel messaggio
news:EAE41221-4DE2-458E-84D7-B24A0531F1A1@.microsoft.com...
> hi all,
> i'm testing some of my applications w/c runs on MSDE on the new Windows XP
Service Pack2, which actually entails newer & more secure firewall settings.
> my application run on both the server & workstations only w/ the firewall
switched off.
> but the problem comes w/n i have the firewall settings switched on. the
applications runs on the server but the workstation applications cannot.
> how do i configure my workstations to be in the exception list on the
firewall so they can access the server?
> i'll already added the workstation's IP address & subnet but still i can't
get it connect.
> how do i configure my network to use TCP/IP protocol w/ a static port so i
can add the workstations to the firewall's exceptions list.
>
you have to manually open TCP/IP port 1433, if MSDE instance you are running
is listening on the default port.. or the port you are using to connect to
it...
as regards multi instance support, Windows XP SP2 firewall will actually
disable the benefit of dynamic port detection by SQL Server... that's to say
you have to manually statically set a designed port for each instance, open
all the required ports on the Firewall and close UDP 1434 port, which is no
longer needed when dynamic detection is "disabled"..
Microsoft is developing a script for customers who need an automated
solution. If you need the script, contact msdewxp2@.microsoft.com, asking for
"script for customers who need an automated solution to enable MSDE network
connections" , as required by PSS email "Guidance for using MSDE on Windows
XP Service Pack 2"
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.7.0 - DbaMgr ver 0.53.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
i'm testing some of my applications w/c runs on MSDE on the new Windows XP Service Pack2, which actually entails newer & more secure firewall settings.
my application run on both the server & workstations only w/ the firewall switched off.
but the problem comes w/n i have the firewall settings switched on. the applications runs on the server but the workstation applications cannot.
how do i configure my workstations to be in the exception list on the firewall so they can access the server?
i'll already added the workstation's IP address & subnet but still i can't get it connect.
how do i configure my network to use TCP/IP protocol w/ a static port so i can add the workstations to the firewall's exceptions list.
thanks.
herbert
hi Herbert,
"herbert" <praetorean.tech@.graffiti.net> ha scritto nel messaggio
news:EAE41221-4DE2-458E-84D7-B24A0531F1A1@.microsoft.com...
> hi all,
> i'm testing some of my applications w/c runs on MSDE on the new Windows XP
Service Pack2, which actually entails newer & more secure firewall settings.
> my application run on both the server & workstations only w/ the firewall
switched off.
> but the problem comes w/n i have the firewall settings switched on. the
applications runs on the server but the workstation applications cannot.
> how do i configure my workstations to be in the exception list on the
firewall so they can access the server?
> i'll already added the workstation's IP address & subnet but still i can't
get it connect.
> how do i configure my network to use TCP/IP protocol w/ a static port so i
can add the workstations to the firewall's exceptions list.
>
you have to manually open TCP/IP port 1433, if MSDE instance you are running
is listening on the default port.. or the port you are using to connect to
it...
as regards multi instance support, Windows XP SP2 firewall will actually
disable the benefit of dynamic port detection by SQL Server... that's to say
you have to manually statically set a designed port for each instance, open
all the required ports on the Firewall and close UDP 1434 port, which is no
longer needed when dynamic detection is "disabled"..
Microsoft is developing a script for customers who need an automated
solution. If you need the script, contact msdewxp2@.microsoft.com, asking for
"script for customers who need an automated solution to enable MSDE network
connections" , as required by PSS email "Guidance for using MSDE on Windows
XP Service Pack 2"
Andrea Montanari (Microsoft MVP - SQL Server)
http://www.asql.biz/DbaMgr.shtmhttp://italy.mvps.org
DbaMgr2k ver 0.7.0 - DbaMgr ver 0.53.0
(my vb6+sql-dmo little try to provide MS MSDE 1.0 and MSDE 2000 a visual
interface)
-- remove DMO to reply
Firewall Setting for XP Professional
We have installed SQL Server Evaluation copy on a Windows
XP Professional Workstation with SP2 installed. We also
installed Reporting Services on that workstation as well.
We would like to access the reports on that workstation
from a remote workstation. In this way, we would like to
know what is the best way to open the firewall ? Is it
only for us to add C:\Program Files\Microsoft SQL
Server\MSSQL\Binn\sqlservr.exe in the exception list ?
ThanksHi
http://support.microsoft.com/?kbid=841249
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"Daniel" wrote:
> We have installed SQL Server Evaluation copy on a Windows
> XP Professional Workstation with SP2 installed. We also
> installed Reporting Services on that workstation as well.
> We would like to access the reports on that workstation
> from a remote workstation. In this way, we would like to
> know what is the best way to open the firewall ? Is it
> only for us to add C:\Program Files\Microsoft SQL
> Server\MSSQL\Binn\sqlservr.exe in the exception list ?
> Thanks
>
>
XP Professional Workstation with SP2 installed. We also
installed Reporting Services on that workstation as well.
We would like to access the reports on that workstation
from a remote workstation. In this way, we would like to
know what is the best way to open the firewall ? Is it
only for us to add C:\Program Files\Microsoft SQL
Server\MSSQL\Binn\sqlservr.exe in the exception list ?
ThanksHi
http://support.microsoft.com/?kbid=841249
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"Daniel" wrote:
> We have installed SQL Server Evaluation copy on a Windows
> XP Professional Workstation with SP2 installed. We also
> installed Reporting Services on that workstation as well.
> We would like to access the reports on that workstation
> from a remote workstation. In this way, we would like to
> know what is the best way to open the firewall ? Is it
> only for us to add C:\Program Files\Microsoft SQL
> Server\MSSQL\Binn\sqlservr.exe in the exception list ?
> Thanks
>
>
Firewall Setting for XP Professional
We have installed SQL Server Evaluation copy on a Windows
XP Professional Workstation with SP2 installed. We also
installed Reporting Services on that workstation as well.
We would like to access the reports on that workstation
from a remote workstation. In this way, we would like to
know what is the best way to open the firewall ? Is it
only for us to add C:\Program Files\Microsoft SQL
Server\MSSQL\Binn\sqlservr.exe in the exception list ?
Thanks
Hi
http://support.microsoft.com/?kbid=841249
Regards
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"Daniel" wrote:
> We have installed SQL Server Evaluation copy on a Windows
> XP Professional Workstation with SP2 installed. We also
> installed Reporting Services on that workstation as well.
> We would like to access the reports on that workstation
> from a remote workstation. In this way, we would like to
> know what is the best way to open the firewall ? Is it
> only for us to add C:\Program Files\Microsoft SQL
> Server\MSSQL\Binn\sqlservr.exe in the exception list ?
> Thanks
>
>
XP Professional Workstation with SP2 installed. We also
installed Reporting Services on that workstation as well.
We would like to access the reports on that workstation
from a remote workstation. In this way, we would like to
know what is the best way to open the firewall ? Is it
only for us to add C:\Program Files\Microsoft SQL
Server\MSSQL\Binn\sqlservr.exe in the exception list ?
Thanks
Hi
http://support.microsoft.com/?kbid=841249
Regards
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"Daniel" wrote:
> We have installed SQL Server Evaluation copy on a Windows
> XP Professional Workstation with SP2 installed. We also
> installed Reporting Services on that workstation as well.
> We would like to access the reports on that workstation
> from a remote workstation. In this way, we would like to
> know what is the best way to open the firewall ? Is it
> only for us to add C:\Program Files\Microsoft SQL
> Server\MSSQL\Binn\sqlservr.exe in the exception list ?
> Thanks
>
>
Firewall Setting for XP Professional
We have installed SQL Server Evaluation copy on a Windows
XP Professional Workstation with SP2 installed. We also
installed Reporting Services on that workstation as well.
We would like to access the reports on that workstation
from a remote workstation. In this way, we would like to
know what is the best way to open the firewall ? Is it
only for us to add C:\Program Files\Microsoft SQL
Server\MSSQL\Binn\sqlservr.exe in the exception list ?
ThanksHi
http://support.microsoft.com/?kbid=841249
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"Daniel" wrote:
> We have installed SQL Server Evaluation copy on a Windows
> XP Professional Workstation with SP2 installed. We also
> installed Reporting Services on that workstation as well.
> We would like to access the reports on that workstation
> from a remote workstation. In this way, we would like to
> know what is the best way to open the firewall ? Is it
> only for us to add C:\Program Files\Microsoft SQL
> Server\MSSQL\Binn\sqlservr.exe in the exception list ?
> Thanks
>
>
XP Professional Workstation with SP2 installed. We also
installed Reporting Services on that workstation as well.
We would like to access the reports on that workstation
from a remote workstation. In this way, we would like to
know what is the best way to open the firewall ? Is it
only for us to add C:\Program Files\Microsoft SQL
Server\MSSQL\Binn\sqlservr.exe in the exception list ?
ThanksHi
http://support.microsoft.com/?kbid=841249
Regards
--
Mike Epprecht, Microsoft SQL Server MVP
Zurich, Switzerland
MVP Program: http://www.microsoft.com/mvp
Blog: http://www.msmvps.com/epprecht/
"Daniel" wrote:
> We have installed SQL Server Evaluation copy on a Windows
> XP Professional Workstation with SP2 installed. We also
> installed Reporting Services on that workstation as well.
> We would like to access the reports on that workstation
> from a remote workstation. In this way, we would like to
> know what is the best way to open the firewall ? Is it
> only for us to add C:\Program Files\Microsoft SQL
> Server\MSSQL\Binn\sqlservr.exe in the exception list ?
> Thanks
>
>
Firewall Problem
I have opened port 1433 on my firewall, but I am still not able to get
remote clients to connect via query analyser, or enterprise manager.
Are there other ports required to be opened ?Have you checked your remote clients to make sure TCP/IP sockets is the
default protocol? You may have to go SQL Client Network Utility or run
through a SQL Server ODBC System DSN (Control Panel | ODBC Data Sources) and
verify that on the user login credential page that the Client Configuration
that it says TCP/IP sockets.
I did look in SQL Server books online in the Network Libraries topic, and
read this
SQL Server uses UDP port 1434 to establish connections from SQL Server 2000
clients. This socket number is also reserved for SQL Server by Internet
Assigned Number Authority (IANA).
You can download SQL Server books online for free from MS
http://www.microsoft.com/sql/techin.../2000/books.asp
****************************************
***************************
Andy S.
MCSE NT/2000, MCDBA SQL 7/2000
andymcdba1@.NOMORESPAM.yahoo.com
Please remove NOMORESPAM before replying.
Always keep your antivirus and Microsoft software
up to date with the latest definitions and product updates.
Be suspicious of every email attachment, I will never send
or post anything other than the text of a http:// link nor
post the link directly to a file for downloading.
This posting is provided "as is" with no warranties
and confers no rights.
****************************************
***************************
"AussieRules" <someone@.nowhere.com> wrote in message
news:upbiLWY6DHA.3288@.TK2MSFTNGP11.phx.gbl...
remote clients to connect via query analyser, or enterprise manager.
Are there other ports required to be opened ?Have you checked your remote clients to make sure TCP/IP sockets is the
default protocol? You may have to go SQL Client Network Utility or run
through a SQL Server ODBC System DSN (Control Panel | ODBC Data Sources) and
verify that on the user login credential page that the Client Configuration
that it says TCP/IP sockets.
I did look in SQL Server books online in the Network Libraries topic, and
read this
SQL Server uses UDP port 1434 to establish connections from SQL Server 2000
clients. This socket number is also reserved for SQL Server by Internet
Assigned Number Authority (IANA).
You can download SQL Server books online for free from MS
http://www.microsoft.com/sql/techin.../2000/books.asp
****************************************
***************************
Andy S.
MCSE NT/2000, MCDBA SQL 7/2000
andymcdba1@.NOMORESPAM.yahoo.com
Please remove NOMORESPAM before replying.
Always keep your antivirus and Microsoft software
up to date with the latest definitions and product updates.
Be suspicious of every email attachment, I will never send
or post anything other than the text of a http:// link nor
post the link directly to a file for downloading.
This posting is provided "as is" with no warranties
and confers no rights.
****************************************
***************************
"AussieRules" <someone@.nowhere.com> wrote in message
news:upbiLWY6DHA.3288@.TK2MSFTNGP11.phx.gbl...
quote:
> I have opened port 1433 on my firewall, but I am still not able to get
> remote clients to connect via query analyser, or enterprise manager.
> Are there other ports required to be opened ?
>
>
Firewall ports to open
We're setting up an IIS server in a DMZ but it needs to communicate with a
SQL server on the LAN through the NetScreen firewall. I've opened up all
ports in test and using Enterprise Manager & Query Analyser, the following
ports are used:
UDP 1434
TCP 9127
Now I've seen lots of mentions to 1434 (not sure it should be UDP but there
you go) but is TCP 9127 also needed?
Thanks, Rob.PS. Also noticed TCP 1433 as well so the list so far:
UDP: 1434
TCP: 9127, 1433
"Rob Nicholson" <informed@.community.nospam> wrote in message
news:egK0lfc6EHA.2876@.TK2MSFTNGP12.phx.gbl...
> We're setting up an IIS server in a DMZ but it needs to communicate with a
> SQL server on the LAN through the NetScreen firewall. I've opened up all
> ports in test and using Enterprise Manager & Query Analyser, the following
> ports are used:
> UDP 1434
> TCP 9127
> Now I've seen lots of mentions to 1434 (not sure it should be UDP but
there
> you go) but is TCP 9127 also needed?
> Thanks, Rob.
>|||Hi
Check out
http://support.microsoft.com/defaul...kb;en-us;287932
John
"Rob Nicholson" <informed@.community.nospam> wrote in message
news:OEYY2gc6EHA.1564@.TK2MSFTNGP09.phx.gbl...
> PS. Also noticed TCP 1433 as well so the list so far:
> UDP: 1434
> TCP: 9127, 1433
> "Rob Nicholson" <informed@.community.nospam> wrote in message
> news:egK0lfc6EHA.2876@.TK2MSFTNGP12.phx.gbl...
> there
>|||Hello Rob,
To communicate with a SQL server through the NetScreen firewall, you need
configure the firewall, you must allow traffic from *ANY* to 1433, and from
1433 to *ANY*, where *ANY* is a port greater than 1024.
*ANY* -> 1433
1433 -> *ANY*
The firewall software should allow this dynamic allocation to occur through
the use of rules. If it does, you can configure 1433 -> *ANY* established;
this will dynamically open the response port after a syn followed by a
syn/ack by way of a statefull packet inspection.
There is no way to limit the number of source TCP ports used for a SQL
Server client to connect; this would defeat the purpose of having the
client allocate a new, unused dynamic port. This is a TCP/IP standard that
is defined for Winsock applications; this is not a limitation of SQL Server
client communication.
If you want you can use firewall to allow connection to SQL server only
from IIS server. You need enable TCPIP protocol on both server and client
side.
In addition, a named instance of SQL Server 2000 will use a dynamic
destination port by default. This port should be changed to a fixed port
prior to configuring the firewall. The SQL Server Network Utility should be
used to configure the destination port. See SQL Server Books Online for
information on how to use the SQL Server Network Utility.
You can refer to the following article regarding how to find the SQL Server
instance port number:
INF: How to Connect to an SQL Server 2000 Named Instance with the Previous
Version's Client Tools (265808)
http://support.microsoft.com/defaul...KB;EN-US;265808
Otherwise, the client computer would need to open a random UDP port and the
server UDP port 1434 will be used to send the instance name, and if the
instance is clustered, the version of the SQL instance, the TCP port number
that the instance is listening on, and the named pipe that the instance is
using. However, if the goal is to minimize the number of ports open on the
firewall, a static port number should be chosen for the default instance
and any named instance. The client computers would need to be configured to
connect to a particular ServerName or ServerName instance and specific port
number.
When SQLMail is started on a SQL Server, a DLL responsible for this creates
a socket and listens for connections. SQL Enterprise Manager will
periodically connect to this socket and read a DWORD (32bit) value returned
from the server. This value determines the state of sqlmail. By default the
port which sqlmail use is 9127.
I hope above information is helpful.
Sophie Guo
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
========================================
=============
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
========================================
=============
This posting is provided "AS IS" with no warranties, and confers no rights.|||Hello Rob,
To communicate with a SQL server through the NetScreen firewall, you need
configure the firewall, you must allow traffic from *ANY* to 1433, and from
1433 to *ANY*, where *ANY* is a port greater than 1024.
*ANY* -> 1433
1433 -> *ANY*
The firewall software should allow this dynamic allocation to occur through
the use of rules. If it does, you can configure 1433 -> *ANY* established;
this will dynamically open the response port after a syn followed by a
syn/ack by way of a statefull packet inspection.
There is no way to limit the number of source TCP ports used for a SQL
Server client to connect; this would defeat the purpose of having the
client allocate a new, unused dynamic port. This is a TCP/IP standard that
is defined for Winsock applications; this is not a limitation of SQL Server
client communication.
If you want you can use firewall to allow connection to SQL server only
from IIS server. You need enable TCPIP protocol on both server and client
side.
In addition, a named instance of SQL Server 2000 will use a dynamic
destination port by default. This port should be changed to a fixed port
prior to configuring the firewall. The SQL Server Network Utility should be
used to configure the destination port. See SQL Server Books Online for
information on how to use the SQL Server Network Utility.
You can refer to the following article regarding how to find the SQL Server
instance port number:
INF: How to Connect to an SQL Server 2000 Named Instance with the Previous
Version's Client Tools (265808)
http://support.microsoft.com/defaul...KB;EN-US;265808
Otherwise, the client computer would need to open a random UDP port and the
server UDP port 1434 will be used to send the instance name, and if the
instance is clustered, the version of the SQL instance, the TCP port number
that the instance is listening on, and the named pipe that the instance is
using. However, if the goal is to minimize the number of ports open on the
firewall, a static port number should be chosen for the default instance
and any named instance. The client computers would need to be configured to
connect to a particular ServerName or ServerName instance and specific port
number.
When SQLMail is started on a SQL Server, a DLL responsible for this creates
a socket and listens for connections. SQL Enterprise Manager will
periodically connect to this socket and read a DWORD (32bit) value returned
from the server. This value determines the state of sqlmail. By default the
port which sqlmail use is 9127.
I hope above information is helpful.
Sophie Guo
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
========================================
=============
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
========================================
=============
This posting is provided "AS IS" with no warranties, and confers no rights.
SQL server on the LAN through the NetScreen firewall. I've opened up all
ports in test and using Enterprise Manager & Query Analyser, the following
ports are used:
UDP 1434
TCP 9127
Now I've seen lots of mentions to 1434 (not sure it should be UDP but there
you go) but is TCP 9127 also needed?
Thanks, Rob.PS. Also noticed TCP 1433 as well so the list so far:
UDP: 1434
TCP: 9127, 1433
"Rob Nicholson" <informed@.community.nospam> wrote in message
news:egK0lfc6EHA.2876@.TK2MSFTNGP12.phx.gbl...
> We're setting up an IIS server in a DMZ but it needs to communicate with a
> SQL server on the LAN through the NetScreen firewall. I've opened up all
> ports in test and using Enterprise Manager & Query Analyser, the following
> ports are used:
> UDP 1434
> TCP 9127
> Now I've seen lots of mentions to 1434 (not sure it should be UDP but
there
> you go) but is TCP 9127 also needed?
> Thanks, Rob.
>|||Hi
Check out
http://support.microsoft.com/defaul...kb;en-us;287932
John
"Rob Nicholson" <informed@.community.nospam> wrote in message
news:OEYY2gc6EHA.1564@.TK2MSFTNGP09.phx.gbl...
> PS. Also noticed TCP 1433 as well so the list so far:
> UDP: 1434
> TCP: 9127, 1433
> "Rob Nicholson" <informed@.community.nospam> wrote in message
> news:egK0lfc6EHA.2876@.TK2MSFTNGP12.phx.gbl...
> there
>|||Hello Rob,
To communicate with a SQL server through the NetScreen firewall, you need
configure the firewall, you must allow traffic from *ANY* to 1433, and from
1433 to *ANY*, where *ANY* is a port greater than 1024.
*ANY* -> 1433
1433 -> *ANY*
The firewall software should allow this dynamic allocation to occur through
the use of rules. If it does, you can configure 1433 -> *ANY* established;
this will dynamically open the response port after a syn followed by a
syn/ack by way of a statefull packet inspection.
There is no way to limit the number of source TCP ports used for a SQL
Server client to connect; this would defeat the purpose of having the
client allocate a new, unused dynamic port. This is a TCP/IP standard that
is defined for Winsock applications; this is not a limitation of SQL Server
client communication.
If you want you can use firewall to allow connection to SQL server only
from IIS server. You need enable TCPIP protocol on both server and client
side.
In addition, a named instance of SQL Server 2000 will use a dynamic
destination port by default. This port should be changed to a fixed port
prior to configuring the firewall. The SQL Server Network Utility should be
used to configure the destination port. See SQL Server Books Online for
information on how to use the SQL Server Network Utility.
You can refer to the following article regarding how to find the SQL Server
instance port number:
INF: How to Connect to an SQL Server 2000 Named Instance with the Previous
Version's Client Tools (265808)
http://support.microsoft.com/defaul...KB;EN-US;265808
Otherwise, the client computer would need to open a random UDP port and the
server UDP port 1434 will be used to send the instance name, and if the
instance is clustered, the version of the SQL instance, the TCP port number
that the instance is listening on, and the named pipe that the instance is
using. However, if the goal is to minimize the number of ports open on the
firewall, a static port number should be chosen for the default instance
and any named instance. The client computers would need to be configured to
connect to a particular ServerName or ServerName instance and specific port
number.
When SQLMail is started on a SQL Server, a DLL responsible for this creates
a socket and listens for connections. SQL Enterprise Manager will
periodically connect to this socket and read a DWORD (32bit) value returned
from the server. This value determines the state of sqlmail. By default the
port which sqlmail use is 9127.
I hope above information is helpful.
Sophie Guo
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
========================================
=============
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
========================================
=============
This posting is provided "AS IS" with no warranties, and confers no rights.|||Hello Rob,
To communicate with a SQL server through the NetScreen firewall, you need
configure the firewall, you must allow traffic from *ANY* to 1433, and from
1433 to *ANY*, where *ANY* is a port greater than 1024.
*ANY* -> 1433
1433 -> *ANY*
The firewall software should allow this dynamic allocation to occur through
the use of rules. If it does, you can configure 1433 -> *ANY* established;
this will dynamically open the response port after a syn followed by a
syn/ack by way of a statefull packet inspection.
There is no way to limit the number of source TCP ports used for a SQL
Server client to connect; this would defeat the purpose of having the
client allocate a new, unused dynamic port. This is a TCP/IP standard that
is defined for Winsock applications; this is not a limitation of SQL Server
client communication.
If you want you can use firewall to allow connection to SQL server only
from IIS server. You need enable TCPIP protocol on both server and client
side.
In addition, a named instance of SQL Server 2000 will use a dynamic
destination port by default. This port should be changed to a fixed port
prior to configuring the firewall. The SQL Server Network Utility should be
used to configure the destination port. See SQL Server Books Online for
information on how to use the SQL Server Network Utility.
You can refer to the following article regarding how to find the SQL Server
instance port number:
INF: How to Connect to an SQL Server 2000 Named Instance with the Previous
Version's Client Tools (265808)
http://support.microsoft.com/defaul...KB;EN-US;265808
Otherwise, the client computer would need to open a random UDP port and the
server UDP port 1434 will be used to send the instance name, and if the
instance is clustered, the version of the SQL instance, the TCP port number
that the instance is listening on, and the named pipe that the instance is
using. However, if the goal is to minimize the number of ports open on the
firewall, a static port number should be chosen for the default instance
and any named instance. The client computers would need to be configured to
connect to a particular ServerName or ServerName instance and specific port
number.
When SQLMail is started on a SQL Server, a DLL responsible for this creates
a socket and listens for connections. SQL Enterprise Manager will
periodically connect to this socket and read a DWORD (32bit) value returned
from the server. This value determines the state of sqlmail. By default the
port which sqlmail use is 9127.
I hope above information is helpful.
Sophie Guo
Microsoft Online Partner Support
Get Secure! - www.microsoft.com/security
========================================
=============
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
========================================
=============
This posting is provided "AS IS" with no warranties, and confers no rights.
firewall ports open for tcp/ip connection on server
I would like to know what ports need to be open to access MS SQL via
TCP/IP, using W2k3 and SQL2005.
The default port is 1433. Any UDP openings. I want to use SqlManager on a
remote machine also.
Thanks
Harry
Hi Harry
http://support.microsoft.com/kb/287932 describes how to configure the
firewall.
John
"Harry" wrote:
> I would like to know what ports need to be open to access MS SQL via
> TCP/IP, using W2k3 and SQL2005.
> The default port is 1433. Any UDP openings. I want to use SqlManager on a
> remote machine also.
> Thanks
> Harry
>
>
TCP/IP, using W2k3 and SQL2005.
The default port is 1433. Any UDP openings. I want to use SqlManager on a
remote machine also.
Thanks
Harry
Hi Harry
http://support.microsoft.com/kb/287932 describes how to configure the
firewall.
John
"Harry" wrote:
> I would like to know what ports need to be open to access MS SQL via
> TCP/IP, using W2k3 and SQL2005.
> The default port is 1433. Any UDP openings. I want to use SqlManager on a
> remote machine also.
> Thanks
> Harry
>
>
firewall ports open for tcp/ip connection on server
I would like to know what ports need to be open to access MS SQL via
TCP/IP, using W2k3 and SQL2005.
The default port is 1433. Any UDP openings. I want to use SqlManager on a
remote machine also.
Thanks
HarryHi Harry
http://support.microsoft.com/kb/287932 describes how to configure the
firewall.
John
"Harry" wrote:
> I would like to know what ports need to be open to access MS SQL via
> TCP/IP, using W2k3 and SQL2005.
> The default port is 1433. Any UDP openings. I want to use SqlManager on a
> remote machine also.
> Thanks
> Harry
>
>
TCP/IP, using W2k3 and SQL2005.
The default port is 1433. Any UDP openings. I want to use SqlManager on a
remote machine also.
Thanks
HarryHi Harry
http://support.microsoft.com/kb/287932 describes how to configure the
firewall.
John
"Harry" wrote:
> I would like to know what ports need to be open to access MS SQL via
> TCP/IP, using W2k3 and SQL2005.
> The default port is 1433. Any UDP openings. I want to use SqlManager on a
> remote machine also.
> Thanks
> Harry
>
>
firewall ports open for tcp/ip connection on server
I would like to know what ports need to be open to access MS SQL via
TCP/IP, using W2k3 and SQL2005.
The default port is 1433. Any UDP openings. I want to use SqlManager on a
remote machine also.
Thanks
HarryHi Harry
http://support.microsoft.com/kb/287932 describes how to configure the
firewall.
John
"Harry" wrote:
> I would like to know what ports need to be open to access MS SQL via
> TCP/IP, using W2k3 and SQL2005.
> The default port is 1433. Any UDP openings. I want to use SqlManager on a
> remote machine also.
> Thanks
> Harry
>
>
TCP/IP, using W2k3 and SQL2005.
The default port is 1433. Any UDP openings. I want to use SqlManager on a
remote machine also.
Thanks
HarryHi Harry
http://support.microsoft.com/kb/287932 describes how to configure the
firewall.
John
"Harry" wrote:
> I would like to know what ports need to be open to access MS SQL via
> TCP/IP, using W2k3 and SQL2005.
> The default port is 1433. Any UDP openings. I want to use SqlManager on a
> remote machine also.
> Thanks
> Harry
>
>
Firewall Ports
What ports need to be opened between the report server and the SQL Server backend DB? Does port 135 need to be opened?Port 135 is the DCOM port. I don't think it needs to be opened, although I am not 100% sure. Are you seeing problems?
Firewall Port 1443
I installed SQL Server 2000 Enterprise Trial. I am trying to connect to my Remote database. In Enterprise Manager it won't resolve listing the server and it's tables. I can register and get a connection though. My host said that if I am behind the firewal
l, that it blocks Port 1433. I tried switching the Port to 8080 and 1222. Still no luck. I am stuck. Any ideas?
Stickfigure
Because everyone likes Figures.
can you connect using query analyser? Or osql?
Vikram Jayaram
Microsoft, SQL Server
This posting is provided "AS IS" with no warranties, and confers no rights.
Subscribe to MSDN & use http://msdn.microsoft.com/newsgroups.
|||If it is a firewall issue, and if port 1433 is blocked then the chances are
that ports 8080 and 1222 are blocked also. You might need to take this up
with your firewall administrator.
"Stickfigure" <Stickfigure@.discussions.microsoft.com> wrote in message
news:792F6F89-F318-4E47-99FA-189E9D082BDD@.microsoft.com...
>I installed SQL Server 2000 Enterprise Trial. I am trying to connect to my
>Remote database. In Enterprise Manager it won't resolve listing the server
>and it's tables. I can register and get a connection though. My host said
>that if I am behind the firewall, that it blocks Port 1433. I tried
>switching the Port to 8080 and 1222. Still no luck. I am stuck. Any ideas?
> Stickfigure
> Because everyone likes Figures.
l, that it blocks Port 1433. I tried switching the Port to 8080 and 1222. Still no luck. I am stuck. Any ideas?
Stickfigure
Because everyone likes Figures.
can you connect using query analyser? Or osql?
Vikram Jayaram
Microsoft, SQL Server
This posting is provided "AS IS" with no warranties, and confers no rights.
Subscribe to MSDN & use http://msdn.microsoft.com/newsgroups.
|||If it is a firewall issue, and if port 1433 is blocked then the chances are
that ports 8080 and 1222 are blocked also. You might need to take this up
with your firewall administrator.
"Stickfigure" <Stickfigure@.discussions.microsoft.com> wrote in message
news:792F6F89-F318-4E47-99FA-189E9D082BDD@.microsoft.com...
>I installed SQL Server 2000 Enterprise Trial. I am trying to connect to my
>Remote database. In Enterprise Manager it won't resolve listing the server
>and it's tables. I can register and get a connection though. My host said
>that if I am behind the firewall, that it blocks Port 1433. I tried
>switching the Port to 8080 and 1222. Still no luck. I am stuck. Any ideas?
> Stickfigure
> Because everyone likes Figures.
Firewall Port 1443
I installed SQL Server 2000 Enterprise Trial. I am trying to connect to my Remote database. In Enterprise Manager it won't resolve listing the server and it's tables. I can register and get a connection though. My host said that if I am behind the firewal
l, that it blocks Port 1433. I tried switching the Port to 8080 and 1222. Still no luck. I am stuck. Any ideas?
Stickfigure
Can you connect through query analyser to another machine?
Vikram Jayaram
Microsoft, SQL Server
This posting is provided "AS IS" with no warranties, and confers no rights.
Subscribe to MSDN & use http://msdn.microsoft.com/newsgroups.
l, that it blocks Port 1433. I tried switching the Port to 8080 and 1222. Still no luck. I am stuck. Any ideas?
Stickfigure
Can you connect through query analyser to another machine?
Vikram Jayaram
Microsoft, SQL Server
This posting is provided "AS IS" with no warranties, and confers no rights.
Subscribe to MSDN & use http://msdn.microsoft.com/newsgroups.
Firewall Port 1443
I installed SQL Server 2000 Enterprise Trial. I am trying to connect to my R
emote database. In Enterprise Manager it won't resolve listing the server an
d it's tables. I can register and get a connection though. My host said that
if I am behind the firewal
l, that it blocks Port 1433. I tried switching the Port to 8080 and 1222. St
ill no luck. I am stuck. Any ideas?
StickfigureCan you connect through query analyser to another machine?
Vikram Jayaram
Microsoft, SQL Server
This posting is provided "AS IS" with no warranties, and confers no rights.
Subscribe to MSDN & use http://msdn.microsoft.com/newsgroups.
emote database. In Enterprise Manager it won't resolve listing the server an
d it's tables. I can register and get a connection though. My host said that
if I am behind the firewal
l, that it blocks Port 1433. I tried switching the Port to 8080 and 1222. St
ill no luck. I am stuck. Any ideas?
StickfigureCan you connect through query analyser to another machine?
Vikram Jayaram
Microsoft, SQL Server
This posting is provided "AS IS" with no warranties, and confers no rights.
Subscribe to MSDN & use http://msdn.microsoft.com/newsgroups.
Firewall Port 1443
I installed SQL Server 2000 Enterprise Trial. I am trying to connect to my R
emote database. In Enterprise Manager it won't resolve listing the server an
d it's tables. I can register and get a connection though. My host said that
if I am behind the firewal
l, that it blocks Port 1433. I tried switching the Port to 8080 and 1222. St
ill no luck. I am stuck. Any ideas?
Stickfigure
Because everyone likes Figures.can you connect using query analyser? Or osql?
Vikram Jayaram
Microsoft, SQL Server
This posting is provided "AS IS" with no warranties, and confers no rights.
Subscribe to MSDN & use http://msdn.microsoft.com/newsgroups.|||If it is a firewall issue, and if port 1433 is blocked then the chances are
that ports 8080 and 1222 are blocked also. You might need to take this up
with your firewall administrator.
"Stickfigure" <Stickfigure@.discussions.microsoft.com> wrote in message
news:792F6F89-F318-4E47-99FA-189E9D082BDD@.microsoft.com...
>I installed SQL Server 2000 Enterprise Trial. I am trying to connect to my
>Remote database. In Enterprise Manager it won't resolve listing the server
>and it's tables. I can register and get a connection though. My host said
>that if I am behind the firewall, that it blocks Port 1433. I tried
>switching the Port to 8080 and 1222. Still no luck. I am stuck. Any ideas?
> Stickfigure
> Because everyone likes Figures.
emote database. In Enterprise Manager it won't resolve listing the server an
d it's tables. I can register and get a connection though. My host said that
if I am behind the firewal
l, that it blocks Port 1433. I tried switching the Port to 8080 and 1222. St
ill no luck. I am stuck. Any ideas?
Stickfigure
Because everyone likes Figures.can you connect using query analyser? Or osql?
Vikram Jayaram
Microsoft, SQL Server
This posting is provided "AS IS" with no warranties, and confers no rights.
Subscribe to MSDN & use http://msdn.microsoft.com/newsgroups.|||If it is a firewall issue, and if port 1433 is blocked then the chances are
that ports 8080 and 1222 are blocked also. You might need to take this up
with your firewall administrator.
"Stickfigure" <Stickfigure@.discussions.microsoft.com> wrote in message
news:792F6F89-F318-4E47-99FA-189E9D082BDD@.microsoft.com...
>I installed SQL Server 2000 Enterprise Trial. I am trying to connect to my
>Remote database. In Enterprise Manager it won't resolve listing the server
>and it's tables. I can register and get a connection though. My host said
>that if I am behind the firewall, that it blocks Port 1433. I tried
>switching the Port to 8080 and 1222. Still no luck. I am stuck. Any ideas?
> Stickfigure
> Because everyone likes Figures.
Firewall in Replication
Hi,
We are using SQL Server 2000. We need to setup merge replication between
server A & B using TCP/IP.
These servers are behind a firewall. The connection
between these servers can be done only using IP (class C)
How to configure this.
rgds,
Soura
Basically with SQL 2000 you need to allow inbound connections on port 1433
and 21 from the device doing the pull. Download the snapshot using ftp. If
this is not possible upgrade to SQL 2005 and do web synchronizations.
Hilary Cotter
Director of Text Mining and Database Strategy
RelevantNOISE.Com - Dedicated to mining blogs for business intelligence.
This posting is my own and doesn't necessarily represent RelevantNoise's
positions, strategies or opinions.
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"SouRa" <SouRa@.discussions.microsoft.com> wrote in message
news:134C38E0-CAAF-44C6-AD2B-1D525DB5BB0D@.microsoft.com...
> Hi,
> We are using SQL Server 2000. We need to setup merge replication between
> server A & B using TCP/IP.
> These servers are behind a firewall. The connection
> between these servers can be done only using IP (class C)
> How to configure this.
> rgds,
> Soura
>
>
We are using SQL Server 2000. We need to setup merge replication between
server A & B using TCP/IP.
These servers are behind a firewall. The connection
between these servers can be done only using IP (class C)
How to configure this.
rgds,
Soura
Basically with SQL 2000 you need to allow inbound connections on port 1433
and 21 from the device doing the pull. Download the snapshot using ftp. If
this is not possible upgrade to SQL 2005 and do web synchronizations.
Hilary Cotter
Director of Text Mining and Database Strategy
RelevantNOISE.Com - Dedicated to mining blogs for business intelligence.
This posting is my own and doesn't necessarily represent RelevantNoise's
positions, strategies or opinions.
Looking for a SQL Server replication book?
http://www.nwsu.com/0974973602.html
Looking for a FAQ on Indexing Services/SQL FTS
http://www.indexserverfaq.com
"SouRa" <SouRa@.discussions.microsoft.com> wrote in message
news:134C38E0-CAAF-44C6-AD2B-1D525DB5BB0D@.microsoft.com...
> Hi,
> We are using SQL Server 2000. We need to setup merge replication between
> server A & B using TCP/IP.
> These servers are behind a firewall. The connection
> between these servers can be done only using IP (class C)
> How to configure this.
> rgds,
> Soura
>
>
2012年2月19日星期日
Firewall between Web Server and SQL Server
Hello everyone,
I've setup a web server in the DMZ and it interacts with a SQL server on the
inside of the firewall.
The problem is when I want to apply access control lists to the firewall,
the web server can't communicate with the SQL server for some reason.
I've enabled ports 1433, 135, 139... and when I apply the rule, and type the
website in the browser, I get a message that says SQL server not found...
etc...
Does anyone have any experience in this kind of situation?
Any help would be greatly appreciated.
AliAli (amiralisetoudeh@.hotmail.com) writes:
> I've setup a web server in the DMZ and it interacts with a SQL server on
> the inside of the firewall.
> The problem is when I want to apply access control lists to the firewall,
> the web server can't communicate with the SQL server for some reason.
> I've enabled ports 1433, 135, 139... and when I apply the rule, and type
> the website in the browser, I get a message that says SQL server not
> found... etc...
> Does anyone have any experience in this kind of situation?
Ports 135 and 139? Do you really need them? Those are ports I would keep
closed in a firewall.
As for SQL Server not being found, the obvious things to check are:
o Is SQL Server listening on port 1433? (If it's a named instance,
typically it does not.)
o Is the server name resolvable? Would it work if you use the IP address?
o What does the connection string in the application look like?
o Try connecting from SQLCMD or OSQL on the web server, to see if that
works.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx|||Again, thanks for the reply Erland.
I guess 135 and 139 aren't needed as I removed them from the firewall rules.
The problem in a more detailed explanation was:
I enabled a firewall rule to have the web server, which is in the DMZ, talk
with the SQL server, which is inside. I enabled only SQL services to pass
through. And this configuration was working fine.
Over the weekend they called me saying the website was down and they had to
allow all traffic in the firewall rule. They explained for some reason ODBC
logging got enabled in IIS and couldn't communicate with the SQL server over
the port it communicates...
I'm still trying to monitor the network and see if it'll happen again...
hopefully not.
Ali
"Erland Sommarskog" <esquel@.sommarskog.se> wrote in message
news:Xns9905DF2A140C6Yazorman@.127.0.0.1...
> Ali (amiralisetoudeh@.hotmail.com) writes:
> Ports 135 and 139? Do you really need them? Those are ports I would keep
> closed in a firewall.
> As for SQL Server not being found, the obvious things to check are:
> o Is SQL Server listening on port 1433? (If it's a named instance,
> typically it does not.)
> o Is the server name resolvable? Would it work if you use the IP address?
> o What does the connection string in the application look like?
> o Try connecting from SQLCMD or OSQL on the web server, to see if that
> works.
>
> --
> Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
> Books Online for SQL Server 2005 at
> http://www.microsoft.com/technet/pr...oads/books.mspx
> Books Online for SQL Server 2000 at
> http://www.microsoft.com/sql/prodin...ions/books.mspx|||Ali (amiralisetoudeh@.hotmail.com) writes:
> Over the weekend they called me saying the website was down and they had
> to allow all traffic in the firewall rule. They explained for some
> reason ODBC logging got enabled in IIS and couldn't communicate with the
> SQL server over the port it communicates...
ODBC logging generates a lot of output and takes lots of resources. Not
that I see how it could affect the firewall, but maybe it was the general
load that caused problems together with the firewall.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx
I've setup a web server in the DMZ and it interacts with a SQL server on the
inside of the firewall.
The problem is when I want to apply access control lists to the firewall,
the web server can't communicate with the SQL server for some reason.
I've enabled ports 1433, 135, 139... and when I apply the rule, and type the
website in the browser, I get a message that says SQL server not found...
etc...
Does anyone have any experience in this kind of situation?
Any help would be greatly appreciated.
AliAli (amiralisetoudeh@.hotmail.com) writes:
> I've setup a web server in the DMZ and it interacts with a SQL server on
> the inside of the firewall.
> The problem is when I want to apply access control lists to the firewall,
> the web server can't communicate with the SQL server for some reason.
> I've enabled ports 1433, 135, 139... and when I apply the rule, and type
> the website in the browser, I get a message that says SQL server not
> found... etc...
> Does anyone have any experience in this kind of situation?
Ports 135 and 139? Do you really need them? Those are ports I would keep
closed in a firewall.
As for SQL Server not being found, the obvious things to check are:
o Is SQL Server listening on port 1433? (If it's a named instance,
typically it does not.)
o Is the server name resolvable? Would it work if you use the IP address?
o What does the connection string in the application look like?
o Try connecting from SQLCMD or OSQL on the web server, to see if that
works.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx|||Again, thanks for the reply Erland.
I guess 135 and 139 aren't needed as I removed them from the firewall rules.
The problem in a more detailed explanation was:
I enabled a firewall rule to have the web server, which is in the DMZ, talk
with the SQL server, which is inside. I enabled only SQL services to pass
through. And this configuration was working fine.
Over the weekend they called me saying the website was down and they had to
allow all traffic in the firewall rule. They explained for some reason ODBC
logging got enabled in IIS and couldn't communicate with the SQL server over
the port it communicates...
I'm still trying to monitor the network and see if it'll happen again...
hopefully not.
Ali
"Erland Sommarskog" <esquel@.sommarskog.se> wrote in message
news:Xns9905DF2A140C6Yazorman@.127.0.0.1...
> Ali (amiralisetoudeh@.hotmail.com) writes:
> Ports 135 and 139? Do you really need them? Those are ports I would keep
> closed in a firewall.
> As for SQL Server not being found, the obvious things to check are:
> o Is SQL Server listening on port 1433? (If it's a named instance,
> typically it does not.)
> o Is the server name resolvable? Would it work if you use the IP address?
> o What does the connection string in the application look like?
> o Try connecting from SQLCMD or OSQL on the web server, to see if that
> works.
>
> --
> Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
> Books Online for SQL Server 2005 at
> http://www.microsoft.com/technet/pr...oads/books.mspx
> Books Online for SQL Server 2000 at
> http://www.microsoft.com/sql/prodin...ions/books.mspx|||Ali (amiralisetoudeh@.hotmail.com) writes:
> Over the weekend they called me saying the website was down and they had
> to allow all traffic in the firewall rule. They explained for some
> reason ODBC logging got enabled in IIS and couldn't communicate with the
> SQL server over the port it communicates...
ODBC logging generates a lot of output and takes lots of resources. Not
that I see how it could affect the firewall, but maybe it was the general
load that caused problems together with the firewall.
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx
Firewall between IIS and SQL Server
Hi:
(Sorry for double post, I already post it in sqlserver.setup group but
i did't get any reply.)
I plan to deploying an ASP.Net web app into the following scenario:
Internet --> Firewall1 --> WebServer (IIS+SQL Server 2000) -->
firewall2 --> SQL Server 2000
The WebServer and the SQL Server behind the firewall2 is sit on
different LAN (different sub net),
and a two way replication will be create to sync these two SQL server
through firewall2.
Is it possible ? Is the firewall2 redundant ?
Separate the Web server and SQL server to different sub net and add
firewall2 between Web Server and SQL Server, does this configuration
provide better security to secure the data use by the LAN user ?
Thanks
JCVoon
having your servers behind the firewall does provide greater security.
however, you might want to read up on configuration to ensure connectivity
between hubs.
http://support.microsoft.com/kb/287932
-oj
"jcvoon" <jcvoon@.maximas.com.my> wrote in message
news:1143602187.916531.187150@.i39g2000cwa.googlegr oups.com...
> Hi:
> (Sorry for double post, I already post it in sqlserver.setup group but
> i did't get any reply.)
> I plan to deploying an ASP.Net web app into the following scenario:
>
> Internet --> Firewall1 --> WebServer (IIS+SQL Server 2000) -->
> firewall2 --> SQL Server 2000
>
> The WebServer and the SQL Server behind the firewall2 is sit on
> different LAN (different sub net),
> and a two way replication will be create to sync these two SQL server
> through firewall2.
>
> Is it possible ? Is the firewall2 redundant ?
> Separate the Web server and SQL server to different sub net and add
> firewall2 between Web Server and SQL Server, does this configuration
> provide better security to secure the data use by the LAN user ?
>
> Thanks
> JCVoon
>
|||oj:
Thanks for the info.
Regards
JCVoon
(Sorry for double post, I already post it in sqlserver.setup group but
i did't get any reply.)
I plan to deploying an ASP.Net web app into the following scenario:
Internet --> Firewall1 --> WebServer (IIS+SQL Server 2000) -->
firewall2 --> SQL Server 2000
The WebServer and the SQL Server behind the firewall2 is sit on
different LAN (different sub net),
and a two way replication will be create to sync these two SQL server
through firewall2.
Is it possible ? Is the firewall2 redundant ?
Separate the Web server and SQL server to different sub net and add
firewall2 between Web Server and SQL Server, does this configuration
provide better security to secure the data use by the LAN user ?
Thanks
JCVoon
having your servers behind the firewall does provide greater security.
however, you might want to read up on configuration to ensure connectivity
between hubs.
http://support.microsoft.com/kb/287932
-oj
"jcvoon" <jcvoon@.maximas.com.my> wrote in message
news:1143602187.916531.187150@.i39g2000cwa.googlegr oups.com...
> Hi:
> (Sorry for double post, I already post it in sqlserver.setup group but
> i did't get any reply.)
> I plan to deploying an ASP.Net web app into the following scenario:
>
> Internet --> Firewall1 --> WebServer (IIS+SQL Server 2000) -->
> firewall2 --> SQL Server 2000
>
> The WebServer and the SQL Server behind the firewall2 is sit on
> different LAN (different sub net),
> and a two way replication will be create to sync these two SQL server
> through firewall2.
>
> Is it possible ? Is the firewall2 redundant ?
> Separate the Web server and SQL server to different sub net and add
> firewall2 between Web Server and SQL Server, does this configuration
> provide better security to secure the data use by the LAN user ?
>
> Thanks
> JCVoon
>
|||oj:
Thanks for the info.
Regards
JCVoon
Firewall between IIS and SQL Server
Hi:
(Sorry for double post, I already post it in sqlserver.setup group but
i did't get any reply.)
I plan to deploying an ASP.Net web app into the following scenario:
Internet --> Firewall1 --> WebServer (IIS+SQL Server 2000) -->
firewall2 --> SQL Server 2000
The WebServer and the SQL Server behind the firewall2 is sit on
different LAN (different sub net),
and a two way replication will be create to sync these two SQL server
through firewall2.
Is it possible ? Is the firewall2 redundant ?
Separate the Web server and SQL server to different sub net and add
firewall2 between Web Server and SQL Server, does this configuration
provide better security to secure the data use by the LAN user ?
Thanks
JCVoonhaving your servers behind the firewall does provide greater security.
however, you might want to read up on configuration to ensure connectivity
between hubs.
http://support.microsoft.com/kb/287932
-oj
"jcvoon" <jcvoon@.maximas.com.my> wrote in message
news:1143602187.916531.187150@.i39g2000cwa.googlegroups.com...
> Hi:
> (Sorry for double post, I already post it in sqlserver.setup group but
> i did't get any reply.)
> I plan to deploying an ASP.Net web app into the following scenario:
>
> Internet --> Firewall1 --> WebServer (IIS+SQL Server 2000) -->
> firewall2 --> SQL Server 2000
>
> The WebServer and the SQL Server behind the firewall2 is sit on
> different LAN (different sub net),
> and a two way replication will be create to sync these two SQL server
> through firewall2.
>
> Is it possible ? Is the firewall2 redundant ?
> Separate the Web server and SQL server to different sub net and add
> firewall2 between Web Server and SQL Server, does this configuration
> provide better security to secure the data use by the LAN user ?
>
> Thanks
> JCVoon
>|||oj:
Thanks for the info.
Regards
JCVoon
(Sorry for double post, I already post it in sqlserver.setup group but
i did't get any reply.)
I plan to deploying an ASP.Net web app into the following scenario:
Internet --> Firewall1 --> WebServer (IIS+SQL Server 2000) -->
firewall2 --> SQL Server 2000
The WebServer and the SQL Server behind the firewall2 is sit on
different LAN (different sub net),
and a two way replication will be create to sync these two SQL server
through firewall2.
Is it possible ? Is the firewall2 redundant ?
Separate the Web server and SQL server to different sub net and add
firewall2 between Web Server and SQL Server, does this configuration
provide better security to secure the data use by the LAN user ?
Thanks
JCVoonhaving your servers behind the firewall does provide greater security.
however, you might want to read up on configuration to ensure connectivity
between hubs.
http://support.microsoft.com/kb/287932
-oj
"jcvoon" <jcvoon@.maximas.com.my> wrote in message
news:1143602187.916531.187150@.i39g2000cwa.googlegroups.com...
> Hi:
> (Sorry for double post, I already post it in sqlserver.setup group but
> i did't get any reply.)
> I plan to deploying an ASP.Net web app into the following scenario:
>
> Internet --> Firewall1 --> WebServer (IIS+SQL Server 2000) -->
> firewall2 --> SQL Server 2000
>
> The WebServer and the SQL Server behind the firewall2 is sit on
> different LAN (different sub net),
> and a two way replication will be create to sync these two SQL server
> through firewall2.
>
> Is it possible ? Is the firewall2 redundant ?
> Separate the Web server and SQL server to different sub net and add
> firewall2 between Web Server and SQL Server, does this configuration
> provide better security to secure the data use by the LAN user ?
>
> Thanks
> JCVoon
>|||oj:
Thanks for the info.
Regards
JCVoon
订阅：
博文 (Atom)