Oracle Redirect Sessions Are Blocked When Using Port-based Policy
Resolution
Issue
Oracle redirect session does not go through the Palo Alto Networks device when security policy is configured to allow tcp/1521 only. The following is a sample of the security policy:
By default, Oracle uses tcp port 1521, then dynamically opens other ports <1024 - 65000> for redirect sessions.
Note: This behavior can be disabled by adding a regkey on Windows server \HKLM\software\oracle\homeX\use_shared_socket.
Cause
For application "oracle", parent session and child session (ex. Oracle redirect session) are not linked by design. The child session appears in show session all as a predict session. However, it remains detached from the main parent session based on the application definition.
Resolution
In this case it is best to set policies by application (e.g. allow only "oracle" application), and not by application-port .
owner: ymiyashita