topic Re: Outbound SQL traffic (possibly) hitting a zone protection profile in General Topics

Outbound SQL traffic (possibly) hitting a zone protection profile

inSync-MarkValpreda — Wed, 07 May 2025 15:53:32 GMT

We have a process that sends MSSQL (1433/tcp) to a cloud service that occasionally just stops working - so trust to untrust. It is mostly on 'larger' data transmissions. Turned off all the flood protection in the zone protection profile on the outside interface, and there is no issue.

Can I see where that is being triggered? Any thoughts on changes to thresholds?

Re: Outbound SQL traffic (possibly) hitting a zone protection profile

Raido_Rattameister — Wed, 07 May 2025 16:18:12 GMT

Most likely you either hit limits on "Flood Protection" tab or on "Reconnaissance Protection" tab.

You can add source IP (where process runs) into "Source Address Exclusion" list on "Reconnaissance Protection" tab.

Assuming your internal zone is "INSIDE" you can start the process and then run command "show zone-protection zone INSIDE" to see current rate of Zone Protection counters for the zone.

Re: Outbound SQL traffic (possibly) hitting a zone protection profile

inSync-MarkValpreda — Wed, 07 May 2025 16:39:59 GMT

Thank you. I am working with the team having the issue and seeing if it is Flood or Reconnaissance protection I am hitting. Turned off SYN and Other IP on Flood for now.

Re: Outbound SQL traffic (possibly) hitting a zone protection profile

OtakarKlier — Fri, 09 May 2025 15:40:26 GMT

Hello,

I hope that the traffic is over a VPN tunnel? Otherwise youre sending data over the internet in plain text almost.

Regards,