topic Re: SQL and Terminal Services agent in General Topics

SQL and Terminal Services agent

UKRB — Fri, 16 Nov 2012 17:10:04 GMT

Hi all,

I'm seeing some odd behaviour with apps that use SQL where the app is on a terminal server. The terminal server has an app installed and works perfectly when the PAN TS agent is not running. When the agent is started, the application throws up lots of connection errors.

This happens with multiple terminal servers, multiple app and multiple SQL servers.

Has anyone else seen behaviour like this at all?

Thanks,

UKRB

Re: SQL and Terminal Services agent

mikand — Fri, 16 Nov 2012 19:08:06 GMT

If im not mistaken using TS-agent will assign a portrange per user on the server which the TS-agent then informs the PA device of.

Like sending info to the PA device that if an outbound connection is made where sourceport is 1100-1199 then the PA should log this as userX. If port 1200-1299 is used then its userY and so on.

However im not sure if its the TS-server that does on its own and the TS-agent just reads these values or if its the TS-agent who configures the TS-server for this.

So my thought is if your application for some reason tries to use its own srcports which the TS-server simply just drops (because its not the srcports which is assigned to the user running your application) so your app logs connection errors?

Re: SQL and Terminal Services agent

siebi — Sat, 17 Nov 2012 23:20:38 GMT

Hi UKRB,

I have currently the same issues with an SQL database application running on a terminal server. If the agent runs, the application displays connection error messages. Even if the sessions started within the user context, the agent causes an issue...

Re: SQL and Terminal Services agent

UKRB — Mon, 19 Nov 2012 09:50:21 GMT

Hi siebi.

I'm pleased to hear that I'm not the only one who is having this issue. It's really quite frustrating. I did log it with support a while back but didn't make much progress.

Have you logged it at all yourself?

Thanks

Re: SQL and Terminal Services agent

plingeman — Tue, 06 Aug 2013 16:48:50 GMT

Siebi and UKRB,,

I too have run into the same issue,,,we just spun up 300 TS-agents on the weekend and had to disable about 70 agents

due to issues with SQL connnections. One of my thoughts is reserved ports for system services. We may need to expand

these to say 1025-10000. I looked at the netstat -a table for some of these servers having the issue and most of the

sql connections are sourced from between 1025-7000....

Has anybody found a solution yet? At this point just shootin from the hip! 🙂

thanks,,

Re: SQL and Terminal Services agent

UKRB — Tue, 27 Aug 2013 14:44:23 GMT

Has anyone got anywhere with PAN support with this? I've slightly given up hope which is not great really!

Re: SQL and Terminal Services agent

StefanSteenstra — Wed, 15 Feb 2017 09:25:03 GMT

Bump!

We are having this very same issue with multiple database applications. No idea how to solve but to disable the TS Agent.

Re: SQL and Terminal Services agent

JoschkaKruse — Thu, 12 Oct 2023 08:55:22 GMT

Hey folks,

Terminal Server Agent (TSA) Advanced Configuration using Window... - Knowledge Base - Palo Alto Networks

Check out HonorSourcePorts and TWS. For me, I had to enable both (Value 1).

Re: SQL and Terminal Services agent

PaulCourtois — Thu, 16 Nov 2023 18:21:15 GMT

Thanks JoschkaKruse. HonorSrcPortRequest worked for my environment.