[FW-1] sql1.1 redirect inspect code in user.def

[Andre Doehn <adoehn@FW1-NOSPAMWEB.DE>]

hi list,
i tried to install i small part inspect code in in the $FWDIR/lib/user.def to solve a problem with redirected pakets of a sqlnet 1.1 conections.

ive put the following code in $FWDIR/lib/user.def right before the #endif /* __user_def__ */ line:

-------------------------------------

#define SQL_PORT 1521

#define sql11_match ((tcp,dport=SQL_PORT) or <src,0,dst,dport,ip_p> in pending)

#define sql11_prologue (tcp, sport=SQL_PORT, [TCPDATA:1]=10, [TCPDATA+3,b]=0x494c4f56, \
[TCPDATA+7:2,b]=0x454e,[TCPDATA+9:1]=0x54, \
record <dst,0,src,[TCPDATA+1:2,b],ip_p> in pending);

-------------------------------------

i created a service of type other:
In the prologue field type : sql11_prologue
in the match field type : sql11_match

..after that i defined a rule to allow this service - then I tried to install the policy and i got the error

sql_test1.W: Security Policy Script generated into sql_test1.pf
sql_test1:
"/opt/CPfw1-41/conf/sql_test1.pf", line 393: ERROR: cannot find <sql11_match> anywhere
"/opt/CPfw1-41/conf/sql_test1.pf", line 503: ERROR: cannot find <sql11_portredirect> anywhere
Compilation Failed.

can anybody give me a hint what iam doing wrong? iam running 4.1 SP2 manager

thanks + bye
andre
______________________________________________________________________________
WEB.DE MyPage - Ultimatives Kommunikationstool! Ihre Message sofort
online! Domain aenderbar! http://www.das.ist.aber.ne.lustige.sache.ms/

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================