Skip to main content
fahsan11
New Member
July 1, 2020
Question

Car SMBv1 Application Server Issues

  • July 1, 2020
  • 2 replies
  • 8358 views
Dear Guys, I need your suggestions related to the weird issue on a Fortigate Firewall which is related to an SMBv2 Application. As the Fortigate FW, Client and the Server lie in a single network and also I would say in a single subnet. Fortigate is running in a NAT-mode, also I have created a Virtual Wire Pair with the two interfaces whereas port15 is connected to a to Client and port 16 which is connected to a L3 Switch(MPLS Provider) where the Application Server resides. Its a sort of a Car Application, that check the employees and revert the daily results of the working hours. However, with Fortiagte once I have login the application and trying to access through the Client it doesn't show anything only reverts with a blank page. I have been stuck in this issue for 2 weeks. Even though I have been in contact with FortiTAC Support but they said Fortigate is working fine and there is a problem with the Application seems to be something on it after seeing the Packet Capture. Whenever I tried to bypass the Fortigate the Application works and shows me the Output. Note: I have created a bidirectional Policy but nothing works. I have tried to increase the session-ttl timeout, set tcp-timeout rst, set tcp-mss-receiver and sender on the Policy, set the MTU on the Router interface. Though the Client and Server send the RST Packets. Changed the DNS of the FGT to the Internal DNS nothing happened. Though tried every possibility but nothing worked at all. The firmware version of the Firewall is 6.0.10 as TAC Support recommends me to do that. UTM Profiles are also disabled on the Policy and also on the Feature Visibility. Any help would be appreciated.

    2 replies

    live89
    Explorer III
    July 2, 2020

    Hi,

     

    - What do you mean by "blank page" ? When you try click on f12 on browser and then enter the application page, what response do you see there ?

    Or do you mean it keeps loading and nothing happened?

     

    - Does you application only uses SMBv2 and no other ports ? or you only suspect the problem is with SMBv2 ?

     

    - You upgraded to 6.0.10 to see if this resolves the issue ? or you were all the time at 6.0.10 and never upgraded ?

     

    - Did it happen to work with some other firewall other than fortigate ? or you never tried that , and only bypassed the fortigate ?

     

    - Is it possible for you to post the output of:

    diag debug reset

    diag debug disable

    diag debug flow filter <application destination ip>

    diag debug flow trace start 1000

    diag debug enable

     

    After finishing disable the debug : diag debug disable

    poundy
    New Member
    July 2, 2020

    you say SMB. What traffic are you actually expecting to transit this ? I am hoping this isn't a firewall to the internet too and the app server isn't on the internet?? SMBv1 is deprecated everywhere and is highly insecure. Do you really mean SMBv2 perhaps? 

    Agree on diag debug to get info on whats going on. 

    fahsan11
    fahsan11Author
    New Member
    July 2, 2020
    Yes exactly the server isn’t on the Internet I have seen on the packet captures the application supposed to use SMBv2 but the customer said to me that the application uses SMBv1. The expected result would be the output of the working hours. It’s quite strange that the whole application works smoothly on the printer part of the application wouldn’t working as expected.
    koleina
    Explorer III
    February 25, 2025

    thanks for the information