Skip to main content
bmduncan33
bmduncan33
New Member
December 8, 2023
Question

ZTNA SMB TCP Forwarding using KDC Proxy

  • December 8, 2023
  • 3 replies
  • 3873 views

A FortiOS 7.4.1 document outlines how to use a kdc proxy server to help get znta access to smb file shares.  Has anyone successfully built this and got it to work?  If so, I'd like to compare notes to see what I might be missing with this setup.

3 replies

lgupta
Staff
lgupta
Staff
December 10, 2023

Hello bmduncan33 ,

Thank you for reaching out.


I did go through: https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/553746/ztna-access-proxy-with-kdc-to-access-shared-drives

This looks like just another regular TCP Forwarding on the FortiGate ZTNA side.
@bmduncan33It should work if the KDC service is configured correctly on the client and server.

Also, you are more than welcome to open a support ticket if things don't work as expected.

 

Thank you!

nsgill
nsgill
New Member
January 5, 2024

Hi ,

Is it working for you now? 

bmduncan33
bmduncan33Author
New Member
January 5, 2024

No sir.  The kdc proxy, while it may seem trivial, isn't for me.  I was able to build the proxy server on my network, but was never able to get a successful connection from my remote laptop.  The command you have to run to test it is 'klist get krbtgt'.  If I perform that from an on-prem host it works like a champ.  Now what is interesting is that I would have expected that command to work on a remote laptop connected via sslvpn - but it doesn't.  Which begs the question - how am I able to connect to mapped drives using smb and hostnames when kerberos tickets are not present on the laptop.  This has taken me hours of investigating and I am pretty much resigned to focusing on getting smb access to mapped drives using IP addresses.  That mechanism apparently only relies on NTLM and not Kerberos.  

 

Also, please note that the kdc proxy acting on it's own outside of remote desktop services, and one other MS service, is not a solution explicitly supported by Microsoft.  So it's not like I can open a ticket with them on this functionality.

76maverick
76maverick
Explorer
September 6, 2024

Just a note on this old thread, if you're having issues getting the kdc proxy to show up, it will only do so when you're offnet and no direct line of sight to the DC. If it doesn't show up, you'll want to check 1) url is correct, 2) common name of the certificate matches the fqdn of the proxy, 3) if you have a CRL it must be published to the internet, or disable revocation checking - i wouldn't recommend this 4) use a cert from a third party rather than your CA.

Terms & ConditionsAccessibility statement