Technical Tip: How to block SMBv1 and allow SMBv3 on a FortiGate firewall

[kajlasunil]

Description	The article describes how to block SMBv1 because it is a legacy protocol, making it a prime target for cyberattacks.
Scope	FortiOS.
Solution	Since FortiGate firewall rules alone cannot differentiate between SMB versions, the best approach is to use an Application control signature to detect the SMB version. SMBv1 operates over TCP 139 and TCP 445. Since SMBv2 and SMBv3 also use TCP 445, the Firewall policy must use Deep Packet Inspection (DPI) to block only SMBv1. To block SMBv1 and allow SMBv3 on a FortiGate firewall, follow these steps: Create an Application profile to block SMBV1: Log in to FortiGate. Go to Security Profiles -> Application Control. Create a new profile or edit an existing one. Select Add Signatures and search for SMB. Select SMB v1 and set the action to Block and Save. Apply the Application Control Profile to a Firewall Policy: Create a New Firewall policy to allow only the SMB protocol. Under Security Profiles, enable Application Control, and select the profile created above. Save and apply changes. Related document:  Deep inspection