Technical Tip: SMB Access Fails When 'Proxy-Based' Anti-Virus Security Profile is enabled in the Firewall Policy

[ssanga]

Description	This article describes an issue where SMB access fails when a firewall policy is configured with an Anti-Virus security profile set to 'Proxy-Based' inspection mode.
Scope	FortiGate v7.2.6, v7.2.7.
Solution	When the Anti-Virus security profile is configured to 'Proxy-Based' inspection mode and is enabled within the firewall policy, the WAD daemon blocks access to SMB resources when the client uses authentication methods other than NTLM or Kerberos, before it defaults to NTLM authentication.   This issue has been resolved in FortiOS versions 7.2.9, 7.4.4, 7.4.5. Workaround: Disable Proxy based AV profile in the firewall policy or Switch to flow based Anti-Virus profile or Disable PKU2U authentication on the client PC. Logs required by FortiGate TAC for investigation. Debugs: diagnose wad filter src <IP_Address> diagnose wad debug enable level verbose diagnose wad debug enable category all diagnose debug console timestamp enable diagnose debug enable Reproduce the issue. diagnose debug reset Sniffers: diagnose sniffer packet any "host <source_IP> and host <destination_IP>" 6 0 l TAC Report: execute tac report Configuration the file of the FortiGate.