Car SMBv1 Application Server Issues

[fahsan11]

Dear Guys, I need your suggestions related to the weird issue on a Fortigate Firewall which is related to an SMBv2 Application. As the Fortigate FW, Client and the Server lie in a single network and also I would say in a single subnet. Fortigate is running in a NAT-mode, also I have created a Virtual Wire Pair with the two interfaces whereas port15 is connected to a to Client and port 16 which is connected to a L3 Switch(MPLS Provider) where the Application Server resides. Its a sort of a Car Application, that check the employees and revert the daily results of the working hours. However, with Fortiagte once I have login the application and trying to access through the Client it doesn't show anything only reverts with a blank page. I have been stuck in this issue for 2 weeks. Even though I have been in contact with FortiTAC Support but they said Fortigate is working fine and there is a problem with the Application seems to be something on it after seeing the Packet Capture. Whenever I tried to bypass the Fortigate the Application works and shows me the Output. Note: I have created a bidirectional Policy but nothing works. I have tried to increase the session-ttl timeout, set tcp-timeout rst, set tcp-mss-receiver and sender on the Policy, set the MTU on the Router interface. Though the Client and Server send the RST Packets. Changed the DNS of the FGT to the Internal DNS nothing happened. Though tried every possibility but nothing worked at all. The firmware version of the Firewall is 6.0.10 as TAC Support recommends me to do that. UTM Profiles are also disabled on the Policy and also on the Feature Visibility. Any help would be appreciated.

[live89]

Hi,

- What do you mean by "blank page" ? When you try click on f12 on browser and then enter the application page, what response do you see there ?

Or do you mean it keeps loading and nothing happened?

- Does you application only uses SMBv2 and no other ports ? or you only suspect the problem is with SMBv2 ?

- You upgraded to 6.0.10 to see if this resolves the issue ? or you were all the time at 6.0.10 and never upgraded ?

- Did it happen to work with some other firewall other than fortigate ? or you never tried that , and only bypassed the fortigate ?

- Is it possible for you to post the output of:

diag debug reset

diag debug disable

diag debug flow filter <application destination ip>

diag debug flow trace start 1000

diag debug enable

After finishing disable the debug : diag debug disable

[poundy]

you say SMB. What traffic are you actually expecting to transit this ? I am hoping this isn't a firewall to the internet too and the app server isn't on the internet?? SMBv1 is deprecated everywhere and is highly insecure. Do you really mean SMBv2 perhaps? 

Agree on diag debug to get info on whats going on. 

[fahsan11]

Yes exactly the server isn’t on the Internet I have seen on the packet captures the application supposed to use SMBv2 but the customer said to me that the application uses SMBv1. The expected result would be the output of the working hours. It’s quite strange that the whole application works smoothly on the printer part of the application wouldn’t working as expected.

[live89]

So before 6.0.9 it worked properly with FortiGate? Or all the issue starts after installing FortiGate? Also, I'm not sure if this is related to your issue, but if application is using SMBv1, Then it worth checking with Fortinet TAC this:

414081 SMB1 support has been by default disabled under part models.

Which released at v5.6.6 and 6.0.2 https://fortinetweb.s3.am....0.2-release-notes.pdf https://pub.kb.fortinet.c....6.6-release-notes.pdf

[fahsan11]

Actually, it never works on Fortigate whether it’s the 6.0.9 or 6.0.10 firmware version was concerned. Thank you for the information but that information is related to the SSL VPN as far as I know. I have read it already.

[live89]

I've came across situations were things didn't work after replacing firewall but most of them are related to MTU / TCP MSS issues .. But this should be shown in pcap which you already have done as you mentioned ..

[fahsan11]

Yes but I have changed the MTU on the firewall and also on the interface and policy too. I have tried the Jumbo frame packets too but things wouldn’t work as expected.

[fahsan11]

Yes it keeps loading on and on and didn’t give me back the desired Output. The application uses port 445, 2003 port in which I have seen on the logs and that is Server Reset and Client Reset. Well issue starts with the 6.0.9 firmware and by the recommendation of TAC Support I have upgraded the firmware version to 6.0.10. I have bypassed the FW and it works as expected. In addition to this all of the application works perfectly only the printer part of the working hours showing a blank page with FGT. Fortinet TAC and I have captured a lot of packets seems like fortigate working properly and seems like an issue with an application layer after seeing the pcap files. But that’s not the reason as the application works with another old firewall like Microsoft ISA.