NetBIOS over VPN

[#1]

Hi, Although I' ve mentioned this in other forum threads, it appears in a number of them, and I thought I might try a new post, to see if others are having this problem. We use forticlients with 3DES and SHA, and with mapping drives using the ip (as in \\192.169.40.x\share) we can get users access to shares once they " click" on the drive letter and authenticate (LDAP would be nice! Don' t know how to do that). At any rate, the problem is, one of our main apps expects NetBIOS to work to properly function, and as a result, we' ve had to jury rig things by mapping various drives, even to the point of experimentation with VPN users to see what works. We' ve got a major app upgrade coming, and I' m looking for a simple way to enable NetBIOS so we can have users browse the network from their VPN clients. Any ideas? Thanks in advance, Jim

[UkWizard]

If you setup the VPN connection properties so that the machine connects to the internal DNS and WINS servers, then this should be fine. Albeit, a little slow. Netbios over tcp should be fine, but i doubt any apps rely on this. Are you sure it just isnt name resolution causing issues in the past. Easiest thing is to use the forticlient and get the clients to get a dhcp from your internal dhcp servers. This works a treat normally. Does require the latest firmware and client though.

[#3]

Thank you for your reply! Does that mean since I' m using the Fortigate for DHCP...just use it for the external clients? Also, then....the range of internal clients is in the 192.168.40.x subnet. The Fortinet clients not even being assigned an IP...so, would " NAT traversal" need to be checked for the forticlients to get an internal IP (and it would presumably be in the .40 range as well)? We are using the lastest forticlient and Fortigate firmware. Would this also work with PPTP clients? We have a few, but may have more soon due to expediency and the lack of client cost. Thanks again, Jim

[UkWizard]

You cannot use the fortinet itself to provide ip addresses to ipsec vpn users, this would have to be an internal server. Are you saying you are using the fortinet to provide DHCP services to the lan ? If so, then you will either use an internal server to provide it (recommended) or assign static ip addresses for each client you setup. Its easier with PPTP, as you specify a range to use instead (which can be from the internal network). Or alternatively, you could use a different subnet altogether for VPN users, as long as the firewall is the default gateway for all internal hosts.

[#5]

Well, I am using the fortinet for internal user' s DHCP. So, (to clarify) I would have to turn that off, use, say, M$ Windows 2000 Server to provide the DHCP..and a VPN client (using Forticlient) would get an IP just as an internal user would? And, with PPTP, I' ve seen that you can provide a range...but, that' s still not from the DHCP server portion of the Fortigate box...right? I' d still have to use an internal server? Or providing a different IP range for PPTP users via the Fortigate box would give me the functionality to browse internal network resources and use the Fortigate box for ALL DHCP? I know in other cases, with other clients I' ve used, an IP gets assigned and a secondary virtual adapter is created with all of the attributes of a plugged-in card...ending up with two IP addresses showing if you do an IP config /all...however, I just don' t know how this works. Sorry, I just wanted to make it clear what I have to do...don' t really like the idea of using Win2K for DHCP, but if I must then I will. The firewall IS the default gateway for all internal hosts...and I' m using M$ DNS for address resolution...

[UkWizard]

I would recommend switching to MS DHCP on the server, yes, this can then provide all the required details, like ip, dns, wins and domain name. PPTP is trickier, as it does not have a place to enter domain name (but there is a reg hack on the knowledgebase on how to do this). Both PPTP or IPSec can use internal IP addresses or another dedicated subnet. But using the IPSec in conjunction with an Windows DHCP server on a doman controller wraps it all up nicely. Just need to have all the latest firmware and clients. There have been the odd report of it not working, so the dhcp relaying does have a slim chance of not working, but should be fine.

[#7]

Thanks! I' ll give that a try.