Netbios through SSL-VPN

[#1]

Hi all, I can' t succeed in making network browsing work through SSL-VPN. All I' m able to do is connect to shared resources with IP addresses. If I try to connect to a resource \\server\shared_folder, the host answers it cannot find the path to this resource. Just as if the host couldn' t find the master browser in the lan. Same thing if I try to browse the network. I put a WINS server and an internal DNS server in the SSL-VPN advanced configuration but without any success. A few details : The remote user is logged locally. FortiOS is V3MR2 the domain reached is a Windows 2000 Active Directory Policy is any/any/ssl-vpn In web-mode, the bookmarks created are only working if the destination server is written with its IP address (ie: //192.168.0.1/shared/). Bookmarks with server names (like //server/shared/) don' t work. Same thing with tunnel-mode. The only way I found to make this work (in tunnel-mode) is add the server' s name in the client' s hosts file. Does someone have the clue ? and is there a clue ? Thanks for any answer, Best regards, Vincent MAZARD DML France www.dml.fr

[rwpatterson]

This appears to be a DNS issue. I had the same issue. I had to force all traffic via SSL VPNs through the tunnel, to force the use of our DNS servers. (Turned off split tunneling). The tricky part is creating a rule from port 2 to port 2 ( Internet to Internet) so that the tunnel traffic can see the Internet. I then gave this strange rule limited Internet capbility, and told my users, when they' re connected, don' t browse! Get over it. They should be in the network to do work anyway. Disconnect, browse, then reconnect. It takes 5 seconds to get the tunnel back up. -Bob

[#3]

Thanks for your answer. Unfortunately this doesn' t solve my problem : split-tunnelling is off the remote clients do use the internal DNS servers. And this isn' t sufficient for the clients to discover the network. even a " net view \\some_internal_machine" doesn' t work. Thanks anyway I tried to add " netbios-forward enable" and " wins-ip n.n.n.n" without success (on both internal and external interfaces) Vincent

[rwpatterson]

Also, have you added the ' WINFRAME' protocol to the appropriate service group? This is Fortigate' s version of Samba. Actually, now that I recall, I had to jump through hoops to get that to work. Let me dig through my config, and get you an answer.

[rwpatterson]

Here' s how I got it to work: 1) Create the user. 2) Create the user group, and in ' SSL-VPN User Group Options' , check ' Enable SSL-VPN Tunnel Service' , and make an IP range in ' Restrict tunnel IP range for this group' . 3) Create a ' Firewall -> Address Range' that corresponds with this user group. 4) Create a policy (source ' User Group' , destination ' Server Group' , Action ' SSL VPN' ) that will give this group the ' WINFRAME' protocol, among others. Notes here: NAT must be OFF in the policy, for this to work. This forces any SSL VPN traffic using this user group to have an IP in a particular IP range. In turn the policy will take any IPs' s in the same range, and give them the approriate access. I forgot this part as well: In VPN -> SSL -> SSL VPN, open ' Advanced (DNS and WINS Servers)' and add your DNS servers. One thing I had to do manually is tell the users to open the FortiSSL client when connected, and input the DNS domain. That is one thing I have yet to find any product capable of doing automatically. Hope this works for you. It does for me, though a bit cumbersome.

[#6]

Will this also work with IPsec VPN? I' m having the same issue....

[#7]

Winframe ins the Citrix Metaframe protocol (tcp 1494). Nothing to do with Netbios communications... Vincent

[#8]

I found the answer for the tunnel mode : The fortissl DUN connection doesn' t include the " Windows network client" and " file and print sharing" components. I wonder why these modules are not checked by default ???? (a bug ?). Just check them both in the fortissl configuration and reconnect to be able to browse the internal network. For web-mode, the bookmarks with server names instead of IP addresses still doesn' t work.... Investigating further. VM

[#9]

I found the answer for the tunnel mode : The fortissl DUN connection doesn' t include the " Windows network client" and " file and print sharing" components. I wonder why these modules are not checked by default ???? (a bug ?). Just check them both in the fortissl configuration and reconnect to be able to browse the internal network. For web-mode, the bookmarks with server names instead of IP addresses still doesn' t work.... Investigating further. VM

[rwpatterson]

  I stand corrected. I crossed two different service groups when I was transferring info. WINFRAME is not needed here. (and it is Citrix, not SAMBA)   We only use tunnel mode here, not web mode. My users take the respective clients home and install them there. (Not with licensed software though). They connect directly to the servers over the SSL VPN.