disable netbios via Fortigate 240D?

[buddyd]

Greetings Folks,

We have an active-passive cluster of 240D's, current OS is 5.2.8 build 727. Without going into too much detail, we are trying to use the Fortigate to disable NetBIOS over tcp/ip on Windows machines as we have recently seen a large amount of NBstat.Query errors from the IPS. Tech Support has provided documentation to do this, we have it configured but it seems to be ineffective. The command line (see below) will work if run directly on the Windows device but once converted to hex and added to the FG config, nothing. I have been assured by Fortinet tech support that the syntax/config is correct on the Fortigate.

Anyone else ever successfully do this? Has anyone been able to get this to work?

Any help/advice is greatly appreciated.

Thank you.

Buddy

######################################################

wmic /interactive:off nicconfig where TcpipNetbiosOptions=0 call SetTcpipNetbios 2

# config vdom

# edit #####FW1

# config system dhcp server

# edit 5

#

config system dhcp server

 

    edit 5

        set status enable

        set lease-time 604800

        set mac-acl-default-action assign

        set forticlient-on-net-status enable

        set dns-service specify

        set wifi-ac1 0.0.0.0

        set wifi-ac2 0.0.0.0

        set wifi-ac3 0.0.0.0

        set ntp-service specify

        set domain ''

        set wins-server1 0.0.0.0

        set wins-server2 0.0.0.0

        set default-gateway 192.168.26.1

        set next-server 0.0.0.0

        set netmask 255.255.254.0

        set interface "Wifi Guest"

            config ip-range

                edit 1

                    set start-ip 192.168.26.2

                    set end-ip 192.168.26.200

                next

            end

--More--                  set timezone-option default

        set tftp-server ''

        set filename ''

        set option1 252 '776d6963202f696e7465726163746976653a6f6666206e6963636f6e6669672077686572652054637069704e657462696f734f7074696f6e733d302063616c6c2053657454637069704e657462696f732032'

        set option2 0

        set option3 0

        set option4 0

        set option5 0

        set option6 0

        set server-type regular

        set conflicted-ip-timeout 1800

        set auto-configuration enable

        set vci-match disable

        set dns-server1 8.8.8.8

        set dns-server2 4.2.2.2

        set dns-server3 0.0.0.0

        set ntp-server1 0.0.0.0

        set ntp-server2 0.0.0.0

        set ntp-server3 0.0.0.0

    next

end

 

[emnoc]

Nebios over TCP?  And nbstat.query, i would look for fortinet and a vips signature for this. I believe they have one or could write one for you if not available now.

[buddyd]

Thanks emnoc.

We've noticed the IPS warning (nbstat.query) seems to be triggered by Windows 10 machines only, some testing with Windows 7 laptops doesn't exhibit the same behavior.

My question is, if the configuration above for the dhcp server is correct (confirmed by Fortinet Support), then why doesn't it work?

[emnoc]

What's not working with that DHCP-server configuration  ? It looks  good from a casual glance, I'm too lazy to decode your  option252 ;)

Did you try a diag debug app dhcps -1 to see  what could be happening ? is the  subnet and mask and gateway correct for that cfg and the correct interface

e.g

diag debug reset 

diag debug en

diag debug application  dhcps -1

Where you expecting the dhcp-server to fix your nbstat.query issues? FWIW I believe  netbios over tcp is a window10 by default and most all others needs you to enable it via the local_properties tcpip ipv4 interfaces.

If you set static or supplied WINS servers settings , than the clients should use that ONLY but without locking down the clients, this is not a best approach for control imho.

[buddyd]

Thanks again, emnoc.

The dhcp server as configured on the fortigate works fine. It's the additional functionality we've added ( 252 ) which should disable netbios on the connecting system via the dhcp server. Fortinet Support has looked at the config and said it should work, but it does not. The hex command converts to the line below:

wmic /interactive:off nicconfig where TcpipNetbiosOptions=0 call SetTcpipNetbios 2

If we run that locally on the connecting device, it works as expected (disables netbios over tcp/ip) on the Wifi NIC.

So yes, we were hoping/expecting that would solve the nbstat.query warnings we are seeing every minute or so in the FG logs. We are now considering disabling those particular warnings, if possible. As long as they are internally generated, we do not see it as a security risk.

I'll run the diag debug commands you recommended and see what turns up.

[emnoc]

hmm dhcp options 252 is for proxy, did they mean option 46 or 47 ? ( those are netbios related )

When you run the cods manually what does  your cmd.exe net config server and net config workstation shows before and after?

[buddyd]

That's interesting, they did not flag 252 as being a problem. I was under the impression that any random number 1 - 255 was OK. I will make the modification and see if it helps.

I've run the command manually and it does disable netbios over tcp/ip, I can see it via ipconfig /all.

Thanks again!! I'll make those changes and update you soon.

[buddyd]

I tried both option 46 and 47, same result. A snippet from the debug while connecting is below:

2016-10-18 16:28:31 [debug]calling handler[Valetude Guest] 2016-10-18 16:28:31 [debug]locate_network prhtype(1) pihtype(1) 2016-10-18 16:28:31 [debug]find_lease(): packet contains preferred client IP, cip.s_addr is 192.168.26.5 2016-10-18 16:28:31 [debug]find_lease(): leaving function with lease set 2016-10-18 16:28:31 [debug]find_lease(): the lease's IP is 192.168.26.5 2016-10-18 16:28:31 [note]DHCPREQUEST for 192.168.26.5 from e4:b3:18:89:ae:f9 via Valetude Guest(ethernet) 2016-10-18 16:28:31 [debug]deled ip 192.168.26.5 mac e4:b3:18:89:ae:f9 in vd BreuerFW1 2016-10-18 16:28:31 [debug]added ip 192.168.26.5 mac e4:b3:18:89:ae:f9 in vd BreuerFW1 2016-10-18 16:28:31 [debug]packet length 330 2016-10-18 16:28:31 [debug]op = 1  htype = 1  hlen = 6  hops = 0 2016-10-18 16:28:31 [debug]xid = 6ddb5117  secs = 0  flags = 0 2016-10-18 16:28:31 [debug]ciaddr = 0.0.0.0 2016-10-18 16:28:31 [debug]yiaddr = 0.0.0.0 2016-10-18 16:28:31 [debug]siaddr = 0.0.0.0 2016-10-18 16:28:31 [debug]giaddr = 0.0.0.0 2016-10-18 16:28:31 [debug]chaddr = e4:b3:18:89:ae:f9 2016-10-18 16:28:31 [debug]filename = 2016-10-18 16:28:31 [debug]server_name = 2016-10-18 16:28:31 [debug]  host-name = "BD-X1Y1-L1-W10" 2016-10-18 16:28:31 [debug]  dhcp-requested-address = 192.168.26.5 2016-10-18 16:28:31 [debug]  dhcp-message-type = 3 2016-10-18 16:28:31 [debug]  dhcp-parameter-request-list = 1,3,6,15,31,33,43,44,46,47,121,249,252 2016-10-18 16:28:31 [debug]  dhcp-class-identifier = "MSFT 5.0" 2016-10-18 16:28:31 [debug]  dhcp-client-identifier = 1:e4:b3:18:89:ae:f9 2016-10-18 16:28:31 [debug]  option-81 = 0:0:0:42:44:2d:58:31:59:31:2d:4c:31:2d:57:31:30:2e:62:72:65:75:65:72:2e:63:6f:6d

Are there any docs that explain what the dhclp-parameter-request-list and option-81 ?! Looks like it's ignoring option 46 and 47...

[emnoc]

I believe that option #46  is used,  IF you have listed WINServers.

[buddyd]

Hmmmm....I was under the impression that DNS was an acceptable substitute for WINS, with the intro of NETBios over TCP/IP. We do not have WINS servers.