AOS: v4.7.1
Server Platform: Multiple Hyper-V (2012 r2) clusters
It appears that if you whitelist an IP that belongs to either a Server 2016 or a Windows 10 machine, that machine still can not access the SMB share being published by our Nutanix (v4.7.1) clusters.
We found this out after upgrading our SCVMM server to Server 2016. At this point, the VMM server can 'see' the shares but can not calculate share size (reports 0GB) and therefore can't manage the share(s). Since then we've tested with multiple other 2016 and Windows 10 machines - all with the same result: added to the whitelist but can't browse the share, even from Windows Explorer.
We are looking for confirmation that this is a known issue.
If so, can you confirm if it's resolved by an upgrade to v5.0.2?
Incompatibility with Server 2016/Win10 and 2012r2 Hyper-V Cluster (AOS: v4.7.1)
+5This topic has been closed for replies.
+9Hi,
This is likely due to hardening done to SMB in Windows 10 / Server 2016 by Microsoft.
Most likely it's due to the following:
This is likely due to hardening done to SMB in Windows 10 / Server 2016 by Microsoft.
Most likely it's due to the following:
"3.1. Removing RequireSecureNegotiate setting
In previous versions of SMB, we introduced “Secure Negotiate”, where the SMB client and server verify integrity of the SMB negotiate request and response messages.
Because some third-party implementations of SMB did not correctly perform this negotiation, we introduced a switch to disable “Secure Negotiate”. We explain this in more detail in this blog post.
Since we have learned via our SMB PlugFests that third parties have fixed their implementations, we are removing the option to bypass “Secure Negotiate” and SMB always performs negotiate validation if the connection’s dialect is 2.x.x or 3.0.x.
Note 1: For SMB 3.1.1 clients and servers, the new Pre-Authentication Integrity feature (described in item 2.1 above) supersedes “Secure Negotiate” with many advantages.
Note 2: With the new release, any third party SMB 2.x.x or SMB 3.0.x implementations that do not implement “Secure Negotiate” will be unable to connect to Windows.
Note 3: While this change improves overall security, it might interfere with some solutions that rely on modifying SMB network traffic, like certain kinds of WAN accelerators."
I take it that you do not run Kerberos Authentication in the current Nutanix Setup?
There are have been ways to go around this, I've seen it in case of NetApp Filers but can not answer for Nutanix. I would guess the recommended method is to actually implement the Kerberos Authentication part as that also hardens the security around the Storage Access.
Kind Regards
+34
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.