ALERT: Some images may not load properly within the Knowledge Base Article. If you see a broken image, please right-click and select 'Open image in a new tab'. We apologize for this inconvenience.
Upgrading to SGOS 6.6.4.x can sometimes break IWA Direct if SMB signing is disabled on the domain controller
Article ID: 169153
ProxySG Software - SGOS
After an upgrade to SGOS 6.6.4.x or later, the proxy fails to establish a secure channel when SMB signing is disabled on the domain controller (DC) in IWA Direct.
When the ProxySG appliance tries to establish a secure channel with the DC in IWA Direct, it must involve SMB signing when trying to establish a secure channel. This change of behavior was due to the Badlock vulnerability (CVE-2016-2115 and CVE-20162118).
In SGOS 6.6.4.x, the proxy requires SMB signing. In versions prior to 6.6.4.x, there was no requirement for SMB signing. As a result, upon upgrading to 6.6.4.x, the proxy fails to establish the secure channel if SMB signing was disabled prior to upgrade.
A packet capture shows that when the proxy sends the SMB request, the flag for "Security Signatures Required" is set to "1", which means SMB signing is required.
No. Time Source Destination SrcPrt DstPrt Protocol Length Info
712 37.837828 x.x.x.x y.y.y.y 1358 445 SMB 117 Negotiate Protocol Request