Optimizing SMB2/3 (2024)

Configuring Optimization Features : Configuring CIFS optimization : Optimizing SMB2/3

Optimizing SMB2/3

This section describes the SMB support changes with recent releases of RiOS.

SMB3 support

Enabling SMB3 on an appliance also enables support for the SMB3.02 dialect introduced by Microsoft in Windows 8.1 and Windows Server 2012 R2. SMB3.02 is only negotiated when systems of these operating system versions are directly connected. SMB3.02 is qualified with SMB3.02 signed and unsigned traffic over IPv4 and IPv6, and encrypted connections over IPv4 and IPv6. Authenticated connections between a server-side appliance and a domain controller are only supported over IPv4.

RiOS includes support for SMB3 traffic latency and bandwidth optimization for native SMB3 clients and servers.

Windows 8 clients and Windows 2012 servers feature SMB3, an upgrade to the CIFS communication protocol. SMB3 adds features for greater resiliency, scalability, and improved security. SMB3 supports these features:

•Encryption - If the SMB server and client negotiate SMB3 and the server is configured for encryption, all SMB packets are encrypted on the wire, except for when share-level encryption is configured. Share-level encryption marks a specific share on the server as being encrypted; if a client opens a connection to the server and tries to access the share, the system encrypts the data that goes to that share. The system does not encrypt the data that goes to other shares on the same server.

Encryption requires that you enable SMB signing.

•New Signing Algorithm - SMB3 uses the AES-CMAC algorithm instead of the HMAC-SHA256 algorithm used by SMB2 and enables signing by default.

•Secure Dialect Negotiation - Detects man-in-the-middle attempts to downgrade the SMB 2/3 protocol dialect or capabilities that the SMB client and server negotiate. Secure dialect negotiation is enabled by default in Windows 8 and Server 2012. You can use secure dialect negotiation with SMB2 when you are setting up a connection to a server running Server 2008-R2.

SMB 3.0 dialect introduces these enhancements:

–Allows an SMB client to retrieve hashes for a particular region of a file for use in branch cache retrieval, as specified in [MS-PCCRC] section 2.4.

–Allows an SMB client to obtain a lease on a directory.

–Encrypts traffic between the SMB client and server on a per-share basis.

–Uses remote direct memory access (RDMA) transports, when the appropriate hardware and network are available.

–Enhances failover between the SMB client and server, including optional handle persistence.

–Allows an SMB client to bind a session to multiple connections to the server. The system can send a request through any channel associated with the session, and sends the corresponding response through the same channel previously used by the request.

To optimize signed SMB3 traffic, you must enable SMB3 optimization on the client-side and server-side appliances.

For additional details on SMB 3.0 specifications, go to http://msdn.microsoft.com/en-us/library/cc246482.aspx.

SMB2 support

RiOS supports for SMB2 traffic latency optimization for native SMB2 clients and servers. SMB2 allows more efficient access across disparate networks. It is the default mode of communication between Windows Vista and Windows Server 2008. Microsoft modified SMB2 again (to SMB2.1) for Windows 7 and Windows Server 2008 R2.

SMB2 brought a number of improvements, including but not limited to:

•a vastly reduced set of opcodes (a total of only 18); in contrast, SMBv1 has over 70 separate opcodes. Note that use of SMB2 does not result in lost functionality (most of the SMB1 opcodes were redundant).

•general mechanisms for data pipelining and lease-based flow control.

•request compounding, which allows multiple SMB requests to be sent as a single network request.

•larger reads and writes, which provide for more efficient use of networks with high latency.

•caching of folder and file properties, where clients keep local copies of folders and files.

•improved scalability for file sharing (number of users, shares, and open files per server greatly increased).

To display optimization settings for SMB2 and SMB3

1.Choose Optimization > Protocols: SMB2/3 to display the SMB2/3 page.

Figure: SMB2/3 page

2.Under Down-Negotiation, complete the configuration on the client-side appliance as described in this table.

Control

Description

None

Don’t attempt to negotiate the CIFS session down to SMB1.

SMB2 and SMB3 to SMB1

Enable this control on the client-side SteelHead. Optimizes connections that are successfully negotiated down to SMB1 according to the settings on the Optimization > Protocols: CIFS (SMB1) page.

RiOS bypasses down-negotiation to SMB1 when the client or the server is configured to use only SMB2/3 or the client has already established an SMB2/3 connection with the server. If the client already has a connection with the server, you must restart the client.

Down-negotiation can fail if the client only supports SMB2 or if it bypasses negotiation because the system determines that the server supports SMB2. When down-negotiation fails, bandwidth optimization is not affected.

3.Under Optimization, complete the configuration on both the client-side and server-side appliances as described in this table.

Control	Description
None	Disables SMB2 and SMB3 optimization.
Enable SMB2 Optimization	Performs SMB2 latency optimization in addition to the existing bandwidth optimization features. These optimizations include cross-connection caching, read-ahead, write-behind, and batch prediction among several other techniques to ensure low-latency transfers. RiOS maintains the data integrity, and the client always receives data directly from the servers. By default, SMB2 optimization is disabled. You must enable (or disable) SMB2 latency optimization on both the client-side and server-side SteelHeads. To enable SMB2, both SteelHeads must be running RiOS 6.5 or later. After enabling SMB2 optimization, you must restart the optimization service.
Enable SMB3 Optimization	Performs SMB3 latency optimization in addition to the existing bandwidth optimization features. This optimization includes cross-connection caching, read-ahead, write-behind, and batch prediction among several other techniques to ensure low-latency transfers. RiOS maintains the data integrity and the client always receives data directly from the servers. By default, SMB3 optimization is disabled. You must enable (or disable) SMB3 latency optimization on both the client-side and server-side SteelHeads. You must enable SMB2 optimization to optimize SMB3. To enable SMB3, both SteelHeads must be running RiOS 8.5 or later. After enabling SMB3 optimization, you must restart the optimization service.
Enable DFS Optimization	Enables optimization for Distributed File System (DFS) file shares. You must upgrade both your server-side and client-side SteelHeads to RiOS 9.5 or later to enable DFS optimization. However, this box only needs to be checked on the client-side SteelHead.

4.Click Apply to apply your settings to the current configuration.

See Also

Managed Servers | IT@Cornell

SMB signing prerequisites

This section describes prerequisites and recommendations for using SMB signing:

•With RiOS SMB signing enabled, RiOS appliances sign the traffic between the client and the client-side appliance and between the server and the server-side SteelHead. The traffic is not signed between the appliances, but the appliances implement their own integrity mechanisms. Whether RiOS appliances are used or not, SMB-signed traffic is only signed, not encrypted. For maximum security, we recommend that you configure the appliances as SSL peers and use the secure inner channel to secure the traffic between them. For details, see Configuring secure peers.

•If you already have a delegate user and are joined to a domain, enabling SMB2 signing will work when enabled with no additional configuration.

•SMB signing requires joining a Windows domain. It is vital to set the correct time zone for joining a domain. The most common reason for failing to join a domain is a significant difference in the system time on the Windows domain controller and the RiOS appliance. When the time on the domain controller and the RiOS appliance do not match, this error message appears:

lt-kinit: krb5_get_init_creds: Clock skew too great

We recommend using NTP time synchronization to synchronize the client and server clocks. It is critical that the RiOS appliance time is the same as on the Active Directory controller. Sometimes an NTP server is down or inaccessible, in which case there can be a time difference. You can also disable NTP if it is not being used and manually set the time. You must also verify that the time zone is correct. For details, see Modifying general host settings. For more troubleshooting, see Troubleshooting a domain join failure.

•Both the client and the server must support SMB2 and SMB3 to use RiOS SMB2 and SMB3 signing.

Verifying the domain functional level and host settings

This section describes how to verify the domain and DNS settings before joining the Windows domain and enabling SMB signing.

To verify the domain functional level (delegation mode and replication users)

1.If you are using delegation mode or configuring replication users, verify that the Windows domain functionality is at the Windows 2003 level or higher. In Windows, open Active Directory Users and Computers on the domain controller, choose Domain Name, right-click, and select Raise Domain functionality level. If the domain is not already at the Windows 2003 level or higher, manually raise the domain functionality.

If replication users are configured to use password replication policy (PRP), the domain functional level must be Windows 2008 or higher. For details about delegation mode, see Enabling SMB signing. For details about replication users, see Configuring replication users (Kerberos).

Note: After you raise the domain level, you cannot lower it.

Figure: Verifying the domain level before enabling SMB signing

For details, see the Microsoft Windows Server 2003 Active Directory documentation:

https://technet.microsoft.com/en-us/library/dd578336%28v=ws.10%29.aspx

2.Identify the full domain name, which must be the same as DNS. You must specify this name when you join the server-side SteelHead to the domain.

3.Identify the short (NetBIOS) domain name by pressing Ctrl+Alt+Del on any member server. You must explicitly specify the short domain name when the RiOS appliance joins the domain if it does not match the leftmost portion of the fully qualified domain name.

4.Make sure that the primary or auxiliary interface for the server-side SteelHead is routable to the DNS and the domain controller.

5.Verify the DNS settings.

You must be able to ping the server-side SteelHead, by name, from a CIFS server joined to the same domain that the server-side SteelHead joins. If you cannot, you must manually create an entry in the DNS server for the server-side SteelHead and perform a DNS replication prior to joining the Windows domain. The appliance does not automatically register the required DNS entry with the Windows domain controller.

You must be able to ping the domain controller, by name, whose domain the server-side SteelHead joins. If you cannot, choose Networking > Networking: Host Settings to configure the DNS settings.

Figure: Verifying the DNS settings for SMB signing

For details, see Modifying general host settings.

The next step is to join a Windows domain.

To join a Windows domain

•Choose Optimization > Active Directory: Domain Join on the server-side SteelHead and join the domain.

Figure: Domain Auth Auto Config page

For details, see Easy domain authentication configuration. After you have joined the domain, the next step is to enable SMB signing.

Enabling SMB signing

After you have joined a Windows domain, you can enable SMB signing.

Note: When SMB signing is set to Enabled for both the client and server-side SMB component (but not set to Required), and the RiOS Optimize Connections with Security Signatures feature is enabled, it takes priority and prevents SMB signing. You can resolve this by disabling the Optimize Connections with Security Signatures feature and restarting the SteelHead before enabling this feature.

The RiOS Optimize Connections with Security Signatures feature can lead to unintended consequences in the scenario when SMB signing is required on the client but set to Enabled on the server. With this feature enabled, the client concludes that the server does not support signing and might terminate the connection with the server as a result. You can resolve this by using one of these procedures before enabling this feature:

•Disable the Optimize Connections with Security Signatures feature and restart the SteelHead.

•Apply a Microsoft Service pack update to the clients (recommended). You can download the update from the Microsoft Download Center:

http://support.microsoft.com/kb/916846

To enable SMB1 signing

1.On the server-side SteelHead, choose Optimization > Protocols: CIFS (SMB1) to display the CIFS page.

Figure: CIFS SMB1 page

2.Under SMB Signing, complete the configuration as described in this table.

Control	Description
Enable SMB Signing	Enables CIFS traffic optimization by providing bandwidth optimizations (SDR and LZ), TCP optimizations, and CIFS latency optimizations, even when the CIFS messages are signed. By default, this control is disabled. You must enable this control on the server-side SteelHead. Note: If you enable this control without first joining a Windows domain, a message tells you that the SteelHead must join a domain before it can support SMB signing.
NTLM Transparent Mode	Provides SMB1 signing with transparent authentication. The server-side SteelHead uses NTLM to authenticate users. Select transparent mode with Vista for the simplest configuration. You can also use transparent mode with Windows 7, provided that you join the server-side SteelHead as an Active Directory integration.
NTLM Delegation Mode	Re-signs SMB signed packets using the Kerberos delegation facility. This setting is enabled by default when you enable SMB signing. Delegation mode is required for Windows 7, but works with all clients (unless the client has NTLM disabled). Delegation mode requires additional configuration. Choose Optimization > Active Directory: Service Accounts or click the link provided in the CIFS Optimization page.
Enable Kerberos Authentication Support	Provides SMB signing with end-to-end authentication using Kerberos. The server-side SteelHead uses Kerberos to authenticate users. In addition to enabling this feature, you must also join the server-side SteelHead to a Windows domain and add replication users on the Optimization > Active Directory: Auto Config page. The server-side SteelHead must be running RiOS 7.0.x or later. The client-side SteelHead must be running RiOS 5.5 or later. No configuration is needed on the client-side SteelHead. If you want to use password replication policy (PRP) with replication users, Kerberos authentication requires additional replication user configuration on the Windows 2008 Domain Controller.

3.Click Apply to apply your settings to the running configuration.

4.Click Save to save your settings permanently.

To enable SMB2/3 signing

1.On the server-side SteelHead, choose Optimization > Protocols: SMB2/3 to display the SMB2/3 page.

Figure: CIFS page for SMB2/3 signing

2.Under Signing, complete the configuration as described in this table.

Control	Description
Enable SMB2 and SMB3 Signing	Enables SMB2/3 traffic optimization by providing bandwidth optimizations (SDR and LZ), TCP optimizations, and SMB2/3 latency optimizations, even when the SMB2/3 messages are signed. By default, this control is disabled. You must enable this control on the server-side SteelHead. If you are upgrading and already have a delegate user, and the SteelHead is already joined to a domain, enabling SMB2/3 signing works when enabled with no additional configuration. Note: If you enable this control without first joining a Windows domain, a message tells you that the SteelHead must join a domain before it can support SMB2/3 signing. Note: You must enable SMB2/3 latency optimization before enabling SMB2/3 signing. To enable SMB2/3 latency optimization, choose Optimization > Protocols: SMB2/3.
NTLM Transparent Mode	Provides SMB2/3 signing with transparent authentication. The server-side SteelHead uses NTLM to authenticate users. Select transparent mode with Vista for the simplest configuration. You can also use transparent mode with Windows 7, provided that you join the server-side SteelHead using Active Directory integration with Windows 2003 or 2008.
NTLM Delegation Mode	Re-signs SMB2/3 signed packets using the delegation facility. This setting is enabled by default when you enable SMB2/3 signing. Delegation mode is required for Windows 7 but works with all clients (unless the client has NTLM disabled). Delegation mode requires additional configuration. Choose Optimization > Active Directory: Service Accounts or click the link in the CIFS Optimization page.
Enable Kerberos Authentication Support	Provides SMB2/3 signing with end-to-end authentication using Kerberos. The server-side SteelHead uses Kerberos to authenticate users. In addition to enabling this feature, you must also join the server-side SteelHead to a Windows domain and add replication users: 1. Choose Optimization > Active Directory: Domain Join to join the server-side SteelHead to a Windows domain. 2. Choose Optimization > Active Directory: Auto Config. 3. Choose Configure Replication Account to add the replication users. For SMB3, the server-side SteelHead must be running RiOS 8.5 or later. The client-side SteelHead must be running RiOS 6.5 or later. For SMB2, the server-side SteelHead must be running RiOS 7.0 or later. The client-side SteelHead must be running RiOS 6.5 or later. No configuration is needed on the client-side SteelHead. If you want to use password replication policy (PRP) with replication users, Kerberos authentication requires additional replication user configuration on the Windows 2008 domain controller.

3.Click Apply to apply your settings to the running configuration.

4.Click Save to save your settings permanently.

5.If you enable or disable SMB2 or SMB3, you must restart the optimization service. For details, see Starting and stopping the optimization service.

FAQs

What is the difference between SMB2 and SMB3? ›

A new hashing algorithm, HMAC SHA-256, makes SMB2. 0 more secure compared to the earlier dialects. With SMB3. 0, security has been further enhanced by the AES-CMAC algorithm, and with Windows 11, AES-256-GCM has been introduced.

Read On ›

How do I enable SMB2 or higher? ›

To enable SMB2 on Windows 10, you need to press the Windows Key + S, start typing and click on Turn Windows features on or off. You can also search the same phrase in Start, Settings. Scroll down to SMB 1.0/CIFS File Sharing Support and check that top box.

Discover More Details ›

What is the use of SMB2? ›

The Server Message Block (SMB) Protocol Versions 2 and 3, hereafter referred to as "SMB 2 Protocol", is an extension of the original Server Message Block (SMB) Protocol (as specified in [MS-SMB] and [MS-CIFS]). Both protocols are used by clients to request file and print services from a server system over the network.

Can SMB2 be encrypted? ›

Encryption requires that SMB2 signing is enabled on the server-side SteelHead in NTLM-transparent (preferred) or NTLM-delegation mode, and/or end-to-end Kerberos mode. Domain authentication service accounts must be configured for delegation or replication as needed.

See Details ›

Is SMB2 still used? ›

Windows Vista/Server 2008 and later operating systems use SMB2 when communicating with other machines also capable of using SMB2. SMB1 continues in use for connections with older versions of Windows, as well various vendors' NAS solutions. Samba 3.5 also includes experimental support for SMB2.

Find Out More ›

Why is SMB3 so good? ›

Super Mario Bros. 3 introduced many elements that became Super Mario staples, such as Bowser's children (the Koopalings) and a world map to transition between levels. Super Mario Bros. 3 was praised by critics for its challenging gameplay and is regarded as one of the greatest video games of all time.

Tell Me More ›

Should SMB2 be disabled? ›

Disabling SMB2 and higher is not recommended on any Windows machine, as SMB1 is an old and insecure protocol. Instead, SMB2 and SMB3 should be enabled on the DCs in the domain.

Show Me More ›

Is SMB V2 vulnerable? ›

Description. The remote version of Windows contains a version of SMBv2 (Server Message Block) protocol that has several vulnerabilities. An attacker may exploit these flaws to elevate his privileges and gain control of the remote host.

Explore More ›

How do I know if SMB v2 is enabled? ›

Open the Powershell and type in Get-SmbServerConfiguration | Select EnableSMB2Protocol. You should receive a True in response, meaning you can run SMB2 on your computer. If not, you might need to be sure you have the latest build of Windows. SMBv2 should be disabled by default.

What is SMBv2 V3? ›

Specifies the Server Message Block (SMB) Protocol Versions 2 and 3, which support the sharing of file and print resources between machines and extend the concepts from the Server Message Block Protocol.

Show Me More ›

What port does SMB2 use? ›

The well known TCP port for SMB2 is 445.

Read The Full Story ›

What is SMB2 security mode? ›

Script smb2-security-mode

Determines the message signing configuration in SMBv2 servers for all supported dialects. The script sends a SMB2_COM_NEGOTIATE request for each SMB2/SMB3 dialect and parses the security mode field to determine the message signing configuration of the SMB server.

See Details ›

How can I make my SMB more secure? ›

Securing SMB protocols is most important for network security.

Update SMB: Use the latest SMB version for security features.
Encrypt SMB: Enable SMB encryption for data protection.
Strong Authentication: Use robust authentication methods.
Firewall Rules: Restrict SMB access via firewalls to trusted IPs.

More items...

Sep 29, 2023

Get More Info Here ›

Should I enable SMB encryption? ›

By default, when you create an SMB server on the storage virtual machine (SVM), SMB encryption is disabled. You must enable it to take advantage of the enhanced security provided by SMB encryption. To create an encrypted SMB session, the SMB client must support SMB encryption.

Is SMB a security risk? ›

Small and medium-sized businesses (SMBs) are often targeted by cyberattacks due to misconfigured security systems, weak credentials, and insecure mobile devices. Attackers exploit misconfigured security systems to gain access to sensitive data.

What is SMB3 used for? ›

SMB 3 (Server Message Block 3.0) is a protocol that provides a way for a computer's client applications to read and write to files from a server in a computer network.

View Details ›

Is SMB3.0 safe? ›

For the most part, SMB 3 is a better and more secure version, but backward compatibility is an issue. Printers and other devices may not support SMB 3.0, and their vendors are probably more likely to want to sell you a new printer that supports it than do the work to retrofit it for older printers.

What is the most secure SMB version? ›

These improvements help protect sensitive data from eavesdropping and man-in-the-middle attacks, making SMBv3 the most secure version of the protocol to date. To analyze SMB traffic using Wireshark, you can use display filters to focus on specific SMB versions.

Learn More ›

Is SMB3 vulnerable? ›

Despite the major improvements made on SMBv3, it still presents some security vulnerabilities, with remote code execution being one of the most concerning.

Discover More Details ›