How can I allow NetBios traffic via SSLVPN?

12/20/2019 1269 19015

DESCRIPTION:

Allowing NetBIOS over SSLVPN will reduce the number of problems associated with Microsoft workgroup/domain networks, as the SonicWall security appliances will forward all NetBIOS-Over-IP packets sent to the local LAN subnet's broadcast address coming from the SSL tunnel. Microsoft networking, unless explicitly configured otherwise, is heavily dependent upon local LAN broadcast messages; normally, edge security appliances such as routers, firewalls, or VPN security appliances discard these broadcast messages.

NOTE: We do not have a specific option to enable to allow NetBIOS traffic over SSLVPN on SonicOS 5.9 firmwares. Follow these steps after configuring SSLVPN on SonicWall appliance running SonicOS 5.9 and above.

RESOLUTION:

Configure address object for the broadcast address

Since NetBIOS is a broadcast traffic on UDP port 137, an address object needs to be configured for the broadcast IP address 255.255.255.255.

•   Select Manage | Policies | Objects | Address Objects and Add a new address object.
  • Name:  NetBIOS
  • Zone Assignment: LAN
  • Type: Host
  • IP Assignment: 255.255.255.255
    

Adding broadcast address to SSLVPN services group

• Under Manage | System Setup | Users | Local Users & Groups, ensure that the relevant user or user group is a member of the SSLVPN Services group.
  VPN Access Tab:
  On the VPN Access Tab allows users to access networks using a VPN tunnel, select one or more networks from the Networks list and click the arrow button to move them to the Access List. To remove the user's access to a network, select the network from the Access List, and click the left arrow button.
  

How to Test:

From a host connected through NetExtender client ping a host on the SonicWall network by it's NetBIOS name. Before testing make sure the host you are trying from and the host being accessed has NetBIOS enabled in their NIC.

Resolution for SonicOS 6.2 and Below

The below resolution is for customers using SonicOS 6.2 and earlier firmware. For firewalls that are generation 6 and newer we suggest to upgrade to the latest general release of SonicOS 6.5 firmware.

Configure address object for the broadcast address

Since NetBIOS is a broadcast traffic on UDP port 137, an address object needs to be configured for the broadcast IP address 255.255.255.255.

1.   Select Network | Address Objects and add a new address object.
   • Name:  NetBIOS
   • Zone Assignment: LAN
   • Type: Host
   • IP Assignment: 255.255.255.255
     

Adding broadcast address to SSLVPN services group

1. Under Users | Local users, ensure that the relevant user or user group is a member of the SSLVPN Services group.
   VPN Access Tab:
   On the VPN access tab allows users to access networks using a VPN tunnel, select one or more networks from the networks list and click the arrow button to move them to the Access List. To remove the user's access to a network, select the network from the Access List, and click the left arrow button.

How to Test

From a host connected through Netextender client ping a host on the SonicWall network by it's NetBIOS name. Before testing make sure the host you are trying from and the host being accessed has NetBIOS enabled in their NIC.