ScreenOS Firewalls (NOT SRX)
Reply
Recognized Expert
Dominik
Posts: 392
Registered: ‎01-05-2008
0
Accepted Solution

NetBIOS broadcast forwarding

Hi,

 

I have been asked by a collegue if the following is possible: Two sites connected via two SSG5 firewalls by a site to site VPN tunnel. Both sites use NetBIOS name resolution by means of broadcast messages (all nodes are in B mode). No WINS server is in use and cannot be installed in the near future.

 

Is it possible that the SSG5 firewalls forward the NetBIOS name resolution broadcast messages, i.e. acting as some kind of NetBIOS proxy, to allow computers from one side resolve NetBIOS names from computers in the other site?

 

Regards,

Dominik

JNCIE et al.

--
The Axiom of Choice is obviously true, the well-ordering principle obviously false, and who can tell about Zorn's lemma?
Trusted Expert
Kashif-rana
Posts: 417
Registered: ‎01-29-2008
0

Re: NetBIOS broadcast forwarding

Hi,

 

u can use the option NETBIOS over TCP/IP option in NIC properties.

 

 

Kashif Rana
JNCIE-SEC, JNCIE-ENT, JNCIE-SP, JNCIS(FWV,SSL),JNCIA(IDP,AC,WX),BIG IP-F5-LTM, CCNP
----------------------------------------------------------------------------------------------------------------------------------------

If this post was helpful, please mark this post as an "Accepted Solution".Kudos are always appreciated!
Recognized Expert
Dominik
Posts: 392
Registered: ‎01-05-2008
0

Re: NetBIOS broadcast forwarding

Hi,

 

I think you misunderstand me. The Option "NetBIOS over TCP" in the NIC properties just enables or disables NetBIOS on some workstation. It is enabled by default and if you disable it, all programs that use the NetBIOS API won't work. In particulary, the SMB protocol is used in its SMB over TCPI variant instead of encapsulating it in NetBIOS packets that are themselves tunneled in TCP packets.

 

This option has to be enabled that the Browser service can work. If so, it uses NetBIOS broadcasts that are implemented as ordinary UDP broadcasts in the subnet. The firewall as a Layer 3 device will be the border of the broadcast domain and therefore not forward these broadcast packets through the VPN tunnel.

 

What I'm actually looking for is a ScreenOS option that the FW detects these broadcast packets and forward them anyway through the tunnel after doing some kind of rewriting of the packet to reflect that they are now in a different subnet. Very similiar to the way a DHCP relay works that listens too for some specific broadcast messages and forwards them to a server configured in the options.

 

Regards,

Dominik 

JNCIE et al.

--
The Axiom of Choice is obviously true, the well-ordering principle obviously false, and who can tell about Zorn's lemma?
Trusted Expert
Kashif-rana
Posts: 417
Registered: ‎01-29-2008
0

Re: NetBIOS broadcast forwarding

sorry i got ur point. u need IP helper address type soluton. i dont think so u can configure netscreen to relay netbios traffic.
Kashif Rana
JNCIE-SEC, JNCIE-ENT, JNCIE-SP, JNCIS(FWV,SSL),JNCIA(IDP,AC,WX),BIG IP-F5-LTM, CCNP
----------------------------------------------------------------------------------------------------------------------------------------

If this post was helpful, please mark this post as an "Accepted Solution".Kudos are always appreciated!
Copyright© 1999-2013 Juniper Networks, Inc. All rights reserved.