Domain controller disables SMB1 protocol and causes issues with NTLM authentication in clustered Data ONTAP

Applies to

• ONTAP 9
• Microsoft Server 2012 R2

Issue

• NTLM authentication fails with INTERNAL_ERROR domain controller sending TCP resets in response to a SMB Negotiate Protocol Request.

Example: Packet trace excerpt captured from vserver/SVM to domain controller (DC)

1. SVM will send a negotiate protocol request to a DC with only SMB1 (Dialect: NT LM 0.12) as the advertised support:

No.       Time           Source                Destination           Protocol Length Stream index The RTT to ACK the segment was Info
12        0.036391000    10.251.198.234        10.251.198.218        SMB      121    0                                           Negotiate Protocol Request ...
    Negotiate Protocol Request (0x72)
         Word Count (WCT): 0
         Byte Count (BCC): 12
         Requested Dialects
             Dialect: NT LM 0.12
                 Buffer Format: Dialect (2)
                 Name: NT LM 0.12

2. The DC will immediately reset this TCP connection.

No.     Time           Source                Destination           Protocol Length Stream index The RTT to ACK the segment was Info
13      0.036489000    10.251.198.218        10.251.198.234        TCP      54     0            0.000098000         microsoft-ds > 18352 [RST, ACK] Seq=2520340104 Ack=3939036472 Win=0 Len=0

SECD logs might also fails with the error RESULT_ERROR_SPINCLIENT_SOCKET_RECEIVE_ERROR error connecting to NETLOGON through NTLM

 

Example from ONTAP 9.1:

Failure Summary:
Error: User authentication procedure failed
CIFS SMB2 Share mapping - Client Ip = 10.61.35.36
  [  0 ms] Login attempt by domain user 'NETAPP\user1' using NTLMv2 style security
  [     1] Successfully connected to ip 10.216.29.40, port 445 using TCP
  [     1] Unable to connect to NetLogon service on omard-win2k16dc1.internaldomaina.local (Error: RESULT_ERROR_SPINCLIENT_SOCKET_RECEIVE_ERROR)
  [     1] No servers available for MS_NETLOGON, vserver: 7, domain: internaldomaina.local.
**[     1] FAILURE: Unable to make a connection (NetLogon:INTERNALDOMAINA.LOCAL), result: 6940
  [     2] CIFS authentication failed

000.000.388]  debug:  NEGOTIATE REQUEST: SMB1 - Dialects we support: NT LM 0.12  { in ConnectToCifsServer() at src/Actions/ActionsONTAP.cpp:198 }
[000.000.413]  debug:  CM_STATS:  Tracking connect() to server 10.216.29.40, port 445  { in startConnectTracking() at src/cm/secd_cm_stats_manager.cpp:863 }
[000.001.265]  info :  Successfully connected to ip 10.216.29.40, port 445 using TCP { in _connect() at src/connection_manager/secd_connection_shim.cpp:317 }
[000.001.630]  ERR  :  HandleBytesReturnedFromRecv: Failed to receive data on socket: Connection reset by peer  { in DisplayPerror() at src/Support/CustomErrors.cpp:56 }
[000.001.639]  ERR  :  RESULT_ERROR_SPINCLIENT_SOCKET_RECEIVE_ERROR:6754 in HandleBytesReturnedFromRecv() at src/FrameWork/Socket.cpp:796
[000.001.649]  ERR  :  RESULT_ERROR_SPINCLIENT_SOCKET_RECEIVE_ERROR:6754 in ReceiveDataOnSocket() at src/FrameWork/Socket.cpp:911
[000.001.671]  ERR  :  RESULT_ERROR_SPINCLIENT_SOCKET_RECEIVE_ERROR:6754 in PerformSyncClientCmd() at src/FrameWork/ClientInfo.cpp:1707
[000.001.679]  ERR  :  RESULT_ERROR_SPINCLIENT_SOCKET_RECEIVE_ERROR:6754 in SendNegotiateRequest() at src/Commands/Negotiate.cpp:184
[000.001.687]  ERR  :  RESULT_ERROR_SPINCLIENT_SOCKET_RECEIVE_ERROR:6754 in ConnectToCifsServer() at src/Actions/ActionsONTAP.cpp:247
[000.001.705]  ERR  :  Unable to connect or establish session (Error code = 6754)  { in DisplayError() at src/Support/CustomErrors.cpp:86 }
[000.001.712]  ERR  :  RESULT_ERROR_SPINCLIENT_SOCKET_RECEIVE_ERROR:6754 in connectToDomainController() at src/connection_manager/secd_connection.cpp:230
[000.001.719]  debug:  Failed to connect to DC win2k16dc1.internaldomaina.local  { in connectToDomainController() at src/connection_manager/secd_connection.cpp:257 }

• SMB1 driver is running on the domain controller using the CLI:

C:UsersAdministrator>sc qc srv
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: srv
         TYPE               : 2  FILE_SYSTEM_DRIVER
         START_TYPE         : 2   AUTO_START  <<<<<< IF THIS IS DEMAND_START, then change it back to AUTO_START

         ERROR_CONTROL      : 1   NORMAL
         BINARY_PATH_NAME   : System32DRIVERSsrv.sys
         LOAD_ORDER_GROUP   : Network
         TAG                : 0
         DISPLAY_NAME       : Server SMB 1.xxx Driver
         DEPENDENCIES       : srv2
         SERVICE_START_NAME :

:UsersAdministrator>sc query srv

SERVICE_NAME: srv
         TYPE               : 2  FILE_SYSTEM_DRIVER
         STATE              : 4  RUNNING <<<<<< IF THIS IS STOPPED, then SMB1 DRIVER IS NOT RUNNING
                                 (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN)
         WIN32_EXIT_CODE    : 0  (0x0)
         SERVICE_EXIT_CODE  : 0  (0x0)
         CHECKPOINT         : 0x0
         WAIT_HINT          : 0x0