Data ONTAP supports Server Message Block (SMB) signing when requested by the client. SMB signing helps to ensure that network traffic between the storage system and the client has not been compromised by preventing replay attacks (also known as "man in the middle" attacks).
When SMB signing is enabled on the storage system, it is the equivalent of the Microsoft Network server policy "Digitally sign communications (if client agrees)". It is not possible to configure the storage system to require SMB signing communications from clients, which is the equivalent of the Microsoft Network server policy "Digitally sign communications (always)". SMB signing is disabled by default on the storage system for performance reasons. To enable it, see Enabling SMB signing.
Note
SMB signing incurs performance degradation. For more information, see Performance impact of SMB signing.
There are two SMB signing policies on Windows clients that control the digital signing of communications between clients and the storage system:
This setting controls whether or not the client's SMB signing capability is enabled. It is enabled by default.
When this setting is enabled on the client
When this setting is disabled on the client, the client communicates normally with the storage system without SMB signing, regardless of the SMB signing setting on the storage system.
This setting controls whether the client requires SMB signing to communicate with a server. It is disabled by default.
When this setting is enabled on the client
Note
If your environment includes Windows clients configured to require SMB signing, you must enable SMB signing on the storage system. If you do not, the storage system cannot serve data to these systems.
When this setting is disabled on the client, SMB signing behavior is based on the policy setting for "Digitally sign communications (if server agrees)" and the setting on the storage system.
Client SMB policies are controlled through Security Settings using the Microsoft Management Console (MMC). For more information about client SMB signing and security issues, see the Microsoft Windows documentation.
Because of the performance impact of SMB signing (see the following sections), SMB signing is not enabled by default in Data ONTAP. To enable SMB signing on the storage system, complete the following step.
| 1 |
Enter the following command: |
Most Windows clients will negotiate SMB signing by default if it is enabled on the server. When SMB signing is enabled, all CIFS communications to and from Windows clients incur a significant impact on performance, which affects both the clients and the server (that is, the storage system running Data ONTAP). The performance degradation shows as increased CPU usage on both the client and the server, although the amount of network traffic does not change.
Depending on your network and your storage system implementation, the performance impact of SMB signing can vary widely, and can only be verified through testing in your network environment.
If you require SMB protection for some of your Windows clients, and if SMB signing is causing performance issues, you can disable SMB signing on any of your Windows clients that do not require protection against replay attacks. For information about disabling SMB signing on Windows clients, see the Microsoft Windows documentation.
Copyright © 1994-2005, Network Appliance, Inc. All rights
reserved.
Part No. 210-01086_B0
File: 3cifs48.htm
Last updated: 08-Dec-2005 13:19:35