Unidentified Network - Kerberus Auth Problem only with SSL and without NETBIOS

Hello

we are disbled NETBIOS / WINS for our Domain Network on client side. Since we did this we have problems to authentificate on our domaincontroller through VPN SSL. With VPN IPSsec all is fine. Also in LAN all is fine. Both, SSL and IPSec using the same firewall rules. With NETBIOS enable authentification with SSL works fine. Domaincontroller gets Kerberos ticket also with SSL. We tried with several machines with same result.

Sophos TAP adapter has lowest interface metrik from all adapters (2) .

Any ideas why this happens?

Please see also attached pictures.

Thanks a lot for helping

IPSec:

SSL:

This thread was automatically locked due to age.
[entsperrt von: LuCar Toni um 9:00 AM (GMT -7) am 25 Sep 2024]

Top Replies

LuCar Toni 7 months ago in reply to Steve Reschke +1 suggested

So basically windows is doing something like a discovery. Not sure what Windows does there and needs to be "reverse engineered" to get to the bottom of this. SSLVPN does something different than IPsec…

Parents

0 LuCar Toni 8 months ago

Could be related to the DNS implications in SSLVPN? You have DNS request routes in SFOS, thats not part of IPsec. Which means, if the Windows cannot figure out the domain after disable netbios, it could be the cause of your issue. Check the dns captures here.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Reply

0 LuCar Toni 8 months ago

Could be related to the DNS implications in SSLVPN? You have DNS request routes in SFOS, thats not part of IPsec. Which means, if the Windows cannot figure out the domain after disable netbios, it could be the cause of your issue. Check the dns captures here.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel

Children

0 Steve Reschke 8 months ago in reply to LuCar Toni

Hi LuCar, thank you for fast answer. I don't see any DNS request routes. Could it have something to do I did because of the issue in this thread?

iptables -t mangle -I POSTROUTING -s 172.20.10.0/24 -d 10.10.0.0/16 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1300;

iptables -t mangle -I POSTROUTING -s 10.10.0.0/16 -d 172.20.10.0/24 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1300;
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni 8 months ago in reply to Steve Reschke

Essentially this looks to be a windows issue to be honest. I dont have much insights into this problem - You should check what kind of mechanism windows uses to check for discovery.

https://serverfault.com/questions/814557/changing-windows-network-profile-from-domainauthenticated-to-public

Looking into this, it looks to be related to DNS.

__________________________________________________________________________________________________________________
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 Steve Reschke 7 months ago in reply to LuCar Toni

If it would be a windows problem why we have no problems with IPSec or in LAN with the same clients?
Cancel
Vote Up 0 Vote Down

Sign in to reply

Verify Answer

Cancel
0 LuCar Toni 7 months ago in reply to Steve Reschke

So basically windows is doing something like a discovery. Not sure what Windows does there and needs to be "reverse engineered" to get to the bottom of this.
SSLVPN does something different than IPsec in terms of IPsec. So that could be the cause.

Check the openvpn community as well, if you find some kind of hint there.

__________________________________________________________________________________________________________________
Cancel
Vote Up +1 Vote Down

Sign in to reply

Verify Answer

Reject Answer

Cancel