CIFS

What can I do here?

Use this window to configure the properties of a CIFS resource.

Understanding CIFS

CIFS (Common Internet File System) is a protocol used to request file and print services from server systems over a network. The protocol is often implemented over the NETBIOS session service over TCP using port 139. In Windows networking, CIFS is used over the Microsoft-DS protocol (port 445) for networking and file sharing. The Security Gateway secures Microsoft Networking Services in the Inspection module, without requiring a security server. This meets the high performance requirements of LAN security.

Configuring CIFS Stateful Inspection

1. Define a new CIFS Resource: Object Explorer > New > More > Resource > CIFS.
2. Enter a name for the resource to be a network object.
3. In the Allowed Disk\Print Shares list, add CIFS servers and disk shares.
4. In Type, select log and block options.
5. Click OK.
6. Add a new Access Control Policy rule. In Services & Applications, add nbsession or Microsoft-DS, and associate the service with the configured CIFS Resource.

   Important - Do not delete or change the protocol type of the service objects that run content inspection. If the service is changed in this way, the protection will not work.

7. Install the policy.

CIFS Options

• Allowed Disk\Print Shares - Add or delete from the list of Allowed Disk and Print Shares. Wildcard characters are permitted. Many CIFS client implementations also try to map a pseudo share called IPC$. Allow access to this share to permit CIFS connections.

  For example, to allow access to the disk share PAUL on the CIFS server BEATLES:

  1. Click + and enter BEATLES in the Server Name field.
  2. Enter IPC$ in the Share Name field.
  3. Click + again and enter BEATLES in the Server Name field and PAUL in the Share Name field.
• Type
  • Log mapped shares - logs each share map attempt.
  • Log access violation - logs any attempt to violate the restrictions imposed by the Resource. This includes attempts to access restricted disk shares as well as any malformed CIFS message issued by the client.
  • Block remote registry access - blocks the ability to remotely manipulate a the window's registry.