Steelhead Appliance Installation and Configuration Guide
71
Disabling SMB Signing
Installing and Configuring the Steelhead Appliance
Disabling SMB Signing
The CIFS protocol, used by Windows operating systems for file and print sharing, is based on SMB protocol.
To prevent security assaults that might modify transmissions, the SMB protocol supports signing all
transmitted SMB packets. By default, Domain Controllers that also act as file servers have signing enabled.
SMB signing is a performance intensive operation for clients and servers. Hence this feature is not turned
on all the time. This feature is negotiated between the client and the server.
SMB signing prevents the Steelhead appliance from applying full optimization on CIFS connections and
significantly reduces the performance gain from a Steelhead deployment. As many customers take
additional security precautions (such as firewalls, internal-only reachable servers, and so forth), SMB
signing adds little additional security, at a significant performance cost (even without deployed Steelhead
appliances).
Note:
For detailed information about the performance impact of SMB signing, see the Microsoft support site. SMB
signing was enabled on Windows 2000, Service Pack 3, Critical fix Q329170.
Identifying Poor CIFS Performance
You can identify poor CIFS performance by the examining the Steelhead appliance log files in the
Management Console.
For example, on the client-side Steelhead appliance:
Jan 22 00:01:11 dfcfe1 sport[3940]: [smbcfe.WARN] 728 {10.0.0.14:1605 10.0.0.4:445} Cifs
parser shutting down due to error=SMB_SHUTDOWN_ERR_SEC_SIG_ENABLED. Security signatures are
enabled on the server. Disabling latency optimization, only bandwidth will be optimized.
For example, on the server-side Steelhead appliance:
Jan 22 00:04:49 dfcfe1 sport[3940]: [smbcfe.WARN] 733 {10.0.100.86:4688 10.0.0.4:445} Received
cifs shutdown request from SFE: error=SMB_SHUTDOWN_ERR_SEC_SIG_ENABLED
You can disable SMB signing using one of the following approaches:
“Disabling SMB Signing Using the Secure-CIFS Feature,”
“Disabling SMB Signing Using Active Directory” on page 73
Important:
Riverbed recommends you disable SMB signing using the Security Signatures feature. If you still
experience problems, disable SMB signing using the procedures described in
Using Active Directory” on page 73
Disabling SMB Signing Using the Secure-CIFS Feature
The RiOS Secure-CIFS feature automatically disables SMB signing.
Important:
By default, the Secure-CIFS feature is enabled, thus the Steelhead appliance disables SMB signing by default.
