topic Re: NETAPP and Recent SMB1 Issues in ONTAP Discussions

NETAPP and Recent SMB1 Issues

parkea2 — Wed, 04 Jun 2025 14:51:44 GMT

Can anyone point me to any offical NETAPP responses to the SMB1 discussed here:

https://whyistheinternetbroken.wordpress.com/2017/02/22/smb1-vuln-ontap/

I am not in a postion today to move to ONTAP 9.2 and disable SMB1. However our

security scanner are reporting this daily now.

If I can quota an offical response from NETAPP stating its SMB1 is not vulnerable then

I can get a risk acceptance to cover the scan failures until I upgrade to 9.2.

Re: NETAPP and Recent SMB1 Issues

kryan — Wed, 12 Jul 2017 13:19:54 GMT

For a conclusive answer it would help to know exactly is the scanner reporting.

In the mean time, you might find this helpful:

https://kb.netapp.com/support/s/article/NTAP-20170515-0001

Re: NETAPP and Recent SMB1 Issues

parkea2 — Wed, 12 Jul 2017 13:35:15 GMT

Thanks, you reply was very useful. This is the Nessus link.

http://www.tenable.com/plugins/index.php?view=single&id=96982

Re: NETAPP and Recent SMB1 Issues

kryan — Wed, 12 Jul 2017 13:40:04 GMT

Thanks for the info on the generic "disable SMBv1" warning.

As of today (7/12/2017) it is not completely possible to disable SMBv1 for client access on any version of ONTAP other than 9.2. However, there are plans to add that capability to an existing LTS 9.x release and an upcoming 7-Mode release as well.

Re: NETAPP and Recent SMB1 Issues

kryan — Thu, 03 Aug 2017 12:59:12 GMT

ONTAP version 8.2.5 (7-Mode only) posted today and adds the ability to disable SMBv1 server and client.

Re: NETAPP and Recent SMB1 Issues

VIVISIMOIT — Wed, 10 Jan 2018 14:05:05 GMT

How do you disable smb v1? i see option to enable V2 but not disable v1.

Re: NETAPP and Recent SMB1 Issues

parkea2 — Wed, 10 Jan 2018 15:05:05 GMT

See release notes for 8.2.5

https://library.netapp.com/ecmdocs/ECMLP2760543/html/frameset.html

cifs control set

Re: NETAPP and Recent SMB1 Issues

VIVISIMOIT — Wed, 10 Jan 2018 18:18:54 GMT

thanks. per the release notes, the command to disable smb v1 in 8.2.5 7mode is

filer> cifs control set smb1.enable no

in conjunction with this

filer> options cifs.smb2.enable on

and i can confirm that this allows nessus scans to pass for the cifs protocol

Re: NETAPP and Recent SMB1 Issues

Jim_Robertson — Mon, 19 Nov 2018 21:59:31 GMT

Does anyone know of a way to track what clients are making SMB1 connections? We would prefer to idetify them and remove them from the environment rather than just disabling SMB1 on the NetApp and breaking any old printers that are still using it. The cifs session command shows the clients, but it is a point in time, so if they are not actively connected when the command is run, they will not show up.

cifs session show -protocol-version smb1 -fields address

I attempted to use the statistics command, but it only shows me numbers of connections (from what I could find), not the specific clients that the connections were coming from.

Any suggestions?

Re: NETAPP and Recent SMB1 Issues

cyberhic228 — Wed, 03 Jul 2019 01:11:40 GMT

If this is still an outstanding question, you can always perform a packet capture on a filer and review in wireshark. This would answer that questions. Check the knowledgebase on what the commands are to do this, but unless your using a really old OS, you should not have to worry about this.