3

We have a Sharp copier scanner set up on address 172.20.20.200 and a Windows 2008 file server with network shares IP - 172.20.10.82. Up until a week ago we could scan from the copier directly to a folder on the Windows server, no trouble. It has been set up this way for years. This week, scanning to the folder on the server no longer works. Everyone else on network via Windows (7) can access the shares from any subnet (VLAN) - those all still work (mapped drives). Another scanner on a different subnet, IP 172.20.70.200 cannot scan to the Windows server as well and it used to work fine also. The error on the copiers are

Cannot connect to server
. Turning the firewall off on the server makes no difference.

Pinging the server from the scanner works perfectly when the scanning to server does not. A traceroute from the server to scanner:

Tracing route to 172.20.20.200 over a maximum of 30 hops
  1    <1 ms    <1 ms    <1 ms  172.20.10.1
  2    <1 ms    <1 ms    <1 ms  172.20.20.200
Trace complete.

If I change the address of the scanner, and the VLAN port the scanner is on to be on the same subnet (10), say make IP 172.20.10.233, scanning works! I did a packet capture of both instances (172.20.20.200 and 172.20.10.233) and the only difference is that when the scanner is on a different subnet it does a NBSTAT but does not get a reply:

1759    43.589860    172.20.20.200    flsr1.ournet.local NBNS    92    Name query NBSTAT *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>

as opposed to when it is on the same subnet as the windows server and does get a reply back:

6619    75.384317    172.20.10.233    flsr1.ournet.local NBNS    92    Name query NBSTAT *<00><00><00><00><00><00><00><00><00><00><00><00><00><00><00>
6620    75.384554    flsr1.ournet.local    172.20.10.233 NBNS    217    Name query response NBSTAT

The configs on our switches (Cisco 2960's & 3750) have not changed. What else should I be looking for?

RESOLUTION:

A Windows update ( https://support.microsoft.com/en-us/kb/3161949 ) removed SMB over NetBIOS functionality. From the security update notes:

After you install this security update, the following changes are applied: NETBIOS communication outside of the local subnet is hardened. Therefore, by default, some features that depend on NETBIOS (such as SMB over NETBIOS) will not work outside the local subnet.

Removing this update restored scanning to server.

Improve this question
8
  • What's doing your routing?
    – Chopper3
    Jun 17, 2016 at 12:46
  • Sorry, typo above, should be Cisco 3750 is our core switch does layer 3
    – Roberto
    Jun 17, 2016 at 12:50
  • This doesn't makes sense to me. If changing the ip address fixes the problem then the scanner really isn't in a different VLAN. a VLAN provides and creates separation at Layer 2. Routing at Layer 3 provides for communication between VLAN's. How is it possible that changing the ip address fixes the problem if the scanner is in a different Layer 2 network?
    – joeqwerty
    Jun 17, 2016 at 12:50
  • 1
    I change the VLAN port on the 2960 the scanner is on at the same time as changing the IP address.
    – Roberto
    Jun 17, 2016 at 12:51
  • 1
    OK. It would be nice if that info was in your question. Why don't you add that info so that others understand it when reading your question.
    – joeqwerty
    Jun 17, 2016 at 12:52

2 Answers 2

Reset to default
2

The proper resolution to the problem is listed in the article quoted:

To change this new default behavior, create the following registry entry: SUBKEY: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters Value Name: AllowNBToInternet Type: Dword Value: 1 Default value of the flag: 0

Improve this answer
4
  • I didn't include that as a resolution because, for us, after creating the key, rebooting, and resetting the scanner, scanning still didn't work.
    – Roberto
    Jun 20, 2016 at 12:25
  • That's because you also change vlans. If this is a NetBIOS issue that's the proper soution. Removing the update creates the vulnerability.
    – Jim B
    Jun 20, 2016 at 14:16
  • The registry hack is not a solution to the problem I posted and asked for assistance, but for the problem listed in the article quoted.
    – Roberto
    Jun 20, 2016 at 15:00
  • Your edit claims that the issue was the NetBIOS behaviours, if that's not true you should edit to reflect that.
    – Jim B
    Jun 20, 2016 at 16:37
0

For us the ultimate solution was to use FTP rather than "Network Folders." This is two years down the road, and the scanner we're looking at is an older MX-B402SC, so thinking the solutions listed here might not work anymore due to a further hardening of security perhaps? (Somebody somewhere mentioned SMBv1 might still be used by the MFP, and that would be an issue as well).

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .