This article covers the configuration of DFS file sharing using Kerberos authentication. To enable a Windows Share using the SMB/CIFS protocol, you must allow traffic to the server that hosts the share, as well as to its domain controller(s) for authentication purposes.
Requirements
You must have SecureEdge Access Agent version 2.0.2 or higher.
To enable a Windows file share for use with SecureEdge, follow these steps:
Add a Custom Network Application that opens port 445 on your file server.
After this configuration is complete, run a DNS SRV query on the Kerberos service associated with the domain of the file server. This will allow you to identify which domain controllers are responsible for managing the authentication.
These servers will not undergo automatic backhauling. Therefore, you will need your second Custom Network Application to manage these IPs, which open ports 88 (Kerberos), 389 (LDAP), and, if the user's domain controllers prefer LDAPs, port 636 as well.
Add the Zero Trust Access policies for your Custom Network Application and define the ZTNA condition. This includes specifying the users and groups permitted access, as well as assessing your device posture to ensure compliance with security standards.
