[Samba] Winbind and stateful firewalls

[LESUISSE Arthur]

Hello,

We have an issue in our environment with Linux servers/workstations joined to AD using winbind. (The domain controllers run Windows.)

Winbind seems to keep an open TCP session to a domain controller on port 49667, which I understand is some kind of RPC. This TCP session seems to be long lived. The problem is, we have a stateful firewall (Palo Alto) between the stations and the domain controllers. If the connection is inactive for a long time, the firewall will forget about it and start dropping packets. This causes a login delay of ~10 seconds on the stations as they eventually reset the connection.

I tried setting "socket options = SO_KEEPALIVE" in smb.conf on the stations, but that doesn't seem to affect it; I guess that setting is only used for a Samba server and not for connections from winbind to AD?

Is there any way to fix this issue in configuration? Otherwise, is this worthy of opening a bug report for?

Thanks,
Arthur