Skip to content
English
  • There are no suggestions because the search field is empty.

Files: Configuring SMB Integration for File Buckets

Table of Contents

  • Overview
  • Affected Environments
  • Prerequisites & Compatibility
  • Configuration Steps
  • File Ingest Rules & Optional Settings
  • Limitations and Troubleshooting
  • Related Articles

Overview

File buckets resident on Xona Critical System Gateway (CSG) appliances can be linked to a remote filesystem using the Server Message Block (SMB) protocol. Administrators can set up this integration to automatically "mirror" files from the CSG appliance to an SMB share, ingest files from the SMB share into the CSG appliance, or perform both actions simultaneously.

Affected Environments

  • Platform: [x] Hardware (DJN Rail, 1U Server) | [x] Virtual Image (VMware/Hyper-V) | [x] AWS AMI | [x] Azure VM
  • Component: CSG, XCM
Important XCM Consideration: While the XCM is aware of Files and Buckets stored on joined CSG appliances, the CSG appliances themselves communicate directly with any configured SMB servers. The XCM does not communicate directly with SMB servers.

Prerequisites & Compatibility

Before configuring the integration, ensure the following network and compatibility requirements are met:

  • Firewall Requirements: Ensure TCP port 445 is allowed from the CSG appliance to the SMB server through any intermediate firewalls.
  • Windows Server Compatibility: Xona officially tests this integration against the Microsoft Windows Server implementation of the SMB protocol.
  • Windows 11 / Desktop OS Compatibility: Desktop-specific editions of Microsoft Windows (such as Windows 10 and Windows 11) enforce strict default file-sharing limits that may restrict concurrent CSG connections. See the Troubleshooting section below for resolution.
  • Linux Samba (SMB) Compatibility: SMB server implementations offered by storage array vendors and some Linux distributions may or may not work natively with this feature. If you are bridging to a Linux Samba server, ensure the service is explicitly configured to support the standard SMBv2/SMBv3 dialects and NTLMv2 user authentication to maximize compatibility.

Configuration Steps

To set up file ingestion from an SMB share into a specific bucket on the CSG appliance, follow these steps:

  1. Log in to the CSG Web UI as an administrator.
  2. Navigate to Files and select the target file bucket.
  3. Select the Integrations tab of the file bucket.
  4. Enter the Host value (the IP address or hostname of the SMB server). Note: This must be routable from the CSG appliance.
  5. Enter the Share value. This corresponds to the exact "Share Name" configured on the server.
  6. (Optional) Enter the Path value to specify a subdirectory relative to the SMB share root.
    • Leave this empty to sync directly from the root of the share.
    • Use either / or \ as the path separator character. Trailing slashes are not required.
  7. Enter the Username of the user with permissions on the SMB share.
  8. If necessary, enter the Domain value to ensure a Windows domain user identity is assumed for operations on the share.
  9. Click the switch next to Set Password and enter the password for the user.
  10. Scroll to the bottom of the page and save the configuration.

File Ingest Rules & Optional Settings

Once configured, the appliance automatically handles synchronization based on specific rules.

Ingestion Rules The CSG checks for new files to import from the SMB share every 15 seconds. Files are successfully ingested only when the following conditions are met:

  • The file is resident in the exact specified directory of the share (SMB sync will not recursively search into child subdirectories).
  • The file size is less than the CSG's configured maximum upload file size.
  • If enabled, the file passes all configured malware scans.
  • Note: If a previously ingested file is modified remotely, it will be re-ingested.

Optional Settings

You can further tailor the behavior using the following toggles:

  • Copy files to the SMB share when: Uses the SMB share as a "mirror" of files uploaded directly to the bucket via the Xona UI, CLI, or API. (Note: If SMB copy is set to "Approved" but the "Require approval" bucket setting is turned off, this will automatically revert to "Uploaded to CSG").
  • Ingested Files as Approved: Automatically approves files for download if the bucket requires approvals.
  • Delete remote files after ingesting: Removes the file from the origin server once successfully imported.
  • Delete files from the SMB when deleted from the CSG: Ensures that files are removed from the SMB share when they are deleted from the appliance File Bucket. (Note: If you change the Path or Share value while this is enabled, any file matching the name of a file known to the File Bucket will be wiped from the SMB server).

Limitations and Troubleshooting

Domain Controller Limitations: Given the stringent default Group Policies set for Windows Server Domain Controllers, Xona highly recommends against enabling the "Delete files from the SMB" or "Delete remote files after ingesting" features if your share is hosted directly on a Domain Controller. The Group Policy changes required to make those features work significantly increase security risks; you should use an SMB share on a standard domain-joined server instead.

Troubleshooting: Insufficient Number of Connections (Windows 10 / Windows 11) If you are syncing to a desktop-specific edition of Microsoft Windows (like Windows 11), you may notice files are not ingesting and the Logs show the following error:

error establishing SMB connection; please configure the SMB server to allow more connections for the given SMB user

To resolve this connection limit on the Windows endpoint:

  1. Open the Registry Editor on the Windows machine.
  2. Locate the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.
  3. Set the value of CachedLogonsCount to a higher number (e.g., 50).
  4. Wait for the next 15-second ingestion run to occur, then check the Xona Logs again to verify success.