Domino Consulting - HCL Domino Administrator 11.0.1 Help

PLANNING

Planning the NetBIOS network

The HCL Domino® network is compatible with NetBIOS, a set of IBM® session-layer LAN services that has evolved into a standard interface that applications use to access transport-layer network protocols.

Domino supports the NetBIOS interface on Microsoft™ Windows™ systems over the following transport protocols: TCP/IP (on systems running TCP/IP) and NetBEUI (supplied with all Microsoft network products).

Note: Although you can add some NetBIOS services to Linux™ and UNIX™ systems, NRPC communication does not use them.

Deciding whether to use NetBIOS services

Including NetBIOS in the Domino network has both benefits and risks. The benefits are as follows:

NetBIOS has low overhead relative to other protocol suites. NetBIOS over NetBEUI has the least overhead; and NetBIOS over TCP/IP has the most.
Because it is not directly routable, NetBIOS over NetBEUI can provide a secure means to access your server for administration within a flat network. To access the server over a routed IP network, you can create a data-link switching (DLSw) tunnel to limit the administration access with NetBIOS over NetBEUI.
Because NetBIOS name-to-address resolution services offer dynamic registration by name broadcasts, you can use NetBIOS to build a remote Domino network for temporary or emergency use.

The risks of using NetBIOS involve the security of the file system on Domino servers. Depending on the access permissions of the operating system and on the transport protocol being used, NetBIOS name and file services might allow users to see or access the server's file system. When a server provides NRPC services, mitigate this risk by disabling the NetBIOS name and file services (SMB/CIFS) on the system so that the system's name cannot be seen over the network. Other HCL Notes® and Domino systems can still find the Domino server because Domino has its own NetBIOS name service to propagate and register the Domino server's NetBIOS name, but access is secure because it is controlled by the authentication and certification features in NRPC.

If the system on which you run Domino requires NetBIOS name or authentication services, mitigate the security risk by isolating the NetBIOS services. Install an additional NIC on the system for NetBIOS over a private administration network, and disable NetBIOS on the NIC that the Domino server uses.

How to tell if NetBIOS is active on a system

The following are indications that NetBIOS is active:

On Windows systems, you can see or access another Windows system's file system through the Network Neighborhood (indicates Server Message Block/NetBIOS).
You can register with an NT domain (indicates Server Message Block/NetBIOS).
On Windows 2000 or XP systems, NetBIOS over IP is selected in the system's TCP/IP protocol settings.

Note: On Linux and UNIX systems, the SAMBA server service (Windows file server) can offer Server Message Block/NetBIOS or Common Internet File System/IP access, or both.

Server name-to-address resolution over NetBIOS

When an HCL Notes workstation or HCL Domino server running NetBIOS tries to connect to a Domino server, the initiating system offers the destination server's common name to the NetBIOS name service, which then broadcasts that name and its associated network address over the NetBIOS network.

Parent topic: Planning

Related tasks
Server setup tasks specific to NetBIOS

Help on Help

All Help Contents

Help on Help

All Help Contents