Root Cause: Security Settings
This is most certainly because the Synology NAS only supports NTLM authentication and the workstation refuses to use NTLM. This behavior is configured through the Windows security policies editor.
How to fix it
Open a command line (cmd.exe) with administrative rights. Then type in secpol.msc, hit enter. This is one of many methods to launch the security policies editor.
Navigate to Security Settings -> Local Policies -> Security Options. The right side will show a number of security options. Locate the option Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers. If this option is marked as "deny all" the trace will look exactly as the one that you have provided.
Dirty details
Part 1: Negotiate Protocol Request Your workstation offers the latest and greatest in SMB dialects, up to and including SMB 3.1.1. It also promises to use all the bells and whistles offered by SMB3, if only the server would play along: Large MTU, directory leasing, encryption, compression.
These details are specified in the field smb2.capabilities and the Negotiate Contexts provided in the request.
Part 2: Negotiate Protocol Response The server selects SMB 2.0.2, which is the oldest version of SMB 2, going back to Windows Vista / Server 2008. Remarkably the server supports signing smb1.sec_mode.sign_enabled is set to 1, but does not insist (required = 0). As this matches the clients request it will not lead to a broken connection.
The interesting part comes in the Security Blob provided by the server. Note that the server only offers one method for authentication: NTLMSSP. A domain joined server would also offer Kerberos.
Since the workstation refuses to use NTLM but insist on "something else" the handshake cannot continue.
Disclaimer
The default NTLM settings would allow the connection. Since this is denied in your case someone has changed the settings.
If your workstation is a domain member this was most likely configured by your domain administrator. You cannot override the settings chosen by your domain admin. In this case you (or more likely your domain administrator) need to change the configuration using the group policy editor.
Or (if your Synology firmware supports the configuration) you can join the NAS to the domain.
Good luck
Eddi
A (reasonable) guess would be that the PC doesn't like the Negotiate Protocol Response. Sharing a capture with that packet would be very helpful. What OS is the PC running?
Here it is in the original post. Let me know if you want to expand anything. Not sure what I should be looking at.
You've shown us a screenshot of the RST, ACK which is the client closing the connection. What we really need to see id the SMB Negotiation in a format that allows inspection, i.e. a Wireshark capture.
Please share the capture using a public share such as Goggle Drive, DropBox etc. and post a link to it back here.
Hi, here's the link I notice from comparing a working and non working capture, that the working one has some NTLM information in the Negotiate protocol request, while the non working one (which is the link above) doesn't have. Not sure of the significance.
I think you'll have to wait for an SMB expert to take a look. The response looks OK to me, albeit only version SMB 2.0.2, so an older version, but the client does say that's supported in its request.