Azure File Share Mount SMB on Windows - Connection error

Question

Hi,

One of our Clients is attempting to mount SMB Azure File Share on their windows machines. This worked with no issues on two PCS in the UK but in Poland it's having trouble... When Mounting the drive in File Explorer the drive seems to connect as it accepts the password but then gives up. So we tried using the Test-NetConnection cmdlet and it failed but again with not much information... We turned off the firewall on the Windows PC and Port 445 is enabled. Here are the errors we got in Powershell:

WARNING: TCP connect to (IP : 445) failed

ComputerName : "StorageName".file.core.windows.net
RemoteAddress : "ip"
RemotePort : 445
InterfaceAlias : Ethernet
SourceAddress : "ip"
PingSucceeded : False
PingReplyDetails (RTT) : 0 ms
TcpTestSucceeded : False

Any ideas? Do users in countries outside of the regional zone have to do anything extra to connect?

On premise Windows V: Windows 10
On Premise Location: Poland
Storage Unit Zone: UK South

Cheers

Answer 1

@Anonymous Thanks for the update! SMB has always been a network file sharing protocol. As such, SMB requires network ports on a computer or server to enable communication to other systems. SMB uses either IP Port 445 . 445 is an important port because it is used by default for all SMB communication. Windows uses it for various functions since SMB serves as the network protocol at the application level.

You can talk to the ISP to check if they can allow all communication to URLS ".file.core.windows.net " (Suffix used for storage accounts) and ".store.core.windows.net" (Suffix used by the storage stamp).

Resolution:
Solution 1 - Use Azure File Sync
Azure File Sync can transform your on-premises Windows Server into a quick cache of your Azure file share. You can use any protocol that's available on Windows Server to access your data locally, including SMB, NFS, and FTPS. Azure File Sync works over port 443 and can thus be used as a workaround to access Azure Files from clients that have port 445 blocked. Learn how to setup Azure File Sync.

Solution 2 - Use VPN
By Setting up a VPN to your specific Storage Account, the traffic will go through a secure tunnel as opposed to over the internet. Follow the instructions to setup VPN to access Azure Files from Windows.

Solution 3 - Unblock port 445 with help of your ISP/IT Admin
Work with your IT department or ISP to open port 445 outbound to Azure IP ranges.

Solution 4 - Use REST API based tools like Storage Explorer/Powershell
Azure Files also supports REST in addition to SMB. REST access works over port 443 (standard tcp). There are various tools that are written using REST API which enable rich UI experience. Storage Explorer is one of them. Download and Install Storage Explorer and connect to your file share backed by Azure Files. You can also use PowerShell which also user REST API.

Additional information: You can mount the file share on your local machine by using the SMB 3.0 protocol, or you can use tools like Storage Explorer to access files in your file share. From your application, you can use storage client libraries, REST APIs, PowerShell, or Azure CLI to access your files in the Azure file share.

Azure Files only allows connections using SMB 3.0 (with encryption support) from outside the region or datacenter. SMB 3.0 protocol has introduced many security features including channel encryption which is very secure to use over internet. However its possible that port 445 has been blocked due to historical reasons of vulnerabilities found in lower SMB versions. In ideal case, the port should be blocked for only for SMB 1.0 traffic and SMB 1.0 should be turned off on all clients.

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

Azure Files only allows connections using SMB 3.0 (with encryption support) from outside the region or datacenter.

This could be the reason for the issue your client is facing. Make sure to use SMB 3.X
Also, good to check with ISP, if they block port 445 due to some vulnerabilities reported in past

----------

--please don't forget to upvote and Accept as answer if the reply is helpful--

Answer 3

@Anonymous Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

Adding more information to the above response!

As per your output TcpTestsucceeded: failed

If the connection was successful, you should see the following output:

ComputerName : <your-storage-account-name>
RemoteAddress : <storage-account-ip-address>
RemotePort : 445
InterfaceAlias : <your-network-interface>
SourceAddress : <your-ip-address>
TcpTestSucceeded : True

Refer to this article there are multiple resolution , If the port 445 is blocked https://learn.microsoft.com/en-us/azure/storage/files/storage-troubleshoot-windows-file-connection-problems?tabs=azure-portal

Please let us know if you have any further queries. I’m happy to assist you further.

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.