Azure Files Authorization Mounting Question with Private Endpoint

Question

Azure Files Authorization Mounting Question with Private Endpoint

Phil Bailey 21

Hi

I am testing out Azure Files with Private Endpoint with AD DS Authorization. Everything seems to be working fine EXCEPT I can't figure our HOW this is using my private endpoint! I've followed all the instructions. I have name resolution working to the private endpoint and I can telnet to port 445 on it. I did a tracert and it goes across our Express Route connection...so I know I am good.

The very last step in the instructions has completely thrown me. Under the "Mount File share page" here: [storage-files-identity-ad-ds-mount-file-share][1]
There is a script that reads:

$connectTestResult = Test-NetConnection -ComputerName <storage-account-name>.file.core.windows.net -Port 445
if ($connectTestResult.TcpTestSucceeded)
{

WHY would I mount the file share using the NON private DNS name? It doesn't make any sense. I nslookup that name and obviously it's going to the Public IP so my traffic will go that way, which I don't want.

So, i thought that must be wrong in the instructions, I will mount using the privatelink address.. NOPE doesn't work. only <storageaccount>.file.core.windows.net works (as it says in the instructions!)

Can someone please explain this to me as I cannot see how Azure files is using my Private Endpoint at all!

Thanks

Tom Luxton 81 Reputation points

2023-06-02T11:45:05.47+00:00

I came to the same conclusion after many hours. I can't understand why I can't authenticate against the private DNS Zone despite it's showing as an alias when running Resolve-DnsName, returning the same internal IP.

I wondered if it relates to the 'Doesn't Support using CNAME to mount file shares' as defined in:
https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-enable#supported-scenarios-and-restrictions

I couldn't see your reference 'Always mount your share using.file.core.windows.net, even if you setup a private endpoint for your share.' anywhere. Can you please share more information?

Accepted answer

3 additional answers

Your answer

Tom Luxton 81 Reputation points

2023-06-02T11:45:05.47+00:00

I came to the same conclusion after many hours. I can't understand why I can't authenticate against the private DNS Zone despite it's showing as an alias when running Resolve-DnsName, returning the same internal IP.

I wondered if it relates to the 'Doesn't Support using CNAME to mount file shares' as defined in:
https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-enable#supported-scenarios-and-restrictions

I couldn't see your reference 'Always mount your share using.file.core.windows.net, even if you setup a private endpoint for your share.' anywhere. Can you please share more information?

Answer 1

Initially I claimed that Azure private endpoints use CNAMES on the public DNS and that CNAMES are not supported, referring the following document:
https://learn.microsoft.com/en-us/azure/storage/files/storage-files-identity-auth-active-directory-enable#supported-scenarios-and-restrictions

However, I realised the documentation was referring to publicDNS (which was working), but CNAMES in Azure are supported. This contradiction was raised around 12/06/2023 and resulted in the first documentation being updated:

https://github.com/MicrosoftDocs/azure-docs/issues/110635

The only outstanding reference now to explain why this doesn't work with private DNS is this article:

Always mount Azure file shares using file.core.windows.net, even if you set up a private endpoint for your share. Using CNAME for file share mount isn't supported for identity-based authentication.
https://github.com/MicrosoftDocs/azure-docs/blob/main/includes/storage-files-aad-permissions-and-mounting.md

Answer 2

Phil Bailey 21

On further investigation this seems to be working when my Internal AD DNS servers are handling the name resolution. However when my internal OpenDNS are handling the resolution its failing and going to Public Azure. Even though my OpenDNS Servers are set to forward the privatelink.file.core.windows.net back to my local resolvers for resolution. I have opened up a case with OpenDNS

SaiKishor-MSFT 17,336 Reputation points

2022-07-21T05:45:38.78+00:00

@Phil Bailey Thanks for updating!

As you mentioned and as the documentation states-

"When using a custom or on-premises DNS server, you should configure your DNS server to resolve the storage account name in the privatelink subdomain to the private endpoint IP address. You can do this by delegating the privatelink subdomain to the private DNS zone of the VNet or by configuring the DNS zone on your DNS server and adding the DNS A records."

From what you mentioned, itseems like you are using the second method i.e., by configuring DNS zone on your DNS server. Ideally this should work as long as long as the OpenDNS server forwards this request to your local resolvers where the A record is created.

Please do let us know the outcome of your case with OpenDNS team and please do let us know if you need any help from us and we will be happy to assist further. Thank you!

Answer 3

Phil Bailey 21

So everything works great if i only use Windows DNS. If I use my Umbrella VA which is supposed to forward queries back to my Windows DNS servers it doesn't work. It's almost like it doesn't like the double hop

SaiKishor-MSFT 17,336 Reputation points

2022-07-27T20:17:42.087+00:00

@Phil Bailey Thanks for updating! Can you determine if the query actually is forwarded to the Windows DNS and if it responds to the query by doing some traffic captures and filtering for the DNS (port 53) traffic?

Answer 4

Phil Bailey 21

Yes thank you. I finally figured that out and everything is working great. I'm using the new Private Resolver and it is working great!

Share via

Azure Files Authorization Mounting Question with Private Endpoint

Always mount your share using.file.core.windows.net, even if you setup a private endpoint for your share.

3 additional answers

Your answer