Enable Azure File Shares SMB Over QUIC

QUIC only in the Azure Edition

Microsoft is therefore positioning SMB over QUIC for so-called edge file servers. These are servers that are accessible from outside and typically run in the cloud or in the DMZ of the local network.

However, Windows Server 2022 reserves SMB over QUIC for the new Datacenter: Azure Edition. As expected, this is available in the Microsoft cloud. It can also be run on-prem, but only in a VM on Azure Stack HCI. A normal Hyper-V server is thus left out for no technical reason.

Win ACME

Installation Win-ACME

• Download the latest version of the program from this website. 
• Unzip files to a non-temporary folder, so that the scheduled task will be able to run. We recommend using %programfiles%/win-acme or c:/win-acme.
• Run wacs.exe (this requires administrator privileges).
• Follow the instructions on the screen to configure your first renewal.

From my testing using Azure Windows Admin Center, this configuration window will not show up. I am not able to get same screen as Microsoft Learn page: https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-over-quic

If you are having same problem, you can check next section for doing same thing using command line commands.

Enabling SMB over QUIC From Command Line 

By default, SMB over QUIC has been enabled on Win 2022 Azure Edition, but it was not assosicated with any certificate(s).

PS C:/Users/netsec> Get-SmbServerConfiguration |select EnableSMBQUIC, RestrictNamedPipeAccessViaQuic, DisableSmbEncryptionOnSecureConnection

EnableSMBQUIC RestrictNamedPipeAccessViaQuic DisableSmbEncryptionOnSecureConnection
------------- ------------------------------ --------------------------------------
 True True True

$CertName = 'quic.bestit.eu.org'
$Thumbprint = '2fa7c3a0cf7d7155aafde7aa8f2d0d8bf2391e44'
$MyCertDnsNamesToAllow = @('quic.bestit.eu.org')
$Subject = 'CN=quic'
$DisplayName = 'quic.bestit.eu.org'
Foreach ($DnsName in $MyCertDnsNamesToAllow ){
New-SmbServerCertificateMapping -Name $DnsName -Thumbprint $Thumbprint -StoreName My -subject $Subject -DisplayName $DisplayName -Type QUIC -Flags None
}

PS C:/Users/ns> Get-SmbServerCertificateMapping
Name Subject Thumbprint DisplayName StoreName Type Flags
---- ------- ---------- ----------- --------- ---- -----
quic.bestit.eu.org CN=quic.bestit.eu.org 2fa7c3a0cf7d7155aafde7aa8f2d0d8bf2391e44 [Manual] quic.bestit.eu.org @ 2023/1/1 14:12:14 My QUIC None

PS C:/Users/ns>

After verified the certificate has been mapped to your SMB over QUIC configuraiton, you will find the result also from WAC (Windows Admin Center):

Connect Shares Using SMB over QUIC from Windows 11 Client

After you made a share from your Winodws 2022 Azure Edition Server, you can try this now. To make sure we are going to use SMB over QUIC, you need to make sure your Windows Azure Firewall blocking tcp 445. 

Only Windows 11 supported. Windows 10 stll not supporting and no ETA when it will be , as Jan 2023. 

In following screenshot, it shows UDP 443 has been opened (SMB over QUIC). And DenyAllInBound rule will block tcp 445 (Normal SMB traffic).

By default if a Windows Client SMB connection cannot be established via TCP 445 , the client automatically switches to QUIC. Admins can force this behavior by blocking TCP:445 in the firewall.

As an alternative, a network drive can be mapped on the client such that SMB over QUIC is explicitly activated. To do so, use the new switch /transport: quic for net use and the TransportType QUIC parameter with the New-SmbMapping cmdlet.

C:/Users/admin>net use * //quic.bestit.eu.org/test /TRANSPORT:QUIC
Enter the user name for 'quic.bestit.eu.org': administrator1
Enter the password for quic.bestit.eu.org:
Drive Z: is now connected to //quic.bestit.eu.org/test.

The command completed successfully.


C:/Users/admin>netstat -na | find "443"
 TCP 10.10.1.130:49676 52.226.139.121:443 ESTABLISHED
 TCP 10.10.1.130:49766 52.226.139.180:443 ESTABLISHED
 UDP 0.0.0.0:50293 20.203.193.13:443
 UDP [::]:50293 [::ffff:20.203.193.13]:443

C:/Users/admin>

Testing Speed Performance for SMB over 445