Jacob Maslow
SMB over QUIC is an innovative solution that enables secure remote file access without the need for a VPN. This solution was first launched in Windows Server 2022, but was only available in the Azure edition. This limitation reduced the use of SMB over QUIC to organizations that used Azure cloud services.
One of the significant changes in Windows Server 2025 is the expansion of SMB over QUIC availability to Datacenter and Standard editions. This expansion allows more organizations to benefit from secure remote file access, regardless of VPNs. Organizations can now use SMB over QUIC to protect their file traffic with end-to-end encryption, while maintaining flexibility and accessibility.
Contents
How does SMB over QUIC provide secure file access?
SMB over QUIC is a modern alternative to TCP-based SMB, designed for secure file sharing over untrusted networks, such as the public internet. Instead of using TCP/445, this protocol uses UDP/443, leveraging TLS 1.3 certificates for encryption and authentication. A significant advantage is that passwords are not required for authentication, which increases the level of security.
All SMB traffic, including authentication, multi-channeling, and compression, remains encrypted, while seamlessly passing through edge firewalls. This means that data is protected all the way from the server to the client, without potential vulnerabilities. In addition, the user experience remains unchanged, so users can access and share files seamlessly, as if they were connected to a secure local network.
The transition to UDP/443 also helps bypass common network limitations, as this port is commonly used for HTTPS traffic, and is therefore less likely to be blocked by firewalls or internet service providers. The use of TLS 1.3 certificates ensures a high level of encryption, as well as providing robust authentication mechanisms, protecting against man-in-the-middle attacks and other intrusion attempts.
How has Windows Server 2025 changed the availability of SMB over QUIC?
Until the launch of Windows Server 2025, SMB over QUIC was exclusively available in the Azure edition of Windows Server 2022. This limitation created a situation where organizations using Standard or Datacenter editions had to rely on traditional SMB over TCP/445, which required the use of a VPN for secure remote access. This solution was more cumbersome and required maintenance of VPN infrastructure, which added costs and operational complications.
Windows Server 2025 brings a significant change by including SMB over QUIC in the Datacenter and Standard editions as well. This means that more organizations can now deploy a secure SMB solution without a VPN, and protect their SMB traffic with end-to-end encryption using TLS 1.3. This change simplifies the process of remote file access, and reduces reliance on complex VPN infrastructure.
The expanded availability of SMB over QUIC allows organizations to increase the security of their file sharing while maintaining flexibility and ease of use. The new solution provides an additional layer of protection against cyber threats, allowing employees to access files securely from anywhere without needing a VPN connection. In addition, SMB over QUIC helps reduce operating costs by eliminating the need to maintain VPN infrastructure.
In summary, Windows Server 2025 opens a new era of secure remote file access by making SMB over QUIC accessible to all organizations, regardless of the server edition they use. For more information, read about SMB over QUIC.
What are the best practices for using SMB over QUIC?
Active Directory domains should be used for SMB over QUIC. It is recommended to keep the default setting of incoming UDP/443 unless a change is required. If possible, read-only domain controllers should be used. Incoming TCP/445 should not be allowed to the file server. Avoid using IP addresses in the SMB over QUIC certificate SAN, as this requires the use of NTLM instead of more secure Kerberos authentication.
What is the summary and conclusion regarding SMB over QUIC?
In summary, SMB over QUIC offers secure file access without the need for a VPN. With Windows Server 2025, it is available to a wider audience. It is important to properly configure TLS 1.3 certificates and follow the recommendations to maximize security. SMB over QUIC is expected to become an increasingly common solution given its many advantages.
businessnewstips
Clay Leger
