I have enabled Point-to-Site connectivity to a virtual network in my Azure environment. I am able to remotely connect to the VPN tunnel and can ping the private address of the Azure virtual machine. I can also RDP into the server. The problem is that I am not able to access file shares. On this virtual network we also have a site-to-site vpn up so that the office can access the server. The site-to-site is working fine. The users can access the shared folders, query DNS, and authenticate against AD. Does anyone have any idea why ICMP and RDP would work over the point-to-site VPN but file share browsing would not? I have confirmed that DNS is resolving correctly.
I tested it in my lab and I encountered same issue with you.
Here are the steps how I solve this issue.
First, I perform a network capture on the Server side.
I find that it is the server which wants to disconnect the session. And the error code is "STATUS_MORE_PROCESSING_REQUIRED", which means that additional authentication information is to be exchanged.
I suspect that the client is using the credential of the VPN to access the shared folder on server. So I create a VPN profile manually and set the UseRasCredentials to 0. The path of the PBK file is "%userprofile%\AppData\Roaming\Microsoft\Network\Connections\Pbk\rasphone.pbk".
Then my client is able to access the file share.
If it isn't your situation, you are also able to start troubleshooting by performing a network capture first.
To manually create a VPN profile, we need to find the host name of Azure network gateway. The host name is logged in the rasphone.pbk mentioned above. Note: we need to install the profile downloaded from the Azure first, so the configuration will be written to the rasphone.pbk.
Then, we just need to create a SSTP VPN profile with this hostname. The authentication method is "Microsoft:Smart Card or other certificate ---> Use a certificate on this computer".
The following key did the trick for me
This is the resolve because when you connect with a Certificate you are not taking an identity on the VPN as you would if you used the AzureAD logon.
After setting this the connection to a resource after vpn connects will prompt for creds so you can say who you are.
**** This is not good in the case of security and troubleshooting. All users can have cert and you will not know exactly who is having issues or if cert was shared. Anyone with certs installed can connect.