As most of you know, it’s possible to provide a virtual machine in Azure with a public IP address. This IP address can then be used to build a connection to, for example, RDP or SSH.
This way of connecting takes place over the Internet, which entails a great security risk. In many environments we see jumpbox or stepping stone servers, which are placed in the DMZ. These servers can be accessed from the Internet, and from these servers a connection can be made to a server or multiple servers on the internal network.
Such an arrangement is not safe, unmanageable and vulnerable. Azure Bastion is a great addition to facilitate a secure connection to a virtual machine in Azure. Azure Bastion integrates into the Azure portal, requiring multi-factor authentication. The virtual machines do not need to have a public IP address, so they are not accessible directly from the Internet.
Azure Bastion is a fully managed, autoscaling and hardened PaaS service, to provide you secure RDP and SSH connectivity. It is easy to configure in just a few steps. By using virtual network peering, it’s possible to easily add Azure Bastion to an existing configuration in Azure.
- Configure a new virtual network for Azure Bastion
- Create a new subnet named ‘AzureBastionSubnet’ required for Azure Bastion
- Configure virtual network peering to your other networks
- Create an Azure Bastion host
- Login in the VM through the Azure portal using Azure Bastion
- See the list of active sessions in the Azure Bastion Host properties
Now you can securely connect through Azure Bastion to a virtual machine running RDP or SSH. As you can see, the virtual machine I’m connecting to has no public IP address, only a internal IP address.
