Nordlicht Reisen GmbH, a fictional travel agency, has two problems. Administrators can reach their servers only because every virtual machine has a public IP address and port 3389 or 22 is open. And the storage account holding the receipts answers anyone on the internet who knows the key. You are to close both: manage the machines through Azure Bastion, and reach the storage through service endpoints or private endpoints.
Prior knowledge: What public and private endpoints are is explained in "AZ-900 compact," lesson 2.4. Virtual networks and subnets are lesson 4.1, network security groups lesson 4.3, the storage firewall with its rules lesson 2.2, Azure DNS lesson 4.5. Here you learn how to set up the three tools and when to choose which.
Azure Bastion
Azure Bastion is a fully managed service (PaaS) through which you connect to your virtual machines by RDP or SSH, from the Azure portal or with the client on your computer. The connection runs over TLS on port 443. The machines need no public IP address, no agent and no special software; Bastion reaches them through their private address in the virtual network. That removes the open management door from the internet, and the machines are protected from port scans.
Bastion comes in four tiers (SKUs):
| Tier | Key points according to Microsoft |
|---|---|
| Developer | free, shared infrastructure, for development and testing, one VM at a time, only in selected regions, no peering |
| Basic | its own deployment with fixed capacity, for production with moderate demand |
| Standard | everything in Basic plus scaling and more features: client on your own computer (native client), shareable links, connection by IP address, custom ports, file transfer |
| Premium | everything in Standard plus session recording and fully private operation without a public IP address |
If you choose no tier, the default for az network bastion create is the Standard tier. Germany West Central is on Microsoft's list of regions for Bastion Developer; check the list before you start, because it changes.
For your own deployment (Basic, Standard, Premium) you need:
- a subnet with exactly the name AzureBastionSubnet, at least /26 in size, with no route table and no delegation. If it is named differently, Bastion is not deployed.
- a public IP address of the Standard tier in the same region (only Premium can work without one).
- to connect to the VM, at least the Reader role on the VM and on the network interface with the private address, plus an open port 3389 (Windows) or 22 (Linux) on the VM from the network.
Portal route: virtual network or VM → Connect → Bastion. Deploy Bastion creates Bastion with the default settings (Standard tier), Configure manually lets you choose tier, zones and number of instances; according to Microsoft, deployment takes about ten minutes. You connect from the VM through Connect → Bastion; the session opens in the browser. The names in the portal depend on the language setting.
Commands (Microsoft's example with the Basic tier):
az network vnet subnet create --name AzureBastionSubnet --resource-group <gruppe> `
--vnet-name <netz> --address-prefix 10.1.1.0/26
az network public-ip create --resource-group <gruppe> --name <ip-name> --sku Standard
az network bastion create --name <bastion-name> --public-ip-address <ip-name> `
--resource-group <gruppe> --vnet-name <netz> --location <region> --sku Basic
If you don't need the VM's public IP address otherwise, detach it from the network interface (Dissociate) and delete it afterward.
Cost: The hourly price runs from deployment, whether you connect or not; outbound data traffic comes on top (Developer is free). Microsoft recommends deleting Bastion after use for test purposes.
Azure Firewall, Web Application Firewall and DDoS Protection belong, like Bastion, to the Network Security service group and are not on the skills list.