Bastion deployment fails
Problem
Bastion bas-hub won't deploy, so admins can't SSH to vm-app.
Your job
- Get Bastion bas-hub reaching vm-app on 22
Without breaking
- Keep SSH (22) from vm-client to vm-app blockedbroken
Background
Security removed every public IP from the VMs. Admins need SSH to vm-app through Azure Bastion instead. Someone started: there's a subnet called BastionSubnet, and a Standard public IP called pip-bastion in westus. Deploy Bastion bas-hub in vnet-hub so it can reach vm-app on 22. vm-client, in subnet-client, must not reach vm-app on 22.
How to work it
- 1See it fail
This traffic starts outside the lab VMs, so you can't log in to test it. Watch it instead.
Tap Explain on the red line under the map.
Ticks off when you tap Explain on the broken line.
- 2Find where it stops
- 3Fix it and test again
- 4Explain it
0/5 changes
Network map
?
- Resource group, the outer dashed frame
- Virtual network, with its address space top right
- Subnet, with range and usable IPs (5 reserved)
- Network security group. A small shield on a VM's NIC means the NIC has one too
- Route table on the subnet
- VM Appliance Private endpoint
- Peering Connected Initiated or access off
- Goal working Goal broken, X marks where it stops
- Private DNS zone, dotted lines go to linked VNets
- Orange pulse: what your last command changed. Drag to pan, Ctrl and scroll to zoom.
Goals 0/3
Cloud Shell · bashVMsrg-lab · eastus2
cloudshell:~$