Bastion can't reach a VM in a spoke
Problem
Admins can't reach vm-spoke1 through Bastion bas-hub.
Your job
- Get bas-hub reaching vm-spoke1 on 22
Without breaking
- Stop vm-jump from reaching vm-spoke1 on 22broken
Background
Bastion bas-hub (Basic SKU) in the hub works for hub VMs. Admins can't get to vm-spoke1 through it. vnet-spoke1 is peered to the hub, and its NSG, nsg-spoke1, was written to allow SSH from the hub's old jump box subnet. Admins should come in only through Bastion now, so vm-jump, the old jump box, must lose SSH to vm-spoke1.
How to work it
- 1See it fail
This traffic starts outside the lab VMs, so you can't log in to test it. Watch it instead.
Tap Explain on the red line under the map.
Ticks off when you tap Explain on the broken line.
- 2Find where it stops
- 3Name the cause
- 4Fix it and test again
- 5Explain it
Sources on Microsoft Learn (3)
0/2 changes
Network map
?
- Resource group, the outer dashed frame
- Virtual network, with its address space top right
- Subnet, with range and usable IPs (5 reserved)
- Network security group. A small shield on a VM's NIC means the NIC has one too
- Route table on the subnet
- VM Appliance Private endpoint
- Peering Connected Initiated or access off
- Goal working Goal broken, X marks where it stops
- Private DNS zone, dotted lines go to linked VNets
- Orange pulse: what your last command changed. Drag to pan, Ctrl and scroll to zoom.
bas-hub → vm-spoke1:22should work: not workingvm-jump → vm-spoke1:22should stay blocked: blocked
Goals 0/3
Cloud Shell · bashVMsrg-lab · eastus2
cloudshell:~$