Deploy Azure Bastion

Admins should SSH to vm-app in vnet-hub without it having a public IP. AzureBastionSubnet (10.0.7.0/26) and a Standard public IP, pip-bastion, are ready, and nsg-app already allows 22 from the Bastion subnet. Deploy Bastion bas-hub.

1. Deploy Bastion.

   az network bastion create -g rg-lab --name bas-hub --vnet-name vnet-hub --public-ip-address pip-bastion --sku BasicType it
   What's this?

   Creates Azure Bastion, which lets you reach VMs over SSH or RDP without exposing them to the internet. It needs its own subnet named AzureBastionSubnet.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change
   • --vnet-name the virtual network
   • --vnet-name vnet-hub the VNet that has AzureBastionSubnet
   • --sku Basic Basic, Standard, Premium or Developer

2. Check that vm-app lets Bastion in on 22.

   az network watcher test-ip-flow -g rg-lab --vm vm-app --direction Inbound --protocol TCP --local 10.0.1.4:22 --remote 10.0.7.4:*Type it
   What's this?

   Checks whether one packet is allowed or denied to or from a VM, and names the security rule that decided. Use it for security rule problems.

   • -g the resource group the resources live in
   • --vm the virtual machine to test from
   • --direction Inbound for traffic coming in to the VM, Outbound for traffic leaving it
   • --protocol TCP or UDP
   • --local the VM's own IP and port
   • --remote the other side's IP and port (* means any port)

3. Answer the question below.

   What's the smallest size AzureBastionSubnet can be?

   Azure Bastion

   Lets you reach VMs over SSH or RDP from the portal, without opening them to the internet. It lives in a subnet named AzureBastionSubnet.

   Check