Master Azure Bastion: Fast Setup or Full Control

Quick Setup (Automatic Deployment)

Navigate to the Virtual Machine (VM)

1. Sign in to the Azure Portal.
2. From the left-hand menu, select Virtual Machines.
3. Locate and click on the VM you want to connect to securely.

Access the Connect Option

1. On the VM’s overview page, click the Connect button at the top.
2. A dropdown menu or side panel will display the connection options.

Select Bastion as the Connection Method

1. In the connection panel, click the Bastion tab (next to RDP and SSH).
   • This tab enables a secure connection through Azure Bastion.
2. Alternatively, find Bastion under the Connect section in the left-hand menu.

• Locate Dedicated Deployment Options

  1. If Bastion is not set up, scroll to the Bastion configuration section.
  2. You’ll see a prompt to deploy Azure Bastion with available options.

  Choose Between Automatic or Manual Deployment

  Azure Bastion offers two setup approaches:

  • Automatic Deployment:
    • Azure provisions the Bastion host with default settings.
    • Includes a public IP, a dedicated subnet (AzureBastionSubnet), and recommended configurations.
    • For this guide, select Automatic Deployment.

Test the Connection via Bastion

1. Return to the VM’s Connect page and select the Bastion tab again.
2. Enter the credentials used when creating the VM.
3. If a pop-up window is blocked during the Bastion connection, allow it at the top of your screen.

Remove the Public VM IP Address

1. If the Bastion connection is successful, you can remove the VM’s public IP to enhance security.
2. Go to the VM’s Networking settings in the Azure Portal.
3. Select the network interface, then disassociate the public IP address under IP configurations.
4. Save the changes and test the Bastion connection again to confirm the VM remains accessible.

Full Manual Configuration

Access the Bastion Service

• Sign in to the Azure Portal at portal.azure.com.
• Select Bastion from the left-hand menu or search for "Bastion" using the top search bar.

Navigate to Bastion

• In the left-hand menu, select Bastion.

• If it's not visible, use the search bar and type "Bastion" to locate it.

Initiate Bastion Deployment

• Click Create to set up a new Bastion resource.
• Choose your Subscription and Resource Group.

Configure Bastion Settings

• Name: Enter a unique name for the Bastion host.
• Region: Select the same region as your VM for best performance.

Virtual Network and Subnet:

• Choose an existing virtual network (VNet) or create a new one.
• Ensure a subnet named AzureBastionSubnet exists with at least a /26 CIDR range (e.g., 10.0.1.0/26).
• If needed, create the subnet in the VNet’s Subnets section.

Public IP Address

• Select Create new or use an existing public IP.
• Name the IP (e.g., Bastion-PIP).

Additional Settings (Optional)

• SKU: Choose Basic or Standard based on your needs.
• Optional Features: Enable native client support or IP-based connections (Standard SKU only).

Review and Validate

• Click Review + Create to validate your configuration.

• Resolve any issues (e.g., missing subnet or invalid CIDR) before proceeding.

Deploy Bastion

• Once validated, click Create to deploy the Bastion resource.

• The deployment usually takes a few minutes. You can monitor the progress in the Azure Portal.

Connect to the VM via Bastion

• Go to Virtual Machines and select your target VM.

• Click Connect and choose the Bastion tab.

• Enter the VM credentials (username and password or SSH key).

• Click Connect to establish a secure session through Bastion.

• If a pop-up is blocked by the browser, allow it at the top of the screen.

Verify and Test

• Confirm that the connection is successful and functioning as expected.

Remove the Public VM IP Address

1. If the Bastion connection is successful, you can remove the VM’s public IP to enhance security.
2. Go to the VM’s Networking settings in the Azure Portal.
3. Select the network interface, then disassociate the public IP address under IP configurations.
4. Save the changes and test the Bastion connection again to confirm the VM remains accessible.