Hello everyone, my name is Michael Aldridge
and I am a Program Manager on the Azure Bastion team.
I'm joined with my colleague today, Ankur,
who's going to be doing some demos for you later.
I'm really excited today to walk you through Azure Bastion
and outline how there's some new features in preview
and in GA, that we're excited to announce
that really piece together this idea of secure
and robust remote connectivity
for different enterprise applications.
So here's a quick overview
about what we're going to be looking at today.
I'm going to start with an understanding
of what Azure Bastion is.
And so I'll take you through an overview
of what the service does, how it's enabling remote RDP
and SSH connectivity for different enterprises.
We'll then look at some new capabilities
that we have with the GA of the Standard SKU.
And so specifically,
we're going to look at some infrastructure
scaling capabilities.
From there, we're going to be talking about
Vnet peering support
and how that really pieces together this idea
of a global footprint,
where Azure Bastion is able to manage connectivity.
From there, we'll talk about a really exciting feature
called IP-based connection.
This is going to highlight how Bastion
is actually able to extend outside
of an Azure virtual network
and to on-premises
and other non Azure networks.
And then from there,
I'll talk a little bit about native client support,
which is a really cool feature
that customers are able to take advantage of
and then Ankur I'll transition to him
and he can provide a demo
that will really wrap everything together.
So let's go ahead and get started.
This is Azure Bastion.
So there's a few things to note to start.
First, Azure Bastion is a fully managed remote RDP
and SSH connectivity as a service.
The really cool thing about Azure Bastion
is there's two things I want to highlight.
One, it's natively in the Portal.
So the idea is customers are deploying application VMs
globally in different Azure regions
that are serving different purposes.
Customers, enterprise users, IoT administrators
can log into the Azure Portal
and from there really seamlessly
and easily connect to these VMs via RDP
or SSH natively in the browser.
The other real value of Azure Bastion
is that it minimizes the public IP exposure.
In a world where enterprises
are not leveraging remote jumpbox services,
they're having to expose public IP addresses
throughout the network to enable connectivity
to those application VMs.
The magic with Azure Bastion
is there's one public IP address exposed
on the Bastion host.
And then as enterprises deploy application Vnets,
excuse me, applications
and local Vnets or peered Vnets,
Azure Bastion is able to manage connectivity from there
and provide that service.
So what I want to do now is take you from left to right
and outline how we user would leverage Bastion
to connect to the application.
And so on the left side, you see you have the user.
They're logging on to the Azure Portal.
They are using a client machine.
It can be a desktop, be a laptop, whatever that machine is,
and they're going to portal.azure.com.
From there, they able to navigate the different VMs
or VMSS instances that they're trying to access,
and they can click connect with Bastion.
At that point, once that experience is initiated,
the users connecting to the Azure Portal
via their web browser,
the web browsers is then establishing a connection
to Azure Bastion to the public IP address.
The great part about this is from there on out,
once users are connecting to different applications,
Bastion is managing all of that in the backend
using that private IP connectivity.
So what I'm trying to show you here,
like we mentioned at the beginning, is really two things.
One, Azure Bastion is native in the portal.
It's a seamless experience.
It's easy for customers to be able to navigate
to different application VMs natively in the portal.
And then second, it really minimizes that exposure
to public IP addresses,
which is critical as enterprises continue to shift
more resources to Azure.
So now I want to take a look at the new capabilities
that we're announcing with Azure Bastion.
So there's a couple to highlight here.
First, I want to talk about some features
we're excited to announce is generally available.
First is the Azure Bastion Standard SKU.
With the Standard SKU we are announcing
infrastructure scaling capabilities
and robust monitoring
and alerting with Azure monitor.
In addition, there's also some connection
troubleshooting experience native in the portal,
if customers want to try to understand
if Bastion has visibility or has access to a VM.
We're able to show that natively in the portal.
And then additionally, Vnet peering support
is something we've supported for a while.
The reason I'm bringing up peer again,
is it pieces together that idea of global connectivity
that I'm going to continue to talk about
throughout the presentation today.
Additionally, there's some exciting preview features
and even coming soon features
that we're excited to announce.
One of those is going to be IP-based connection.
And this is by far one of my favorite features.
And I'm going to deep dive into this in a little bit.
IP-based connection, it allows Bastion to extend
outside of the Azure virtual network.
And then additionally, native client support
is something we're really excited to talk about.
This is something that's going to be coming soon,
but I'm happy to share a few details today,
as we do a deep dive into what Azure Bastion looks like.
So let's go ahead
and start with infrastructure scaling.
Azure Bastion is an example of what we call
a hosted on behalf of resource.
What that means is customers and enterprise users
are deploying Azure Bastion to their Azure subscriptions
in their virtual networks associated to a sub-net
in a network that they own.
When that happens, Microsoft manages the infrastructure
that's running the Bastion service.
And so what infrastructure scaling allows
is it allows customers to really take advantage
of the platform as a service or the scaling capabilities
that are native to cloud platforms and cloud services.
When we first announced Bastion,
the infrastructure was more or less fixed.
So as customers deployed Bastion
and then as adoption or use of Bastion increased,
you could think about more applications
being accessed over Bastion,
or even the sessions themselves becoming more intense
with more computationally intensive workloads.
The infrastructure of the Bastion resource
was starting to be a constraint,
even a bottleneck in some scenarios.
So customers were coming to us and saying,
hey, I love this service.
I love the seamless access.
I love that it minimizes the public exposure of IPs,
and I'm not able to actually scale this
to meet the different enterprise needs I have.
So with infrastructure scaling,
we announced a capability where customers are able
to scale the virtual machines that Microsoft is hosting
to enable additional concurrent RDP and SSH connectivity.
Like I said, the real benefit of the cloud
is the ability to scale.
If a holiday season is approaching
and a retail company needs to increase the capacity
to serve that workload,
they can do this now with Azure Bastion.
Alternatively, if it's maybe a slow time during the year
and a customer needs to save on costs and scale down,
they can scale down the VMs that are facilitating
the Bastion connection to save on that cost
and that they have
and can maintain that full flexibility.
And next we're going to talk about
metrics monitoring and alerting.
We cannot offer scalable features
and the ability for a customer to scale the infrastructure,
unless we're exposing detailed granular metrics monitoring
and alerting that a customer can enable.
Azure Bastion is fully integrated with Azure monitor.
So as customers are scaling out the infrastructure,
maybe they're scaling from 10 to 20 instances,
maybe 40 down to 20 instances.
We can now show them the different sets of CPU utilization,
we can show the memory usage,
we can show them the availability, the performance,
and the saturation of the infrastructure
that's facilitating their service.
And so what we've noticed really with cloud services
is that as customers are adopting
and moving more applications
and more mission critical workloads to the cloud,
the need for robust metrics monitoring
and alerting is a critical ask.
Next we're going to talk about Vnet peering.
And so this is where we're going to start to piece together
that idea of global connectivity.
What Vnet peering enables
is this idea of that global connection
that Bastion is able to facilitate
to different application VMs.
Vnet peering fundamentally enables enterprises
to leverage a hub and spoke architecture.
Within a hub and spoke architecture
the main idea is enterprises
are able to centralize security functions,
can be a third-party NVA firewall,
maybe a first party Azure firewall.
If there's any hybrid network connections
like express route or VPN,
the gateways for those services are housed
and deployed to this virtual network that's the hub.
And now Azure Bastion is able to be deployed
in this central hub as well.
The main idea with the hub and spoke architecture
and what this feature allows for Bastion
is as customers are sending application traffic to Azure
or accessing applications in Azure,
that traffic transits the hub
before it reaches any application spoke Vnet.
So the idea is all centralized management security functions
sits in the hub as customers deploy
and manage additional applications in Azure,
they add applications to already existing networks,
or they peer additional networks increasing the footprint
and how applications are being served in Azure.
So with Vnet peering it allows a single deployment
of one Bastion to manage connectivity to all applications.
In this diagram right here,
you can see there's two separately peered Vnets.
Bastion is deployed in the hub network.
And if customers want to connect
via RDP to some applications
or SSH to some applications,
they're able to deploy that one Bastion
and have Bastion manage connectivity.
As new VMs are added, as new virtual networks are peered,
Bastion participates in the native Vnet routing
and is able to connect to the private IP address
of those virtual machines,
as customers manage and deploy those.
Next we're going to take a look at IP-based connection.
And like I said, at the beginning,
this is one of my favorite features.
Currently today, Azure Bastion is able to facilitate
global connectivity within Azure networks.
What IP-based connection allows
is that it extends Azure Bastion's connectivity
to on-premises or even to other cloud provider networks.
So what this really enables
is if a customer is running a multi-cloud strategy,
they can have on-premises there as well.
But if they have certain things on-premises,
certain things in other networks,
other cloud provider networks,
as long as there's a hybrid connection
between these networks to the Azure Bastion sub-net,
Bastion can manage connectivity to different applications.
This is something that Ankur is going to demo
a little bit later
but the main focus here is that customers
are able to input the private IP address
of an application VM.
From there Bastion can manage connectivity
as long as that network connectivity is present.
Next, we're going to look at native client support,
and this is going to be a fairly high level slide.
But the main idea here is as we've been developing Bastion
and trying to progress the service,
meet different enterprise needs,
we've noticed that some customers have very specific needs
and requirements that are currently functions
of the native clients that they're running.
And so the approach we're taking here
is as we continued to develop
features natively with Bastion,
as Bastion is able to serve connectivity
via the Azure Portal seamlessly,
we also, with this feature,
are enabling customers with Azure CLI
to allow Bastion connectivity,
to be done via a native client.
So customers are able to use a native RDP and SSH client,
whatever they have configured already,
maybe they're using the on-premises or in other scenarios,
they can now run Azure CLI commands
to allow Bastion to enable that connectivity.
So at this point, I know we've been through a lot,
the main idea of what I wanted to walk you through
was this idea of Bastion being able to securely
manage global connectivity
in Azure networks, in on-premises,
and also in other networks that customers may be managing.
So at this point, I'm going to hand it over to Ankur,
and he's going to walk us through a demo
of what we just talked about.
Thank you for that introduction, Michael.
Hi, I am Ankur Hayatnagarkar,
a Senior Developer in the Azure Bastion team.
With the introduction of Standard SKU,
we want to introduce a lot of cool features.
So without further ado, let's get straight into it.
The setup for the demo is as follows.
We have a virtual network
with a Bastion host deployed in it.
This virtual network is then connected
to the on-prem virtual network
via a virtual network gateway.
The on-prem virtual network has one virtual machine,
the on-prem-VM.
This has an IP address of 10.8.0.4.
The Bastion virtual network is also peered
to a virtual networks spoke,
which has two real Linux virtual machines deployed in it,
Linux RDP VM and Linux RDP port VM.
Now let's jump into the fun part.
As you can see the IP address
of the on-prem virtual network virtual machine is 10.8.0.4.
To connect to this,
after you have enabled the IP-based connection feature
on your Bastion host, a new plane,
the connect plane, should show up.
To connect all you need to do is enter the IP address
of the virtual machine to connect to,
which in this case is 10.8.0.4,
and select SSH, since it's a Linux machine,
enter your username.
You can save your SSH private key in key vault,
which is what I have done here
and click on connect.
And as you can see,
we are connected to the virtual machine.
For the Standard SKU of Bastion we also allow customers
the ability to select a custom protocol
and port for their connections,
which now allows us to RDP into Linux machines
provided the machine has already been set up
with an RDP server.
Let's see this new feature.
I have set up an RDP server on the Linux RDP VM,
which is in the Vnet spoke.
When we try to connect with the Standard SKU of Bastion,
we also get the option to select the connection settings,
which allows us to customize the protocol and port.
Selecting the RDP protocol automatically changes
the port to the default RDP port.
As you can see, after entering the credentials
and clicking connect,
we are now able to RDP into the Linux machine.
Another method of securing your virtual machines further
is to change the default RDP and SSH port
that is used to connect.
With the Standard SKU Bastion,
you also allow connections on non-standard ports.
The Linux RDP port VM has been set up with an RDP server
on a non-default port of 3380.
After entering the correct credentials
and the correct port,
we are now able to RDP into the new Linux machine
with the non-default port.
So these were a few of the cool features
which we have introduced with the new Bastion Standard SKU.
Hope you get to try out the new IP connect feature,
the custom protocol, the custom port feature
in the upcoming months
and hope this was an informative session.
Thank you.
-: Thank you for the demo Ankur.
I appreciate you all spending time with us today.
Learning about the new GA
and public preview features with Azure Bastion
and how it's enabling global
and secure connectivity to enterprise customers.
Thank you.