hello everyone in this video I'm going over a Azure Bastion
hello everyone my name is Travis and this is Ciraltos I was on a much-needed
vacation when a azure bastion went into public preview and I'm a little bit late
to the game on this video but as I always like to say the early bird may
get that worm but the second Mouse gets the cheese before we begin please take a
second to subscribe it'll be more rewarding to me than this fish I caught
let's start with what a bastion host is and why it's important a bastion host is
a secure purpose-built server that sits between the public and internal network
in this case it acts like a jump box allowing secure connection to servers on
an internal network Azure bastion is a purpose-built PaaS jump box that
provides connectivity to servers in an Azure environment if you're familiar with
Windows Remote Desktop Services it's kind of like the web gateway but with
some extra cloud goodness first it's a purpose-built paas offering secured and
kept up to date by Microsoft users connect to the servers directly through
the portal no RDP or SSH client required it offers
multi-platform multi browser support with almost any html5 client there's no
need to give servers a public IP address for this to work
although the bastion server does need a public IP the azure documentation
provides a good diagram of how all this works a user logs into the portal and
from there they can access as your bastion as your Bashan is connected to
your private network providing access to servers on that network Azure manages the
network security groups for the bastion you can add a network security group to
the server subnet allowing RDP and ssh traffic only from the bastion but that's
not required keep in mind that a bastion is assigned to a vnet if you have
multiple VNets you'll need multiple bastions one for each VNet let's look
at prerequisites there's a few things needed before you can deploy a bastion
service you need a /27 or larger subnet named AzureBastionSubnet no
NSG's or routes can be assigned to the subnet in order to get to is your bastion
you have to use the aka.ms/BastionHost link to get to the portal
at the time of this recording this is not available in even the regular
preview portal and you need an html5 client the azure bastion has to reside
in the same region as the v-net it's connected to as of today the only
regions in preview are west US east US west europe south central us australia
east and japan east you no longer need to register for the preview you may find
references to the register-AzureRMpreviewfeature on blogs but you no
longer need to do that okay with that let's hit the demo buckle up everyone
it's demo time in this demo I'm gonna start out by adding the subnet for the
Azure Bastion after that I'm gonna create the bastion and then once that's
done I'm going to try to access it before I move on to that when I first
started preparing for this video there was some requirements posted that you
have to use the register-AzureRMProvider Feature
and register-AzureRMResourceProvider for the Microsoft network as a prerequisite for Azure
Bastion I don't see that in the documentation anymore and I reached out
to Microsoft they indicated that that is no longer needed so if you see any
documentation out there that has that listed evidently it's not required
anymore for the Azure Bastion preview ok let's move on to the azure subnet so
if I go into virtual networking and I'm gonna go into my West v-net my main
v-net is in central US that's where I keep most of my servers that's not in
the preview at this point so I'm going to use my other one which is in West and
that is in the preview azure bastion has to be in the same region as the VNet
so I'll go under subnets and I'm going to add a subnet and it has to be a
minimum of /27 I'll leave it as /24 and according to the
documentation it is required to have the name AzureBastionSubnet
and no security groups are routing tables that's another requirement
according to the documentation I'll leave service endpoints and subnet
delegation as it is and click OK that should just take a second to deploy
and there it is the next step I'm going to create the
Bastion at the time of this recording there's a couple of special requirements
around creating the Bastion it can't be done through the normal portal it also
can't be done through the typical preview portal Microsoft gave a URL
let's just paste it in here of aka.ms/BastionHost and again at the time
of this recording that is the required portal to use to set this up so let's go
there and it looks like the normal preview but I guess it's different so
I'm gonna create a resource and I'll search for Bastion and there it is
Bastion Preview so let's go to that I'm going to create I have a resource group
already set up called BastionDemoRG we'll call it Bastion demo and I'm gonna
use West US again because that is where my virtual network is located as you can
see it's in the West US and I only have the option for the West v-net so again
you don't see the VNet I have in central US and here you can see the
subnet name is Azure bastion subnet is the only one available and that one is
not the selected subnet is not supported I'm gonna leave the public IP address as
default and as you can see it only has static as an option so I'm just gonna
review and create I don't setup tags on my demos although tags are quite
important ok that's great and we'll give this some time to deploy and I'll be
back when it's done all right so that's complete that took about five minutes as
you can see under the duration to finish so I guess the next step now is to see
if it works so the first thing I'm going to do is go over to virtual machines and
I've got the demo one which happens to be a Windows OS let's see if RDP work
I'll go into connect and you can see I have the option of for RDP SSH and
Bastion so I'm going to keep it on bastion now before I do that I'm just gonna
real quick I'm kind of curious if I hop back to my regular portal go to virtual
machines I'm gonna do the same thing demo demo01 connect and yep as I
suspected so not only do you need that specific portal to create the Bashan you
also have to use that to access the Bashan that's fine this is preview it's
not GA so little quirks like that are expected so let me log in and I'll
connect well let me unblock my pop-ups and try again and look at that so this
is a freshly deployed OS I just did it a few minutes ago it may take a couple
seconds to get up here so I'll just pause alright so this is a new OS
installed it's the first time I logged in so it took a couple minutes but we're
here and as you can see it works just like you'd expect I've got a Start menu
pretty straightforward I'm not gonna go into the OS that's not what this is
about but there is one little handle here that's different that I just want
to go over underneath it there's two items
there's a text copy-paste between the Bashan and the localhost and then
fullscreen let's hit this full screen first as you'd expect it goes into full
screen okay so that's full screen mode so let's exit out of full screen and
there we have it I'm gonna close let me just log off there we go
so that is RDP into a Windows server using Azure Bastion now that we have
that done let's go over to my virtual machines we're going to go into demo 2
which is running Linux OS and I'll click connect I do have
set for password not SSH key but you can see there's different options here SSH
private key and SSH private key from a local file so I can enter the private
key here or I can go to it go to a path
ok that's it so I'm in let me just take a look at the IP settings just to show
it's working as you can see I only have one network
card and that only has a private IP so as far as RDP know to this the only
option I have is that public route through the bastion host let me log out
Oh wrong command there we go and I'll close it again ok so there it is that is
how you create the Azure Bastion subnet create the Azure Bastion service in
the azure bastion preview portal and then use the bastion to connect to both
a Windows and a Linux OS using RTP and SSH that's it for the demo ok one final
item pricing at the time of this recording the price is point zero nine
five cents US per hour plus transfer fees the first five gigs per month being
free this is a special half off price for the preview I hope you found this
helpful please take a second to subscribe and click the bell icon for
notifications of new content thanks for watching