>> Hey friends. Do you know that using
a Bastion host can help limit
threats such as port scanning and other types
of malware targeting your VMs.
Azure Bastion gives you secure and seamless RDP and SSH access to
your Virtual Machines from the Azure Portal using
SSL without any exposure through public IP addresses.
Ashish is here to show me how today on Azure Friday.
[MUSIC].
>> Hey friends I'm Scott and it's Azure Friday.
I'm talking with Ashish about
Azure Bastion. I already like the name.
This sounds like a great thing because
the Bastion is like the last bastion.
It's that wall that keeps
the bad guys from getting into your castle.
Is that a good analogy?
>> Yes. Absolutely. Azure Bastion is
specifically designed to be
provisioned at the perimeter of your network,
to specifically guard your Virtual Machines
inside the Virtual Network.
>> So do most people just make
a Virtual Machine and expose the ports directly to the outside?
>> So typically what customers go about accessing the VMs,
especially in Cloud environments is either
they expose their VMs to public IPs,
which is considered as a significant threat surface
or they go ahead and provision jump boxes,
which is the RDP into those jump boxes first
and then from there on RDP to the target VM.
>> Really. That seems like a bad idea, the double RDP.
It seems inefficient and it doesn't
seem like a very clean solution.
>> Absolutely. That experience itself is jarring.
Also on top of that,
because it's customer provision Jump box,
customers are expected to manage, monitor, provision,
harden it, secure it,
managers availability, and redundancy.
So it becomes a lot of challenge
creating their Jump box and managing it on an ongoing basis.
>> Okay. So that's a hack to do
that Jump box as well as multiple passwords and all the things,
and if it becomes compromised and it's no jump box at all,
what's the right thing to do?
What is Azure Bastion?
>> So Azure Bastion is a fully managed service.
So customers don't have to worry about creating
these Jump boxes and managing them on their own.
Azure Bastion, once you provision it,
it gets into your Virtual Network, and from there on,
it's a managed solution that customers can use to RDP and
SSH to their VMs without exposing those VMs to public IPs,
and it all happens with
a single click expedience right in the Azure portal itself.
>> Wow. Okay. Is it an invisible manage reverse proxy?
Or how is the magic done?
>> So it has a set of stuff running inside the Azure Bastion.
Internally, Azure Bastion is a VM scale set and it
has the capability to resize
itself as more number of sessions come in.
It runs an application server as well as a set of Teams,
which are responsible of brokering
the remote session to the customers directly in the Azure portal.
>> Do you recommend this to anyone who has a couple of
Virtual Machines that are exposed
currently to public IP addresses?
>> Absolutely. So if anyone has
Virtual Machines in there watching device that they
want to RDPs to,
we would recommend Azure Bastion as a way to access all of them.
>> This is easy to setup?
>> It's just a couple of clicks
and get going with setting Azure Bastion in your Virtual Network.
>> Cool. Do you have a slide to show me?
Or do you want to make one?
>> Yes sure.
So if you see here,
Azure Bastion is provision in your Virtual Network.
So the box that you see on
the right side is customer's Virtual Network.
Once customer says that I want an Azure Bastion,
what happens is that we provision Azure Bastion
inside customers Virtual Network
in a subnet called Azure Bastion subnet.
Now, when the customer says I wanted to connect,
what happens is that the connection request
comes to Azure Bastion,
which is here and Azure Bastion then
initiates RDP or SSH session to the target VMs.
The idea is that you want to contain the RDP or
SSH protocol within the customer's Virtual Network.
So you never have RDP packets
going outside your Virtual Network or public Wifi.
>> Interesting. Okay.
>> So what Bastion does is that it takes the session packets,
transform it into a custom protocol,
put it in HTTPS,
and then send it over to public wired over for free.
So you don't expose the remote protocol over public Internet.
>> Interesting. So we know RDP ports and RDP itself never leaves,
which gives them much smaller attack surface.
>> Absolutely. Azure Bastion will give you
an RDP-SSH session always on your target VMs private IP address.
So even if your VM had a public IP address due to whatever reason,
Azure Bastion and will never hit
that to give you any more session.
It will always use a target VMs private IP address.
>> Interesting. What is the experience like for
someone who's used to opening
the remote desktop connection app and they think
that they're just going to type in
an IP address and hit "Connect"?
>> So today what we support is with Azure Bastion.
Customers comes to Azure portal,
go to the target VM, click on "Connect."
We integrate right there with
the connect experience in the Azure portal,
and that's where customers can get to their sessions.
Going forward, we will add support for native plant experiences,
where customers can use their desktop applications like MSTSE,
or RDCMan,
or other such client applications that
directly get to the VMs using Azure Bastion.
>> Okay. Then you would automatically create in
the future a download file
and then they can immediately download that,
run into the Remote Desktop Connection.
>> Exactly.
>> Okay. A onetime usage login.
>> Absolutely.
>> That's really cool. Can we do a demo?
>> Yes. Let me quickly show it to you.
So today to create an Azure Bastion,
in Azure portal you can search for a new resource type,
which we call as Azure Bastion
and it's currently in public preview.
So you will see this preview written in brackets.
But once you search for Azure Bastion,
you'll see in the marketplace an Azure Bastion resource.
You go ahead and click on "Create",
and it has a couple of settings that you can provide.
You can provide a resource group.
You can provide your Bastion name,
the region, and then the Virtual Network and the public IP.
You can use an existing one or create
a new one, and that's pretty much it.
Just a couple of settings and you're good to go.
So what I have here is a Bastion provision in my Virtual Network.
So the VNet that you see here is my VNet,
and what I have here is a set of VMs in my Virtual Network.
I have a Win VM and I have a Linux VM.
Now, let's go to Win VM.
As you will see here,
there is no public IP on my VM.
It only has a private IP.
>> So it is not exposed in any way
to the public or the open Internet.
>> Absolutely. So we've integrated Azure Bastion with connect.
So we click on "Connect" and you will
see that Bastion option figures here.
Then here, what you can do is quickly enter your credentials.
I'm going to enter mine and click on "Connect" and you will
see that an RDP session opens right here quickly.
So because Bastion is part of your Virtual Network itself,
it can very quickly reach
the target VM and give you the RDP session.
>> I understand also that for auditing purposes,
you can do video.
So if you're concerned that someone might be
attacking something or you just want complete control on auditing,
you can be recording everything someone is doing.
>> Exactly. So that features currently is in private preview.
But really the idea is that enabling customers to be able
to audit who logged onto what VM and did what.
Today, if customers were to do that,
the way to do that is,
they login to the VMs,
they go to the event where, they go to the audit logs,
and from those logs,
they get best educated guess
of what could have happened in the VM.
So the idea is that the video recording
gives them a quick view of what happened in
the session instead of going through all of those tons of logs.
>> That's a really interesting way to think about it
because in the past,
RDP is an extremely opaque thing.
There's a port that is open, you trust people.
If they got the password,
they've got keys to the castle to use
your Bastion analogy and now here there's really a wall.
There's a control to
make sure that if someone gets into our castle,
they are supposed to be there,
we're auditing what they're doing,
possibly in the future, recording what they're doing,
and making sure that they can do their job,
but also we as the security professionals can do our job.
>> Absolutely. Spot on.
Let me quickly also show you the Linux experience as well.
So if I have a Linux VM,
again you would notice here that there is
no public IP on the Linux experience on the same VNET.
I click on "Connect" and then I go to
the Bastion option and enter my credentials here.
We support SSH keys as well.
So if you have Odyssey keys that are already configured on
your VMs and you want to use that, you could use that too.
Here, you can go in and enter
your password and click on
"Connect" and you will get to your SSH session.
>> That's also an in-browser experience?
>> Exactly. So the idea is you have
an in-browser experience that's over HTTPS.
So you don't have to worry about what
protocols are going over my public internet.
It's all going through Bastion,
through the single point of entry,
which is he Bastion itself and all on HTTPS.
>> So you said that this is in preview right now,
but you encourage people to sign up and try it out?
>> We have thousands of customers already
trying it out and we're getting great feedback,
very motivating and very encouraging.
>> You've got big plans for the future that we talked about.
>> Yes. Absolutely.
>> So people can go and find this by going into the portal,
going to the marketplace, putting in Bastion,
and then following the process that you just went through.
>> Absolutely.
>> Fantastic.
This sounds like a really exciting product. All right.
I'm learning all about Azure Bastion and how to protect
my castle today on Azure Friday.
[MUSIC].