Azure Bastion: no more public RDP and SSH

Let the CLI install the Bastion extension by itself, and start both VMs:

az config set extension.use_dynamic_install=yes_without_prompt
az vm start --resource-group rg-saat-vms --name web01
az vm start --resource-group rg-saat-vms --name win01

Part 1: Bastion Developer (no cost)

1Create a Developer Bastion

Run this (it takes seconds, not minutes):

az network bastion create --resource-group rg-saat-core --name bas-saat-dev --sku Developer --vnet-name vnet-saat --location centralindia --tags course=saatvedha-azure lesson=27 keep=true -o none
az network bastion show --resource-group rg-saat-core --name bas-saat-dev --query "{name:name, sku:sku.name, state:provisioningState}" -o table

You should see this:

Name          Sku        State
------------  ---------  ---------
bas-saat-dev  Developer  Succeeded

2SSH to web01 from the portal

In the portal, open web01, then Connect, then Bastion. Choose Authentication type “SSH Private Key from Local File”, username azureuser, and your key file from C:\Users\<you>\.ssh\id_rsa. Click Connect.

In the browser terminal, run:

hostname; ip -4 -br addr show eth0

You should see something like this:

web01
eth0             UP             10.30.1.4/24

3RDP to win01 from the portal

Close the web01 tab first: Developer allows one VM at a time. Open win01, Connect, Bastion, and sign in with the admin name and password you set in Lesson 16. Server Core opens a command prompt; type hostname.

Part 2: Bastion Standard with native client (paid, about 35 US cents)

4Create AzureBastionSubnet and its NSG

The subnet name must be exactly AzureBastionSubnet. Create the NSG with Microsoft’s required rules, then attach it:

az network vnet subnet create --resource-group rg-saat-core --vnet-name vnet-saat --name AzureBastionSubnet --address-prefixes 10.30.250.0/26 -o none
$rules = @(
    @('AllowHttpsInbound',             100, 'Inbound',  'Internet',          '*',              '443'),
    @('AllowGatewayManagerInbound',    110, 'Inbound',  'GatewayManager',    '*',              '443'),
    @('AllowAzureLoadBalancerInbound', 120, 'Inbound',  'AzureLoadBalancer', '*',              '443'),
    @('AllowBastionHostCommunication', 130, 'Inbound',  'VirtualNetwork',    'VirtualNetwork', '8080 5701'),
    @('AllowSshRdpOutbound',           100, 'Outbound', '*',                 'VirtualNetwork', '22 3389'),
    @('AllowAzureCloudOutbound',       110, 'Outbound', '*',                 'AzureCloud',     '443'),
    @('AllowBastionCommunication',     120, 'Outbound', 'VirtualNetwork',    'VirtualNetwork', '8080 5701'),
    @('AllowHttpOutbound',             130, 'Outbound', '*',                 'Internet',       '80')
)
az network nsg create --resource-group rg-saat-core --name nsg-saat-bastion --tags course=saatvedha-azure lesson=27 keep=true -o none
foreach ($x in $rules) {
    az network nsg rule create --resource-group rg-saat-core --nsg-name nsg-saat-bastion --name $x[0] --priority $x[1] --direction $x[2] --source-address-prefixes $x[3] --destination-address-prefixes $x[4] --destination-port-ranges ($x[5] -split ' ') --protocol '*' --access Allow -o none
}
az network vnet subnet update --resource-group rg-saat-core --vnet-name vnet-saat --name AzureBastionSubnet --network-security-group nsg-saat-bastion -o none
az network nsg rule list --resource-group rg-saat-core --nsg-name nsg-saat-bastion --query "length([])"

You should see this:

8

5Swap the Developer Bastion for Standard

One Bastion per VNet, so remove the Developer one first. The Standard deployment takes about 10 minutes:

az network bastion delete --resource-group rg-saat-core --name bas-saat-dev
az network public-ip create --resource-group rg-saat-core --name pip-saat-bastion --sku Standard --location centralindia --tags course=saatvedha-azure lesson=27 -o none
az network bastion create --resource-group rg-saat-core --name bas-saat --sku Standard --vnet-name vnet-saat --public-ip-address pip-saat-bastion --enable-tunneling true --location centralindia --tags course=saatvedha-azure lesson=27 -o none
az network bastion show --resource-group rg-saat-core --name bas-saat --query "{name:name, sku:sku.name, tunneling:enableTunneling, state:provisioningState}" -o table

You should see this:

Name      Sku       Tunneling    State
--------  --------  -----------  ---------
bas-saat  Standard  True         Succeeded

6SSH from your own terminal

Run this, then type the commands inside the session:

$web01 = az vm show --resource-group rg-saat-vms --name web01 --query id -o tsv
az network bastion ssh --name bas-saat --resource-group rg-saat-core --target-resource-id $web01 --auth-type ssh-key --username azureuser --ssh-key $HOME\.ssh\id_rsa

Inside the session you should see something like this:

azureuser@web01:~$ hostname
web01
azureuser@web01:~$ exit

✅ Checkpoint: You reached web01 and win01 with no public IP on either, first from the portal and then from your own terminal.