How does User connect to the Bastion

Question

How does User connect to the Bastion

Banerjee, Somdutta 166

I am trying to understand something about connecting to a VM through a Bastion host.
First the user connects to the Azure Portal and authenticates- at this point Source is User IP address and destination is azure portal. So, Conditional Access, Authentication, RBAC etc. takes place at this stage.

Once the user navigates to the VM and connects through the Bastion host, what is the source now - is it azure portal or the source is User IP ? Please can you elaborate on the steps.

It is mentioned that NSG can be set at the AzureBastionSubnet from selected IP addresses, does it mean after authentication, the User is accessing the public endpoint of the Bastian directly? How does the Azure Portal connect to the Bastian host(considering it is public IP interface)?

Thank you for your help.

Accepted answer

0 additional answers

Your answer

Answer 1

JimmySalian-2011 42,511

Hi,

Please go through the learn module on Azure Bastion as this will assist you to understand the concept.

Here is a quick diagram on the flow.

You connect to a VM in the Azure portal. In the Azure portal, on the VM overview page, select Connect > Bastion > Use Bastion. Then enter your credentials for the VM.
Browser connects to the Azure Bastion host. The browser connects to Azure Bastion over the internet by using Transport Layer Security (TLS) and the public IP of the Azure Bastion host. Azure Gateway Manager manages portal connections to the Azure Bastion service on port 443 or 4443.
Bastion connects to the VM by using RDP or SSH. Azure Bastion is deployed in a separate subnet called AzureBastionSubnet within the virtual network. You create the subnet when you deploy Azure Bastion. The subnet can have address spaces with a /27 subnet mask or larger. Don't deploy other Azure resources to this subnet or change the subnet name.
Bastion streams the VM to the browser. Azure Bastion uses an HTML5-based web client that's automatically streamed to your local device. The Azure Bastion service packages the session information by using a custom protocol. The packages are transmitted through TLS.

Hope this helps.
JS

==
Please Accept the answer if the information helped you. This will help us and others in the community as well.

Banerjee, Somdutta 166 Reputation points

2022-11-17T13:29:45.817+00:00

Hi @JimmySalian-2011

Thank you so much for your response.
one clarification please-
At step 2 - 2. Browser connects to the Azure Bastion host. The browser connects to Azure Bastion over the internet by using Transport Layer Security (TLS) and the public IP of the Azure Bastion host. Azure Gateway Manager manages portal connections to the Azure Bastion service on port 443 or 4443.
Regarding this point - when we configure the NSG for the AzureBastianSubnet, In the Inbound rules we have the option to allow it from specific source IP addresses(customer public IP's). when does the application of Inbound NSG rule from specific IP's impact the flow?
GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator

2022-11-24T12:33:58.673+00:00

Hello @Banerjee, Somdutta ,

I'm not sure if I understand your question correctly but as soon as the NSG is applied to the AzureBastionSubnet, the inbound traffic is restricted and only the configured set of source public IPs are allowed to make a connection to the Bastion host over a browser.

Suppose your local machine's Public IP is x.x.x.x and you have added the NSG to AzureBastionSubnet for Ingress traffic where you have allowed only the IP address x.x.x.x, then whenever you enter the credentials for the VM within Azure portal, a browser will be opened on your local machine and a TLS session will be initiated and you will be able to connect to the Bastion because your Public IP is whitelisted to make a connection to the public IP of the Azure Bastion host. But if any other user with Public IP y.y.y.y tries to enter the credentials for this VM, it will fail in step 2.

The Azure portal access won't be affected for other users as the restriction is only set for AzureBastionSubnet. But they will not be able to initiate a connection to the Bastion host.
Hope this clarifies.

Regards,
Gita
Banerjee, Somdutta 166 Reputation points

2022-11-24T13:31:16.713+00:00

@GitaraniSharma-MSFT Thank you for the amazing explanation.
GitaraniSharma-MSFT 50,096 Reputation points Microsoft Employee Moderator

2022-11-24T13:42:08.517+00:00

My pleasure, @Banerjee, Somdutta .

Share via

How does User connect to the Bastion

0 additional answers

Your answer