Azure Bastion host unreachable issue

Sakthivel M 0

I have created Azure vnet peering two vnets for bastion access, When tried to troubleshoot the bastion to VM from network watcher ip flow connection is allowed,but not able to connecting the VM through bastion remote. bastion error.png Azure bastion check ip flow.JPG

KapilAnanth-MSFT 35,246 Reputation points Microsoft Employee

2024-04-03T10:46:09.8633333+00:00
@Sakthivel M ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are trying to use Azure Bastion to RDP to an Azure VM.

Is the VM in the same VNET as the Bastion or a Peered VNET?

If you are trying for a VM in Peered VNET, Can you please confirm this works for a VM in the same VNET as Bastion (you can deploy a testVM in the Bastion VNET and check this)

From your IP Flow Connection, I see you have explicitly defined a Rule, "Allow_bastionRDP"

In that case, can you confirm that the entire AzureBastionSubnet's range is allowed in the Source IP and not just 10.1.1.6 IP Address.

If you are trying for a VM in same VNET as the Bastion and this is not working, make sure you adhere to the NSG Requirements as documented in both AzureBastionSubnet and Target VM Subnet

Cheers,

Kapil
Sakthivel M 0 Reputation points

2024-04-12T03:42:20.6666667+00:00
Hi Kapil,

Thanks for the details I am trying to connect peered Vnet VM through bastion. For costing issue we cannot create the testing VM.

I have allowed entire subnet in the source network :"Allow_bastionRDP"
KapilAnanth-MSFT 35,246 Reputation points Microsoft Employee

2024-04-12T05:32:38.8033333+00:00
@Sakthivel M ,

Thanks for the info.

However, without checking the RDP connectivity of the VM question, we cannot isolate the issue to be related to Bastion.

It is quite possible that the VM's OS level firewall (either Windows or a 3rd party) is blocking the RDP access despite the NSG allowing it at platform level.

To confirm that is not the case, you should be able to RDP to the VM without Bastion and the VM should be able to accept the RDP connection.

In your case, where you are not able to create a new dummyVM for testing,
1.you may attach a Public IP to your VM and see if RDP over internet succeeds.
2.try to RDP to this VM from an existing VM in your VM's VNET or peered VNET

Before Bastion, how were you accessing this VM? or is this VM a new deployment and you have not accessed it via RDP yet.

Do you have multiple VMs in the VNET (in the same VNET or peered VNET to Bastion).
1.If yes, are you able to access the others? i.e., is the issue isolated to this one target VM?

Cheers,

Kapil