Hello, I created a test environment in preparation for a live environment and I am having trouble connecting to my virtual machines from the Bastion Host. Configuration： One VNET with 3 subnets. All the subnets have NSGs associated to them. Bastion host subnet also with NSG associated. VMs configured to use ssh keys during loging. I downloaded the private key to my local environment. Passwords for Vms not configured (Do I need to configure passwords?). What I have done so far: Connection troubleshooting from Bastion to both VMs via port 22 ended with the status "Reachable". Connection troubleshooting from Bastion to both Vms via port 3389 ends with the status "Unreachable". ssh azureuser@

Hello @Prrudram-MSFT Thank for all your guidance. The problem has been resolved. I needed a global IP address to access the servers. Once I allowed it at the subnet nsg, I was able to connect to the servers. Thank you once again.

SSH to VM from Bastion Host Failed.

Jessie 85

Hello,

I created a test environment in preparation for a live environment and I am having trouble connecting to my virtual machines from the Bastion Host.

Configuration：

One VNET with 3 subnets. All the subnets have NSGs associated to them.
Bastion host subnet also with NSG associated.
VMs configured to use ssh keys during loging. I downloaded the private key to my local environment.
Passwords for Vms not configured (Do I need to configure passwords?).

What I have done so far:

Connection troubleshooting from Bastion to both VMs via port 22 ended with the status "Reachable".
Connection troubleshooting from Bastion to both Vms via port 3389 ends with the status "Unreachable".

ssh azureuser@

Prrudram-MSFT 26,686 Reputation points

2024-11-13T07:19:47.83+00:00

Hello @Jessie

Thank you for reaching out with your query on Microsoft Learn Q&A

Based on the information you provided, it seems like there may be a few issues that could be causing the connection problems you're experiencing. Here are a few things you can check:

Check the NSG rules: Make sure that the NSG rules associated with the subnets and VMs allow inbound traffic on the ports you're trying to connect to (port 22 for SSH and port 3389 for RDP). You can check this by going to the Azure portal, selecting the NSG, and reviewing the inbound security rules.

Check the network security group rules for the Bastion subnet: Make sure that the NSG rules associated with the Bastion subnet allow inbound traffic on the ports you're trying to connect to (port 22 for SSH and port 3389 for RDP). You can check this by going to the Azure portal, selecting the NSG, and reviewing the inbound security rules.

Check the private key: Make sure that the private key you downloaded is correct and matches the public key associated with the VM. You can check this by going to the Azure portal, selecting the VM, and reviewing the SSH public key configuration.

Check the VM status: Make sure that the VM is running and has a valid IP address. You can check this by going to the Azure portal, selecting the VM, and reviewing the VM status and IP address.

Check the SSH service: Make sure that the SSH service is running on the VM and is configured to allow inbound traffic on port 22. You can check this by logging into the VM using the Azure portal and reviewing the SSH service configuration.

Check the RDP service: Make sure that the RDP service is running on the VM and is configured to allow inbound traffic on port 3389. You can check this by logging into the VM using the Azure portal and reviewing the RDP service configuration.

Check the network connectivity: Make sure that there are no network connectivity issues between the Bastion host and the VMs. You can check this by running a network connectivity test from the Bastion host to the VMs using the Azure portal.

If you've checked all of these things and are still having trouble connecting to the VMs, you may want to consider opening a support ticket with Microsoft Azure support for further assistance.

Let me know if you need further assistance
Prrudram-MSFT 26,686 Reputation points

2024-11-15T08:17:04.0033333+00:00

Hi @Jessie Did you get a chance to review above response. If yes, did you make any progress with this issue? Let me know I am here to help.
Jessie 85 Reputation points

2024-11-15T08:29:17.79+00:00
Hello @Prrudram-MSFT

Thank you for responding to my request for support.

After trying the above solutions your proffered, I still had problems with the connection.

I plan on re-configuring the environment and would appreciate your support with the right configuration steps.

Environment Image:

Virtual network with access to the internet via NAT.

3 subnets (each with NSG associated).

Access to virtual machines via Bastion Host in the same Vnet with the private ssh key downloaded from Azure.

Private Endpoint links to all subnets.

Access from client PC will pass through VPN gateway and Private Endpoint to the VMs using Entra ID.Thank you.
Prrudram-MSFT 26,686 Reputation points

2024-11-15T15:45:46.0833333+00:00

@Jessie

I'm sorry to hear that the previous solutions didn't work for you. I'll be happy to help you with the configuration steps for your new environment.

Here are the steps you can follow to configure your environment:

Create a virtual network with three subnets. Each subnet should have its own NSG associated with it.

Create a Bastion Host in the same virtual network. You can use the Azure portal to create the Bastion Host. During the creation process, you can specify the virtual network and subnet where you want to deploy the Bastion Host.

Configure the NSGs for each subnet to allow inbound traffic on port 22 for SSH connections and port 3389 for RDP connections. You can do this by creating inbound security rules on the NSGs.

Create a NAT gateway to provide internet access to your virtual network. You can use the Azure portal to create the NAT gateway. During the creation process, you can specify the virtual network and subnet where you want to deploy the NAT gateway.

Create a private endpoint for each subnet. You can use the Azure portal to create the private endpoint. During the creation process, you can specify the virtual network, subnet, and the resource you want to connect to.

Download the private SSH key from Azure and use it to connect to your virtual machines via the Bastion Host.

Configure a VPN gateway to allow access from your client PC. You can use the Azure portal to create the VPN gateway. During the creation process, you can specify the virtual network and subnet where you want to deploy the VPN gateway.

Configure Entra ID to allow access to the VMs via the VPN gateway and private endpoint.

I hope this helps! Let me know if you have any further questions.
Prrudram-MSFT 26,686 Reputation points

2024-11-18T08:31:35.5833333+00:00

Hi @Jessie

Did you get a chance to review above response. If it helps, please upvote the same.
Jessie 85 Reputation points

2024-11-22T04:22:14.0233333+00:00

@Prrudram-MSFT

Thank you for responding.

I have reviewed your recommendation above and still cant connect to the VMs.

At this point, I am only trying to connect to the VMs via Bastion first trying internet connection with NAT Gateway and Endpoints.

----------------------------------------------------------------------------------------------------

Environment:

-NSGs associated to subnets configured to allow traffic from both Bastion to the VMs and the reverse.

-Bastion Host deployed.

-Virtual machines are configured without public IP addresses.

-Linux VM deployed to use SSH key. Private key already downloaded.

-NSG associated to bastion allows connections as specified in the below document.

https://learn.microsoft.com/en-us/azure/bastion/bastion-nsg

What am I missing?
Prrudram-MSFT 26,686 Reputation points

2024-11-22T04:50:21.85+00:00

Hi @Jessie
This requires deeper troubleshooting over a remote session. I would recommend reaching out to technical support by creating a support ticket with Azure VM team. If you don't have an active support plan, let me know.

1 answer

Jessie 85 Reputation points

2024-11-25T00:10:45.2966667+00:00

Hello @Prrudram-MSFT

Thank for all your guidance.

The problem has been resolved.

I needed a global IP address to access the servers. Once I allowed it at the subnet nsg, I was able to connect to the servers.

Thank you once again.
Please sign in to rate this answer.
Prrudram-MSFT 26,686 Reputation points

2024-11-25T04:18:24.61+00:00

Hi @Jessie Thanks for the update. I am glad to know it resolved the issue.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

SSH to VM from Bastion Host Failed.

1 answer

Your answer