Not able to connect to my VM via bastion

Question

Not able to connect to my VM via bastion. Getting "Network connection to the bastion appears to be unstable". Any suggestion please?

Answer 1

I found a fix. This exact same problem showed up for us on August 3rd, and we had not touched anything in Azure related to this. It appears that Microsoft must have automatically added a new rule over the weekend to block access to port 3389 for our VM. This is how I fixed it, so try this: Go to your VM in the Azure Portal, go to the "Networking/Network Settings" section, and look for a rule named something like "MicrosoftDefenderForClout-JITRule_-XXXX..." that denies access to port 3389, and delete that rule. Then try bastion again and it will hopefully work.

Answer 2

The error usually points to a connectivity problem either between the browser and Azure Bastion, or between Azure Bastion and the target VM.

Try these checks in order:

1. In the Azure portal, open the Azure Bastion resource and go to Help > Connection Troubleshoot.
   • Check a TCP connection from the source to the target VM.
   • If the check fails, it helps identify whether the issue is network-related.
2. Check for a black screen or unstable session symptoms caused by browser-to-Bastion connectivity.
   • Client internet firewalls can block WebSockets traffic.
   • Allow WebSockets traffic on the client-side firewall or proxy.
3. Check NSGs on both sides.
   • Review the NSG on AzureBastionSubnet.
   • Review the NSG on the target VM subnet or NIC.
   • The VM subnet NSG must allow inbound 3389 for Windows or 22 for Linux from the AzureBastionSubnet range.
   • If a deny rule blocks that traffic, add an allow rule with a lower priority number than the deny rule so it is evaluated first.
4. If connecting on a custom port, verify that:
   • The Bastion SKU is Standard or higher.
   • That exact custom port is open on the VM subnet NSG.
   • The guest OS is listening on that port.
   • The guest OS firewall allows that port.
5. If the network path is allowed but the session still fails, check the guest OS service.
   • For Windows, confirm RDP is running and listening on port 3389.
   • For Linux, confirm SSH is running and listening on port 22, or the configured custom port.
6. If Just-in-time (JIT) access is enabled, verify the user has these permissions:
   • Microsoft.Security/locations/jitNetworkAccessPolicies/read
   • Microsoft.Security/locations/jitNetworkAccessPolicies/write
7. If a session shows "Your session has expired" before it starts, begin the session again from the Azure portal instead of reusing a direct session URL from another tab or browser session.

If the issue is specifically intermittent or appears as an unstable Bastion connection, the most likely checks from the documented causes are:

• client firewall/proxy blocking WebSockets
• NSG rules blocking Bastion-to-VM traffic
• custom port not opened end-to-end
• RDP/SSH service or guest firewall on the VM

---

• Troubleshoot Azure Bastion problems
• Troubleshoot Azure Bastion connectivity problems
• Troubleshoot Azure Bastion connection failures caused by blocked ports
• Troubleshoot Azure Bastion session failures due to unhealthy target VMs
• The network connection to the Bastion Host appears unstable - Microsoft Q&A