Azure Bastion and hub/spoke with UDRs

CS10NET 86 Reputation points
2022-07-15T20:50:47.613+00:00

We have a hub and spoke architecture with Bastion deployed in the hub. On the spoke side we're forcing all traffic to an NVA in the hub with a UDR. When I detach the UDR from the subnet that the destination spoke VM is in, I'm able to connect in with Bastion with no problem. Re-attaching the UDR breaks it again.

Can't seem to find info from MS about this. Thinking something has to be added to the UDR. I don't see any service tags for Bastion and I tried using the Bastion subnet as the prefix destination but not sure what the next hop would be. Has anyone got this work?

Thanks.

Azure Bastion
Azure Bastion
An Azure service that provides private and fully managed Remote Desktop Protocol (RDP) and Secure Shell (SSH) access to virtual machines.
293 questions
Azure Virtual Network
Azure Virtual Network
An Azure networking service that is used to provision private networks and optionally to connect to on-premises datacenters.
2,777 questions
{count} votes

3 answers

Sort by: Most helpful
  1. CS10NET 86 Reputation points
    2022-07-19T12:52:22.277+00:00

    We were able to solve this by just using an entirely different address space for bastion in its own vnet and subnet. So there are no routes in any UDR for this network so it will use vnet peering.

    1 person found this answer helpful.

  2. SaiGunaranjan 1 Reputation point
    2022-07-16T22:17:04.277+00:00

    Hi @CS10NET

    Based on the following document, I am not sure if the scenario you described if supported currently.

    Ref : https://learn.microsoft.com/en-us/azure/bastion/bastion-faq#udr

    If the response helped, please don't forget to accept answer and up-vote - Sai

    0 comments No comments

  3. Andreas Baumgarten 123.7K Reputation points MVP Volunteer Moderator
    2022-07-16T23:12:38.27+00:00

    Hi @CS10NET ,

    based on the information of the link above UDRs aren't supported in the Bastion subnet.
    In a similar environment we are using a "jump host VM" in the same vNet with the Bastion subnet. Connecting to the "jump host VM" via Bastion is possible and from the jump host we are able to connect to any other VM in all the hub and spoke vents/subnets.
    Maybe using a "jump host VM" is an option for you as well.

    ----------

    (If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

    Regards
    Andreas Baumgarten

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.