We were able to solve this by just using an entirely different address space for bastion in its own vnet and subnet. So there are no routes in any UDR for this network so it will use vnet peering.
Azure Bastion and hub/spoke with UDRs
We have a hub and spoke architecture with Bastion deployed in the hub. On the spoke side we're forcing all traffic to an NVA in the hub with a UDR. When I detach the UDR from the subnet that the destination spoke VM is in, I'm able to connect in with Bastion with no problem. Re-attaching the UDR breaks it again.
Can't seem to find info from MS about this. Thinking something has to be added to the UDR. I don't see any service tags for Bastion and I tried using the Bastion subnet as the prefix destination but not sure what the next hop would be. Has anyone got this work?
Thanks.
Azure Bastion
Azure Virtual Network
3 answers
Sort by: Most helpful
-
-
SaiGunaranjan 1 Reputation point
2022-07-16T22:17:04.277+00:00 Hi @CS10NET
Based on the following document, I am not sure if the scenario you described if supported currently.
Ref : https://learn.microsoft.com/en-us/azure/bastion/bastion-faq#udr
If the response helped, please don't forget to accept answer and up-vote - Sai
-
Andreas Baumgarten 123.7K Reputation points MVP Volunteer Moderator
2022-07-16T23:12:38.27+00:00 Hi @CS10NET ,
based on the information of the link above UDRs aren't supported in the Bastion subnet.
In a similar environment we are using a "jump host VM" in the same vNet with the Bastion subnet. Connecting to the "jump host VM" via Bastion is possible and from the jump host we are able to connect to any other VM in all the hub and spoke vents/subnets.
Maybe using a "jump host VM" is an option for you as well.----------
(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)
Regards
Andreas Baumgarten