Azure Bastion and hub/spoke with UDRs

Question

Azure Bastion and hub/spoke with UDRs

CS10NET 86

We have a hub and spoke architecture with Bastion deployed in the hub. On the spoke side we're forcing all traffic to an NVA in the hub with a UDR. When I detach the UDR from the subnet that the destination spoke VM is in, I'm able to connect in with Bastion with no problem. Re-attaching the UDR breaks it again.

Can't seem to find info from MS about this. Thinking something has to be added to the UDR. I don't see any service tags for Bastion and I tried using the Bastion subnet as the prefix destination but not sure what the next hop would be. Has anyone got this work?

Thanks.

KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2022-07-18T06:10:56.537+00:00

Hi @CS10NET ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are using UDR on subnets in spoke VNet(s) to force default traffic to an NVA in Hub and you would like to access the VMs in these Spoke subnet(s) using Bastion.

You are halfway there.
The trick is to set the nextHop as "VirtualNetwork" for the address range of the Bastion subnet in the spoke subnet(s).
Refer : https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

If the Bastion resource is in the same subnet as the spoke Vnet, no additional configuration is required.
However, should the Bastion resource be in a peered Vnet, you must make sure you have enabled "Traffic to remote virtual network" in the peering.
Refer : https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering

I hope this helps.
Please let us know should you have additional queries on the same.

Thanks,
Kapil

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
CS10NET 86 Reputation points

2022-07-18T13:05:24.62+00:00

This is exactly what I tried but when I look under Effective routes it shows the next hop as "None" and not "Virtual network".

So the UDR is attached to the subnet in the spoke that contains the VM I'm trying to access. The destination is Bastion subnet (which is in the hub) and next hop is set to Virtual network. When you click on the UDR, the Overview shows the hop as Virtual network and when you click on the Routes section, it displays it as VnetLocal.

It just seems off that the effective route is is not showing Virtual network to prove that the UDR is working. I have power cycled the VM too.
KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2022-07-19T10:14:38.113+00:00
Hi @CS10NET ,

You are right.
Apologies for the previous comment.

I checked this internally and I see the "VirtualNetwork" nextHop type in UDR does not include the address range of Peered Virtual Networks.

Refer : https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

The other way I can think of is to subnet the address prefix.
i.e,

Let's say your Hub Vnet has the range 10.0.0.0/16 and Bastion Subnet is 10.0.50.0/24

And you have various subnets, subnet1, subnet2........ as 10.0.1.0/24, 10.0.2.0/24 respectively

Currently, I assume you must have the Route configured as 10.0.0.0/16 ---------> NVA IP

Instead, you can add individual routes of the subnet such as subnet1(10.0.1.0/24) -----> NVA, subnet2(10.0.2.0/24) -----> NVA

And not add any routes for Bastion subnet.

But this would introduce the additional labor of configuring and managing all these routes.

However, if you do not have a requirement for traffic between Spoke and Hub to flow via the NVA, you can simply use a 0.0.0.0/0 -------> NVA route in the UDR.
This way, the Hub (including Bastion) routes would take the default route of Vnet Peering
Refer: https://azure.microsoft.com/en-in/blog/accessing-virtual-machines-behind-azure-firewall-with-azure-bastion/

I hope this provides some clarity.

Thanks,
Kapil
CS10NET 86 Reputation points

2022-07-19T12:49:41.243+00:00

Thanks, we were able to solve this by just using an entirely different address space for bastion in its own vnet and subnet. So there are no routes in any UDR for this network so it will use vnet peering.

Thanks for your help with this.

3 answers

Your answer

KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2022-07-18T06:10:56.537+00:00

Hi @CS10NET ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are using UDR on subnets in spoke VNet(s) to force default traffic to an NVA in Hub and you would like to access the VMs in these Spoke subnet(s) using Bastion.

You are halfway there.
The trick is to set the nextHop as "VirtualNetwork" for the address range of the Bastion subnet in the spoke subnet(s).
Refer : https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

If the Bastion resource is in the same subnet as the spoke Vnet, no additional configuration is required.
However, should the Bastion resource be in a peered Vnet, you must make sure you have enabled "Traffic to remote virtual network" in the peering.
Refer : https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-manage-peering

I hope this helps.
Please let us know should you have additional queries on the same.

Thanks,
Kapil

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
CS10NET 86 Reputation points

2022-07-18T13:05:24.62+00:00

This is exactly what I tried but when I look under Effective routes it shows the next hop as "None" and not "Virtual network".

So the UDR is attached to the subnet in the spoke that contains the VM I'm trying to access. The destination is Bastion subnet (which is in the hub) and next hop is set to Virtual network. When you click on the UDR, the Overview shows the hop as Virtual network and when you click on the Routes section, it displays it as VnetLocal.

It just seems off that the effective route is is not showing Virtual network to prove that the UDR is working. I have power cycled the VM too.
KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2022-07-19T10:14:38.113+00:00

Hi @CS10NET ,

You are right.
Apologies for the previous comment.

I checked this internally and I see the "VirtualNetwork" nextHop type in UDR does not include the address range of Peered Virtual Networks.

Refer : https://learn.microsoft.com/en-us/azure/virtual-network/virtual-networks-udr-overview

The other way I can think of is to subnet the address prefix.
i.e,

Let's say your Hub Vnet has the range 10.0.0.0/16 and Bastion Subnet is 10.0.50.0/24

And you have various subnets, subnet1, subnet2........ as 10.0.1.0/24, 10.0.2.0/24 respectively

Currently, I assume you must have the Route configured as 10.0.0.0/16 ---------> NVA IP

Instead, you can add individual routes of the subnet such as subnet1(10.0.1.0/24) -----> NVA, subnet2(10.0.2.0/24) -----> NVA

And not add any routes for Bastion subnet.

But this would introduce the additional labor of configuring and managing all these routes.

However, if you do not have a requirement for traffic between Spoke and Hub to flow via the NVA, you can simply use a 0.0.0.0/0 -------> NVA route in the UDR.
This way, the Hub (including Bastion) routes would take the default route of Vnet Peering
Refer: https://azure.microsoft.com/en-in/blog/accessing-virtual-machines-behind-azure-firewall-with-azure-bastion/

I hope this provides some clarity.

Thanks,
Kapil
CS10NET 86 Reputation points

2022-07-19T12:49:41.243+00:00

Thanks, we were able to solve this by just using an entirely different address space for bastion in its own vnet and subnet. So there are no routes in any UDR for this network so it will use vnet peering.

Thanks for your help with this.

Answer 1

CS10NET 86

We were able to solve this by just using an entirely different address space for bastion in its own vnet and subnet. So there are no routes in any UDR for this network so it will use vnet peering.

KapilAnanth-MSFT 49,616 Reputation points Microsoft Employee Moderator

2022-07-20T10:27:19.403+00:00

Hi @CS10NET ,

Thanks for your insights and for keeping the thread updated.

Thanks,
Kapil

Answer 2

SaiGunaranjan 1

Hi @CS10NET

Based on the following document, I am not sure if the scenario you described if supported currently.

Ref : https://learn.microsoft.com/en-us/azure/bastion/bastion-faq#udr

If the response helped, please don't forget to accept answer and up-vote - Sai

Answer 3

Hi @CS10NET ,

based on the information of the link above UDRs aren't supported in the Bastion subnet.
In a similar environment we are using a "jump host VM" in the same vNet with the Bastion subnet. Connecting to the "jump host VM" via Bastion is possible and from the jump host we are able to connect to any other VM in all the hub and spoke vents/subnets.
Maybe using a "jump host VM" is an option for you as well.

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Share via

Azure Bastion and hub/spoke with UDRs

3 answers

Your answer