Deploy Bastion using Azure PowerShell

Article
03/08/2023

This article shows you how to deploy Azure Bastion with the Standard SKU using PowerShell. Azure Bastion is a PaaS service that's maintained for you, not a bastion host that you install on your VM and maintain yourself. An Azure Bastion deployment is per virtual network, not per subscription/account or virtual machine. For more information about Azure Bastion, see What is Azure Bastion?

Once you deploy Bastion to your virtual network, you can connect to your VMs via private IP address. This seamless RDP/SSH experience is available to all the VMs in the same virtual network. If your VM has a public IP address that you don't need for anything else, you can remove it.

You can also deploy Bastion by using the following other methods:

If you don’t have an Azure subscription, create a free account before you begin.

Note

The use of Azure Bastion with Azure Private DNS Zones is not supported at this time. Before you begin, please make sure that the virtual network where you plan to deploy your Bastion resource is not linked to a private DNS zone.

Prerequisites

The following prerequisites are required.

Azure PowerShell

This article uses PowerShell cmdlets. To run the cmdlets, you can use Azure Cloud Shell. Cloud Shell is a free interactive shell that you can use to run the steps in this article. It has common Azure tools preinstalled and configured to use with your account.

To open Cloud Shell, just select Try it from the upper-right corner of a code block. You can also open Cloud Shell on a separate browser tab by going to https://shell.azure.com/powershell. Select Copy to copy the blocks of code, paste them into Cloud Shell, and select the Enter key to run them.

You can also install and run the Azure PowerShell cmdlets locally on your computer. PowerShell cmdlets are updated frequently. If you have not installed the latest version, the values specified in the instructions may fail. To find the versions of Azure PowerShell installed on your computer, use the Get-Module -ListAvailable Az cmdlet. To install or update, see Install the Azure PowerShell module.

Example values

You can use the following example values when creating this configuration, or you can substitute your own.

Basic VNet and VM values:

Name	Value
Virtual machine	TestVM
Resource group	TestRG1
Region	East US
Virtual network	VNet1
Address space	10.1.0.0/16
Subnets	FrontEnd: 10.1.0.0/24

Azure Bastion values:

Name	Value
Name	VNet1-bastion
Subnet Name	FrontEnd
Subnet Name	AzureBastionSubnet
AzureBastionSubnet addresses	A subnet within your VNet address space with a subnet mask /26 or larger. For example, 10.1.1.0/26.
Tier/SKU	Standard
Public IP address	Create new
Public IP address name	VNet1-ip
Public IP address SKU	Standard
Assignment	Static

Deploy Bastion

This section helps you create a virtual network, subnets, and deploy Azure Bastion using Azure PowerShell.

Create an Azure resource group with New-AzResourceGroup. A resource group is a logical container into which Azure resources are deployed and managed. If you're running PowerShell locally, open your PowerShell console with elevated privileges and connect to Azure using the Connect-AzAccount command.
```
   New-AzResourceGroup -Name TestRG1 -Location EastUS
```

Create a virtual network.

   $virtualNetwork = New-AzVirtualNetwork `
   -ResourceGroupName TestRG1 `
   -Location EastUS `
   -Name VNet1 `
   -AddressPrefix 10.1.0.0/16

Set the configuration for the virtual network.

   $virtualNetwork | Set-AzVirtualNetwork

Configure and set a subnet for your virtual network. This will be the subnet to which you'll deploy a VM. The variable used for -VirtualNetwork was set in the previous steps.

   $subnetConfig = Add-AzVirtualNetworkSubnetConfig `
   -Name 'FrontEnd' `
   -AddressPrefix 10.1.0.0/24 `
   -VirtualNetwork $virtualNetwork

   $virtualNetwork | Set-AzVirtualNetwork

Configure and set the Azure Bastion subnet for your virtual network. This subnet is reserved exclusively for Azure Bastion resources. You must create the Azure Bastion subnet using the name value AzureBastionSubnet. This value lets Azure know which subnet to deploy the Bastion resources to. The example below also helps you add an Azure Bastion subnet to an existing VNet.

Important

For Azure Bastion resources deployed on or after November 2, 2021, the minimum AzureBastionSubnet size is /26 or larger (/25, /24, etc.). All Azure Bastion resources deployed in subnets of size /27 prior to this date are unaffected by this change and will continue to work, but we highly recommend increasing the size of any existing AzureBastionSubnet to /26 in case you choose to take advantage of host scaling in the future.
- The smallest subnet AzureBastionSubnet size you can create is /26. We recommend that you create a /26 or larger size to accommodate host scaling.
  - For more information about scaling, see Configuration settings - Host scaling.
  - For more information about settings, see Configuration settings - AzureBastionSubnet.
- Create the AzureBastionSubnet without any route tables or delegations.
- If you use Network Security Groups on the AzureBastionSubnet, refer to the Work with NSGs article.
Declare the variable.
```
   $virtualNetwork = Get-AzVirtualNetwork -Name "VNet1" `
   -ResourceGroupName "TestRG1"
```
Add the configuration.
```
   Add-AzVirtualNetworkSubnetConfig -Name "AzureBastionSubnet" `
   -VirtualNetwork $virtualNetwork -AddressPrefix "10.1.1.0/26" ` 
```
Set the configuration.
```
   $virtualNetwork | Set-AzVirtualNetwork
```
Create a public IP address for Azure Bastion. The public IP is the public IP address the Bastion resource on which RDP/SSH will be accessed (over port 443). The public IP address must be in the same region as the Bastion resource you're creating.
```
   $publicip = New-AzPublicIpAddress -ResourceGroupName "TestRG1" -name "VNet1-ip" -location "EastUS" -AllocationMethod Static -Sku Standard
```
Create a new Azure Bastion resource in the AzureBastionSubnet using the New-AzBastion command. The following example uses the Standard SKU. The Standard SKU lets you configure more Bastion features and connect to VMs using more connection types. For more information, see Bastion SKUs. If you want to deploy using the Basic SKU, change the -Sku value to "Basic".
```
   New-AzBastion -ResourceGroupName "TestRG1" -Name "VNet1-bastion" `
   -PublicIpAddressRgName "TestRG1" -PublicIpAddressName "VNet1-ip" `
   -VirtualNetworkRgName "TestRG1" -VirtualNetworkName "VNet1" `
   -Sku "Standard"
```
It takes about 10 minutes for the Bastion resources to deploy. You can create a VM in the next section while Bastion deploys to your virtual network.

Create a VM

You can create a VM using the Quickstart: Create a VM using PowerShell or Quickstart: Create a VM using the portal articles. Be sure you deploy the VM to the virtual network to which you deployed Bastion. The VM you create in this section isn't a part of the Bastion configuration and doesn't become a bastion host. You connect to this VM later in this tutorial via Bastion.

The following required roles for your resources.

Required VM roles:
- Reader role on the virtual machine.
- Reader role on the NIC with private IP of the virtual machine.
Required inbound ports:
- For Windows VMS - RDP (3389)
- For Linux VMs - SSH (22)

Connect to a VM

You can use the Connection steps in the section below to connect to your VM. You can also use any of the following articles to connect to a VM. Some connection types require the Bastion Standard SKU.

Connection steps

In the Azure portal, go to the virtual machine to which you want to connect.
At the top of the page, select Connect->Bastion to go to the Bastion page. You can also go to the Bastion page using the left menu.
The options available on the Bastion page are dependant on the Bastion SKU tier. If you're using the Basic SKU, you connect to a Windows computer using RDP and port 3389, and to a Linux computer using SSH and port 22. You don't have options to change the port number or the protocol. However, you can change the keyboard language for RDP by expanding Connection Settings.

If you're using the Standard SKU, you have more connection protocol and port options available. Expand Connection Settings to see the options. Typically, unless you have configured different settings for your VM, you connect to a Windows computer using RDP and port 3389, and to a Linux computer using SSH and port 22.
Select the Authentication Type from the dropdown. The protocol determines the available authentication types. Complete the required authentication values.
To open the VM session in a new browser tab, leave Open in a new browser tab selected.
Click Connect to connect to the VM.
The connection to this virtual machine, via Bastion, will open directly in the Azure portal (over HTML5) using port 443 and the Bastion service.
- When you connect, the desktop of the VM will look different than the example screenshot.
- Using keyboard shortcut keys while connected to a VM may not result in the same behavior as shortcut keys on a local computer. For example, when connected to a Windows VM from a Windows client, CTRL+ALT+END is the keyboard shortcut for CTRL+ALT+Delete on a local computer. To do this from a Mac while connected to a Windows VM, the keyboard shortcut is Fn+CTRL+ALT+Backspace.

To enable audio output

You can enable remote audio output for your VM. Some VMs automatically enable this setting, others require you to enable audio settings manually. The settings are changed on the VM itself. Your Bastion deployment doesn't need any special configuration settings to enable remote audio output.

Note

Audio output takes up bandwidth on your internet connection.

To enable remote audio output on a Windows VM:

After you're connected to the VM, on the right-hand bottom corner of the toolbar, you'll see an audio button.
Right-click the audio button and select "Sounds".
A pop-up appears asking if you would like to enable the Windows Audio Service. Select "Yes". You can configure more audio options in Sound preferences.
To verify sound output, hover your mouse over the audio button on the toolbar.

Remove VM public IP address

Azure Bastion doesn't use the public IP address to connect to the client VM. If you don't need the public IP address for your VM, you can disassociate the public IP address. See Dissociate a public IP address from an Azure VM.

Next steps

To use Network Security Groups with the Azure Bastion subnet, see Work with NSGs.
To understand VNet peering, see VNet peering and Azure Bastion.