Edit

Quickstart: Use the Azure portal to create a virtual network

  • Article
  • 5 minutes to read

This quickstart shows you how to create a virtual network by using the Azure portal. You then create two virtual machines (VMs) in the network, deploy Azure Bastion to securely connect to the VMs from the internet, and communicate privately between the VMs.

A virtual network is the fundamental building block for private networks in Azure. Azure Virtual Network enables Azure resources like VMs to securely communicate with each other and the internet.

Prerequisites

Create a virtual network

The following procedure creates a virtual network with a resource subnet, an Azure Bastion subnet, and an Azure Bastion host.

  1. Sign in to the Azure portal.

  2. In the portal, search for and select Virtual networks.

  3. On the Virtual networks page, select Create.

  4. On the Basics tab of the Create virtual network screen, enter or select the following information:

    • Subscription: Keep the default or select a different subscription.
    • Resource group: Select Create new, and then name the group TestRG.
    • Virtual network name: Enter VNet.
    • Region: Keep the default or select a different region for the network and all its resources.

    Screenshot of the Create virtual network screen in the Azure portal.

  5. Select Next.

  6. On the Security tab, select Enable Azure Bastion.

    Azure Bastion uses your browser to connect to VMs in your virtual network over secure shell (SSH) or remote desktop protocol (RDP) by using their private IP addresses. The VMs don't need public IP addresses, client software, or special configuration. For more information about Azure Bastion, see Azure Bastion.

  7. Select Next to accept the defaults for Azure Bastion host name and Azure Bastion public IP address.

    Screenshot of the Security tab of the Create virtual network screen.

  8. On the IP Addresses tab, accept the settings for the default subnet and select Add Azure Bastion subnet near the bottom of the page.

    Screenshot of the IP Addresses tab of the Create virtual network screen.

  9. On the next screen, select Review + create to accept the following defaults:

    • A virtual network IPv4 address space of 10.0.0.0/16.
    • A resource subnet named default with address range 10.0.0.0/24.
    • Another subnet named AzureBastionSubnet with address space 10.0.1.0/26. A subnet that hosts Azure Bastion must be named AzureBastionSubnet.

    Screenshot of the completed IP Addresses tab of the Create virtual network screen.

  10. After validation succeeds, select Create. It takes a few minutes to create the Bastion host.

Create virtual machines

Create two VMs named VM1 and VM2 in the virtual network.

  1. In the portal, search for and select Virtual machines.

  2. On the Virtual machines page, select Create, and select Azure virtual machine.

  3. On the Basics tab of the Create a virtual machine screen, enter or select the following values:

    • Resource group: Select TestRG if not already selected.
    • Virtual machine name: Enter VM1.
    • Region: Select the same region as your resource group and virtual network if not already selected.
    • Availability options: Select No infrastructure redundancy required.
    • Image: Select Windows Server 2019 Datacenter - x64 Gen2.
    • Size: Accept the default, or drop down and select a size.
    • Username, Password, and Confirm password: Enter an admin username and password for the VM.
    • Public inbound ports: Select None.

    Screenshot of creating basic settings for a VM.

  4. Select the Networking tab at the top of the page.

  5. On the Networking page, enter or select the following values:

    • Virtual network: Select VNet if not already selected.
    • Subnet: Select default if not already selected.
    • Public IP: Select None.

    Screenshot of the networking settings for a VM.

  6. Accept the other settings, and select Review + create. Review the settings, and then select Create.

  7. After the VM creation finishes, you can select Create another VM to create the second VM. Name the VM VM2, with all the same settings.

Note

VMs in a virtual network with a Bastion host don't need public IP addresses. Bastion provides the public IP, and the VMs use private IPs to communicate within the network. You can remove the public IPs from any VMs in Bastion-hosted virtual networks. For more information, see Dissociate a public IP address from an Azure VM.

Connect to a VM

  1. In the portal, search for and select Virtual machines.

  2. On the Virtual machines page, select VM1.

  3. At the top of the VM1 page, select Connect.

  4. On the Connect page, select More ways to connect, and then select Go to Bastion.

    Screenshot of connecting to VM1 with Azure Bastion.

  5. On the Bastion page, enter the username and password you created for the VM, and then select Connect.

Communicate between VMs

  1. From the desktop of VM1, open PowerShell.

  2. Enter ping myVM2. You get a reply similar to the following message:

    PS C:\Users\VM1> ping VM2

Pinging VM2.ovvzzdcazhbu5iczfvonhg2zrb.bx.internal.cloudapp.net with 32 bytes of data
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 10.0.0.5:
    Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

    The ping fails because it uses the Internet Control Message Protocol (ICMP). By default, ICMP isn't allowed through Windows firewall.

  3. To allow ICMP to inbound through Windows firewall on this VM, enter the following command:

    New-NetFirewallRule –DisplayName "Allow ICMPv4-In" –Protocol ICMPv4

  4. Close the Bastion connection to VM1.

  5. Repeat the steps in Connect to a VM to connect to VM2.

  6. From PowerShell on VM2, enter ping VM1.

    This time you get a success reply similar to the following message, because you allowed ICMP through the firewall on VM1.

    PS C:\Users\VM2> ping VM1

Pinging VM1.e5p2dibbrqtejhq04lqrusvd4g.bx.internal.cloudapp.net [10.0.0.4] with 32 bytes of data:
Reply from 10.0.0.4: bytes=32 time=2ms TTL=128
Reply from 10.0.0.4: bytes=32 time<1ms TTL=128
Reply from 10.0.0.4: bytes=32 time<1ms TTL=128
Reply from 10.0.0.4: bytes=32 time<1ms TTL=128

Ping statistics for 10.0.0.4:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 0ms, Maximum = 2ms, Average = 0ms

  7. Close the Bastion connection to VM2.

Clean up resources

When you're done using the virtual network and VMs, you can delete the resource group and all its resources.

  1. In the Azure portal, search for and select Resource groups.

  2. On the Resource groups page, select the TestRG resource group.

  3. On the TestRG page, note all the resources the resource group contains. At the top of the page, select Delete resource group.

  4. On the Delete a resource group page, under Enter resource group name to confirm deletion, enter TestRG, and then select Delete.

  5. Select Delete again.

Next steps

In this quickstart, you created a virtual network with two subnets, one containing two VMs and the other for Azure Bastion. You deployed Azure Bastion and used it to connect to the VMs, and securely communicated between the VMs. To learn more about virtual network settings, see Create, change, or delete a virtual network.

Private communication between VMs is unrestricted in a virtual network. Continue to the next article to learn more about configuring different types of VM network communications.

Filter network traffic