As part of my Azure feature series lets take a look at Bastion (now in preview)

What is it?

Securing access to public facing cloud based VMs is a potentially risky and costly concern for businesses. Using services like JiT (Just in Time Access) to reduce the attack surface requires that your Security Center Service Plan has been upgraded to Standard as the service is not available on the Basic Service Plan.

Say hello to Azure Bastion

Now with Bastion you can remove the attack surface completely by allowing connections via port 443 for Windows and SSH for Linux integrated into the Azure Portal, thereby removing the risk of port scanning and removing the need for public facing IP addresses for your VMs.

Below are some of the key features currently available at this time:

How to activate the Public Preview

The service is currently in preview, which means you need to activate it with the below steps:

1. Make sure you are connected to the Azure Preview portal here
2. Open Azure Shell and run the below three commands:
   (If you have the Az PowerShell module remember to change AzureRM to Az)
   • Register-AzureRmProviderFeature -FeatureName AllowBastionHost -ProviderNamespace Microsoft.Network
   • Register-AzureRmResourceProvider -ProviderNamespace Microsoft.Network
   • Get-AzureRmProviderFeature -ProviderNamespace Microsoft.Network

Getting started

From the homepage of the Azure Preview Portal click + Create a resource and search for Bastion (Preview), then click create.

Choose your subscription and resource group, it is important to note that you have to create a subnet called AzureBastionSubnet. This value lets Azure know which subnet to deploy the Bastion resources to. It is recommend to use at least a /27 or larger subnet. Create the AzureBastionSubnet without any Network Security Groups, route tables, or delegations. Once done create the Bastion.

Once your Bastion is deployed, from the Azure Portal navigate to the VM you want to connect to and click connect, you will see a new option called BASTION next to the familiar RDP and SSH options. Enter the credentials and click Connect.

And there you have it, your VM is securely accessible through the Azure Portal without needing a public facing IP address.

Conclusion

Bastion is a fantastic and a much needed service which allows secure access to your cloud Windows and Linux VMs without any exposure of public IPs ultimately allowing the removal of the VM attack surface in your Azure environment.

If you ever need to test Application insights or any of the other Azure features that need an application such as Front Door there is a simple way to create a test application baked into Azure.

In your Azure portal simple click on “New Resource” and search for Bakery and click Create

Now give the App a name, choose your subscription, resource group and an applicable App Service Plan. Remember the more robust the plan the higher the cost, there is a free limited Tier available called F1 Shared. Then click Create.

After a few minutes your application will be deployed and ready for use with Azure Features. select App Services in your Azure Portal and then click on your Bakery Application

You can find the URL for your new site at the top right of the Overview blade.

Browsing the URL you should see the below site.

For an extra tip if you need the site again you can turn it off instead of deleting it to save some costs. Just press stop in the application overview.