You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/azure/intro-to-azure-bastion/includes/1-introduction.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -6,7 +6,7 @@ Server administrators understand that it's efficient to remotely administer and
6
6
7
7
Suppose you have a line-of-business (LOB) app that supports your organization's research department. In the past, this app ran on a couple of Windows Server computers in your head office datacenter. Whenever you needed to administer the app, you connected using Remote Desktop Protocol (RDP) over TCP port **3389**. You also used Secure Shell (SSH), over port **22**, to administer the VMs. Because the app was hosted on a computing resource in a private datacenter, you had some concerns about access from malicious hackers over the internet. However, the app now runs on VMs hosted in Azure.
8
8
9
-
To connect to the VMs, you must now expose a public IP address on each VM for your RDP/SSH connections. However, potential protocol vulnerabilities make this type of connection undesirable. As a solution, you could use a jump box VM to act as an intermediary between your management console and the target VMs. Or, you could consider implementing Azure Bastion.
9
+
To connect to the VMs, you must now expose a public IP address on each VM for your RDP/SSH connections. However, potential protocol vulnerabilities make this type of connection undesirable. As a solution, you could use a jump box VM to act as an intermediary between your management console and the target VMs. Alternatively, you could consider implementing Azure Bastion.
10
10
11
11
:::image type="content" source="../media/remote-admin.png" alt-text="A remote administrator connecting with RDP or SSH through the internet to Azure VMs. The VMs are accessible through a public IP address using port 3389 or port 22.":::
Copy file name to clipboardExpand all lines: learn-pr/azure/intro-to-azure-bastion/includes/2-what-is-azure-bastion.md
+3-3Lines changed: 3 additions & 3 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ It's vital to be able to securely administer and manage remote hosted VMs. To be
4
4
5
5
Secure remote management is the ability to connect to a remote resource without exposing that resource to security risks. This type of connection can sometimes be challenging, especially if the resource is being accessed across the internet.
6
6
7
-
When administrators connect to remote VMs, they typically use either RDP or SSH to achieve their administrative goals. The problem is, to connect to a hosted VM, you must connect to its public IP address. However, exposing the IP ports used by RDP and SSH (**3389** and **22**) to the internet is highly undesirable, because it presents significant security risks.
7
+
When administrators connect to remote VMs, they typically use either RDP or SSH to achieve their administrative goals. The problem is that to connect to a hosted VM, you must connect to its public IP address. However, exposing the IP ports used by RDP and SSH (**3389** and **22**) to the internet is highly undesirable because it presents significant security risks.
8
8
9
9
## Azure Bastion definition
10
10
@@ -25,15 +25,15 @@ The following table describes the features that are available after you deploy A
25
25
|No hassle of managing Network Security Groups (NSGs)| You don't need to apply any NSGs to the Azure Bastion subnet. Because Azure Bastion connects to your virtual machines over private IP, you can configure your NSGs to allow RDP/SSH from Azure Bastion only. This removes the hassle of managing NSGs each time you need to securely connect to your virtual machines.|
26
26
|No need to manage a separate bastion host on a VM |Azure Bastion is a fully managed platform PaaS service from Azure that is hardened internally to provide you secure RDP/SSH connectivity.|
27
27
|Protection against port scanning|Your VMs are protected against port scanning by rogue and malicious users because you don't need to expose the VMs to the internet.|
28
-
|Hardening in one place only|Azure Bastion sits at the perimeter of your virtual network, so you don’t need to worry about hardening each of the VMs in your virtual network.|
28
+
|Hardening in one place only|Azure Bastion sits at the perimeter of your virtual network, so you don't need to worry about hardening each of the VMs in your virtual network.|
29
29
|Protection against zero-day exploits |The Azure platform protects against zero-day exploits by keeping the Azure Bastion hardened and always up to date for you.|
30
30
31
31
## How to avoid exposing remote management ports
32
32
33
33
By implementing Azure Bastion, you can manage the Azure VMs within a configured Azure virtual network by using either RDP or SSH, without needing to expose those management ports to the public internet. By using Azure Bastion, you can:
34
34
35
35
- Connect easily to your Azure VMs. Connect your RDP and SSH sessions directly in the Azure portal.
36
-
- Avoid exposing management ports to the internet. Sign in to your Azure VMs and avoid public internet exposure by using SSH and RDP with private IP addresses only.
36
+
- Avoid exposing management ports to the internet. Sign in to your Azure VMs, and avoid public internet exposure by using SSH and RDP with private IP addresses only.
37
37
- Avoid extensive reconfiguration of your existing network infrastructure. Integrate and traverse existing firewalls and security perimeters by using a modern HTML5-based web client over TLS on port **443**.
38
38
- Simplify sign in. Use your SSH keys for authentication when signing in to your Azure VMs.
Copy file name to clipboardExpand all lines: learn-pr/azure/intro-to-azure-bastion/includes/3-how-azure-bastion-works.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ The following diagram depicts the architecture of a typical Azure Bastion deploy
16
16
:::image type="content" source="../media/bastion-architecture.png" alt-text="The architecture of Azure Bastion, as described in the preceding text.":::
17
17
18
18
> [!NOTE]
19
-
> The protected VMs and the Azure Bastion host are connected to the same virtual network, although in different subnets.
19
+
> The protected VMs and the Azure Bastion host are connected to the same virtual network, although in different subnets.
20
20
21
21
The typical connection process in Azure Bastion is as follows:
Copy file name to clipboardExpand all lines: learn-pr/azure/intro-to-azure-bastion/includes/4-when-to-use-azure-bastion.md
-1Lines changed: 0 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -34,7 +34,6 @@ To determine whether a jump box or Azure Bastion is the better option to remotel
34
34
|**Ease of management**| Azure Bastion is a fully managed PaaS service. It's not a VM like a jump box, which requires regular updates. You don't need a client or agent to use Azure Bastion, nor do you need to apply patches and updates to it. You also don't need to install or maintain any other software on management consoles.|
35
35
|**Integration**| You can integrate Azure Bastion with other native security services in Azure, such as Azure Firewall. Jump servers don't have this option. |
36
36
37
-
38
37
> [!NOTE]
39
38
> You deploy Azure Bastion per virtual network (or peered virtual network) rather than per subscription, account, or VM.
0 commit comments