IP-based connection lets you connect to your on-premises, non-Azure, and Azure virtual machines via Azure Bastion over ExpressRoute or a VPN site-to-site connection using a specified private IP address. The steps in this article show you how to configure your Bastion deployment, and then connect to an on-premises resource using IP-based connection. For more information about Azure Bastion, see the Overview.
Note
This configuration requires the Standard SKU tier or higher for Azure Bastion. To upgrade, see Upgrade a SKU.
Limitations
IP-based connection won’t work with force tunneling over VPN, or when a default route is advertised over an ExpressRoute circuit. Azure Bastion requires access to the Internet and force tunneling, or the default route advertisem*nt will result in traffic blackholing.
Microsoft Entra authentication isn't supported for RDP connections. Microsoft Entra authentication is supported for SSH connections via native client.
Custom ports and protocols aren't currently supported when connecting to a VM via native client.
UDR isn't supported on Bastion subnet, including with IP-based connection.
Prerequisites
Before you begin these steps, verify that you have the following environment set up:
A VNet with Bastion already deployed.
Make sure that you have deployed Bastion to the virtual network. Once the Bastion service is provisioned and deployed in your virtual network, you can use it to connect to any VM deployed in any of the virtual networks that is reachable from Bastion.
In the Azure portal, go to your Bastion deployment.
IP based connection requires the Standard SKU tier or higher. On the Configuration page, for Tier, verify the tier is set to the Standard SKU or higher. If the tier is set to the Basic SKU, select a higher SKU from the dropdown.
To enable IP based connection, select IP based connection.
Select Apply to apply the changes. It takes a few minutes for the Bastion configuration to complete.
Connect to VM - Azure portal
To connect to a VM using a specified private IP address, you make the connection from Bastion to the VM, not directly from the VM page. On your Bastion page, select Connect to open the Connect page.
On the Bastion Connect page, for IP address, enter the private IP address of the target VM.
Adjust your connection settings to the desired Protocol and Port.
Enter your credentials in Username and Password.
Select Connect to connect to your virtual machine.
Connect to VM - native client
You can connect to VMs using a specified IP address with native client via SSH, RDP, or tunneling. To learn more about configuring native client support, see Configure Bastion native client support.
Note
This feature does not currently support Microsoft Entra authentication or custom port and protocol.
Use the following commands as examples:
RDP:
az network bastion rdp --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-ip-address "<VMIPAddress>
In the Azure portal, go to the virtual machine that you want to connect to. On the Overview page, select Connect, then select Bastion from the dropdown to open the Bastion page. You can also select Bastion from the left pane. On the Bastion page, enter the required authentication credentials, then click Connect.
In the Azure Bastion section, select Enable Bastion. Bastion uses your browser to connect to VMs in your virtual network over Secure Shell (SSH) or Remote Desktop Protocol (RDP) by using their private IP addresses. The VMs don't need public IP addresses, client software, or special configuration.
Azure Bastion deployments, except Developer SKU and Private-only, require a Public IP address. The Public IP must have the following configuration: The Public IP address SKU must be Standard. The Public IP address assignment/allocation method must be Static.
To connect to a VM using a specified private IP address, you make the connection from Bastion to the VM, not directly from the VM page. On your Bastion page, select Connect to open the Connect page.On the Bastion Connect page, for IP address, enter the private IP address of the target VM.
On the Network interface page, under Settings, select IP configurations. In IP configurations, select ipconfig1 in the list. Under Assignment, select Static. Change the private IP address if you want a different one, and then select Save.
Connect to the server via SSH with superuser permissions.
To assign an IPv4 address. Specify the network settings in /etc/sysconfig/network-scripts/ifcfg-<interface> file, where <interface> is the name of the network interface. ...
Azure Bastion is a fully managed service that provides more secure and seamless Remote Desktop Protocol (RDP) and Secure Shell Protocol (SSH) access to virtual machines (VMs) without any exposure through public IP addresses.
You can restrict the access of a specific web application to specified IP addresses through the menu of your web application. However, to configure your IP whitelist for a specific web application, navigate to Settings, Networking, <the Web App overview page>. Under IP restrictions, click Configure IP restrictions.
In the Azure portal, go to the virtual machine to which you want to connect. At the top of the virtual machine Overview page, select Connect, then select Connect via Bastion from the dropdown. This opens the Bastion page. You can go to the Bastion page directly in the left pane.
Both Private and Public IP addresses can be assigned to a virtual machine's network interface controller (NIC). Private IP addresses assigned to a network interface enable a virtual machine to communicate with other resources in an Azure virtual network and connected networks.
In the Azure portal, navigate to Virtual Machines, go to your Windows virtual machine, then from the Overview page Select Connect at the top. Enter your Username and Password that you added when you created your Windows VM. Establish a Remote Desktop Connection with the virtual machine.
Sign into your Azure DevOps organization and navigate to your project. Go to the Pipelines page and select Environments > Create Environment. Specify a Name (required) for the environment and a Description. Choose Virtual Machines as a Resource to be added to the environment, and then select Next.
Introduction: My name is Tish Haag, I am a excited, delightful, curious, beautiful, agreeable, enchanting, fancy person who loves writing and wants to share my knowledge and understanding with you.
We notice you're using an ad blocker
Without advertising income, we can't keep making this site awesome for you.
