Troubleshoot and Optimize Azure Bastion Connectivity
Diagnosing Connectivity Failures
When connection errors occur, administrators should use the Connection Troubleshoot tool within Network Watcher. This utility tests the direct TCP connection between the Bastion host and the target virtual machine to pinpoint where the traffic is being blocked. For example, if a user experiences a black screen upon connecting, the root cause is often client-side firewalls blocking WebSockets or a missing NSG rule. Additionally, virtual machines that rely on Just-In-Time (JIT) VM access require specific role assignments so that the Bastion service can successfully request temporary network openings.
Ingress and Egress Port Requirements
Maintaining reliable access requires strict adherence to NSG rule configurations on the Bastion subnet. For inbound traffic, the NSG must allow port 443 from the GatewayManager service tag and ports 8080 and 5701 for internal data plane communication between host instances. For outbound traffic, the NSG must allow communication to the target VMs on ports 3389 and 22, as well as port 443 to the AzureCloud service tag to send diagnostic logs. Missing any of these rules can disrupt service updates, block connectivity, or cause monitoring failures.
To support high-traffic environments, you can scale the Bastion deployment to handle more concurrent sessions. Utilizing the Standard SKU or higher allows you to configure host scaling, which increases the number of instances up to a maximum of 50. A single instance typically supports up to 20 concurrent RDP sessions or 40 SSH sessions. To leverage this capability, the initial subnet must be sized at /26 or larger, as smaller subnets lack the IP space required to host these additional instances.
Authentication and Session Monitoring
Authentication issues are often caused by using incorrect formatting or unsupported security keys. When connecting to domain-joined Windows virtual machines, users must input their credentials using the User Principal Name format, such as username@domain.com, instead of older formats. For Linux connections, the private SSH keys must use RSA, DSA, or OPENSSH formats to be accepted. If you modify the DNS settings of the virtual network, you must perform a full redeployment of the Bastion host so it can recognize the changes and support Kerberos authentication.
Monitoring who is accessing your workloads is critical for maintaining a secure environment. Enabling BastionAuditLogs records every administrative session, capturing user identities and connection durations for audit purposes. Within the portal, administrators can use the active sessions page to force-disconnect hung or unauthorized sessions immediately. For environments with strict compliance regulations, the Premium SKU offers session recording, which captures all graphical activity during RDP and SSH connections and stores it in an Azure storage account.
Manage Network Security and Access Controls for Azure Bastion
Advanced Network Security Controls
Azure Bastion operates as a fully managed service that protects your workloads by keeping virtual machines entirely isolated from the public internet. By forcing all management traffic through TLS-encrypted sessions, you eliminate the risk of port scanning on your private servers. To further strengthen this boundary, you can integrate Azure Firewall into your virtual network topology to inspect and filter traffic before it reaches Bastion. The NSG on the Bastion subnet must also allow outbound traffic over port 80 to the internet, which the service relies on for certificate validation and session management.
Identity and Privileged Access Management
Securing access to the Bastion host itself depends on a combination of Microsoft Entra ID and Azure RBAC. Users who need to connect to target virtual machines must be assigned the Reader role on the virtual machine, the network interface card, the virtual network, and the Bastion resource itself. To enforce the principle of least privilege, you can implement Privileged Identity Management (PIM) to grant these administrative roles on a temporary, just-in-time basis. Additionally, SSH keys should be managed securely within Azure Key Vault, with access permissions restricted to simple retrieval operations to prevent credential theft.
Deployment Topologies and High Availability
To optimize costs and streamline operations in large environments, you can deploy a single Bastion host in a hub virtual network and connect to virtual machines residing in peered spoke virtual networks. For environments demanding maximum isolation, the Premium SKU supports a private-only deployment that completely eliminates the public IP address. This configuration allows secure connections exclusively through private endpoints, making it ideal for networks linked via ExpressRoute or a VPN. To guarantee high availability, you can deploy Bastion across multiple availability zones, which protects management access from single-datacenter failures.
Compliance, Auditing, and Threat Detection
Continuous monitoring ensures that your remote access methods remain compliant with corporate security policies. You should enable NSG flow logs along with Azure Monitor, Traffic Analytics, and Microsoft Defender for Cloud to detect anomalous traffic patterns and security threats. Session recordings generated by Premium SKU deployments must be stored in secure Azure storage accounts governed by strict retention and access lifecycle policies. Regularly auditing these logs and active configurations ensures that no unauthorized changes compromise your secure management boundary.
StudyCerts
StudyCerts