Diagram
A system architecture diagram showing how Azure Bastion sits in a dedicated subnet within a virtual network, receiving external management traffic over TLS on port 443 and forwarding RDP and SSH traffic to private virtual machines.
Network Security Group Configuration
To control traffic moving in and out of the Bastion subnet, you must attach a specialized Network Security Group (NSG). The inbound rules must allow HTTPS traffic over port 443 from the public internet to enable administrator connections. Meanwhile, the outbound rules must permit traffic to reach your target virtual machines on ports 3389 for RDP and 22 for SSH. Restricting these outbound rules to the private IP addresses of your target virtual machines prevents unauthorized network traversal.
Domain 3 of 5
25 practice questions
Practice this DomainLast updated