|
1 | 1 | --- |
2 | | -title: 'Connect to a VM - specified private IP address: Azure portal' |
| 2 | +title: 'About Azure Bastion IP-based connection' |
3 | 3 | titleSuffix: Azure Bastion |
4 | | -description: Learn how to connect to your virtual machines using a specified private IP address via Azure Bastion. |
| 4 | +description: Learn about IP-based connection in Azure Bastion, including supported scenarios, SKU requirements, and limitations. |
5 | 5 | author: abell |
6 | 6 | ms.service: azure-bastion |
7 | | -ms.topic: how-to |
8 | | -ms.date: 03/03/2025 |
| 7 | +ms.topic: concept-article |
| 8 | +ms.date: 03/09/2026 |
9 | 9 | ms.author: abell |
10 | | -ms.custom: sfi-image-nochange |
11 | 10 |
|
12 | | -# Customer intent: As a network administrator, I want to configure and connect to virtual machines using a specified private IP address via Bastion, so that I can securely manage resources in my network environment. |
| 11 | +# Customer intent: As a network administrator, I want to understand how IP-based connection works with Azure Bastion, so that I can determine whether it's the right approach for securely connecting to on-premises, non-Azure, or Azure virtual machines. |
13 | 12 | --- |
14 | 13 |
|
15 | | -# Connect to a VM via specified private IP address |
| 14 | +# About Azure Bastion IP-based connection |
16 | 15 |
|
17 | | -IP-based connection lets you connect to your on-premises, non-Azure, and Azure virtual machines via Azure Bastion over ExpressRoute or a VPN site-to-site connection using a specified private IP address. The steps in this article show you how to configure your Bastion deployment, and then connect to an on-premises resource using IP-based connection. For more information about Azure Bastion, see the [Overview](bastion-overview.md). |
| 16 | +IP-based connection lets you connect to your on-premises, non-Azure, and Azure virtual machines via Azure Bastion using a specified IP address. Unlike standard Bastion connections that use the Azure Resource Manager resource ID of a target virtual machine, IP-based connections target a virtual machine by its IP address. This makes it possible to connect to machines that aren't registered as Azure resources, such as on-premises servers or VMs running in other cloud environments. |
18 | 17 |
|
19 | | -:::image type="content" source="./media/connect-ip-address/architecture.png" alt-text="Diagram that shows the Azure Bastion architecture." lightbox="./media/connect-ip-address/architecture.png"::: |
| 18 | +## Architecture |
20 | 19 |
|
21 | | -> [!NOTE] |
22 | | -> This configuration requires the Standard SKU or higher for Azure Bastion. To upgrade, see [Upgrade a SKU](upgrade-sku.md). |
23 | | -> |
| 20 | +The following diagram shows the IP-based connection architecture. Azure Bastion, deployed in its virtual network, connects to a target virtual machine using the virtual machine's IP address over an ExpressRoute circuit or VPN site-to-site connection. The connection doesn't require the target virtual machine to have a public IP address or to be an Azure resource. |
24 | 21 |
|
25 | | -**Limitations** |
| 22 | +:::image type="content" source="./media/connect-ip-address/architecture.png" alt-text="Diagram that shows how IP-based connections work over Azure ExpressRoute private peering or VPN site-to-site connections, extending Azure Bastion secure connectivity beyond Azure-hosted workloads." lightbox="./media/connect-ip-address/architecture.png"::: |
26 | 23 |
|
27 | | -* IP-based connection won’t work with force tunneling over VPN, or when a default route is advertised over an ExpressRoute circuit. Azure Bastion requires access to the Internet and force tunneling, or the default route advertisement will result in traffic blackholing. |
| 24 | +In this scenario: |
| 25 | +* Azure Bastion routes the RDP or SSH traffic through the ExpressRoute or VPN connection to reach the target virtual machine at the specified IP address. |
| 26 | +* The connection is secured through the Bastion host, so the target virtual machine doesn't need to be exposed to the public internet. |
28 | 27 |
|
29 | | -* Microsoft Entra authentication isn't supported for RDP connections. Microsoft Entra authentication is supported for SSH connections via native client. |
| 28 | +## Supported scenarios |
30 | 29 |
|
31 | | -* Custom ports and protocols aren't currently supported when connecting to a VM via native client. |
| 30 | +IP-based connection supports the following scenarios: |
32 | 31 |
|
33 | | -* UDR isn't supported on Bastion subnet, including with IP-based connection. |
| 32 | +* **On-premises virtual machines:** Connect to virtual machines running in your on-premises datacenter through an [ExpressRoute private peering](../expressroute/designing-for-disaster-recovery-with-expressroute-privatepeering.md) or [VPN site-to-site connection](../vpn-gateway/add-remove-site-to-site-connections.md). |
| 33 | +* **Non-Azure virtual machines:** Connect to virtual machines hosted in other cloud environments that are reachable from the Azure virtual network through ExpressRoute or VPN. |
| 34 | +* **Azure virtual machines:** Connect to Azure virtual machines by specifying an IP address instead of selecting the virtual machine resource in the portal. This is useful when the target virtual machine is in a peered or connected virtual network. |
34 | 35 |
|
35 | | -## Prerequisites |
| 36 | +## Supported connection methods |
36 | 37 |
|
37 | | -Before you begin these steps, verify that you have the following environment set up: |
| 38 | +The following table summarizes the connection methods available with IP-based connection: |
38 | 39 |
|
39 | | -* A VNet with Bastion already deployed. |
| 40 | +| Connection method | Protocol | Details | |
| 41 | +|---|---|---| |
| 42 | +| Azure portal (browser) | RDP, SSH | Provides browser-based RDP or SSH sessions from the Bastion **Connect** page by targeting an IP address. For step-by-step guidance, see [Connect to a Windows VM using RDP](bastion-connect-vm-rdp-windows.md). | |
| 43 | +| Native client (Azure CLI) | RDP | Provides RDP connectivity from a Windows client using `az network bastion rdp` with the `--target-ip-address` parameter. For connection steps, see [Connect from a Windows native client](connect-vm-native-client-windows.md). | |
| 44 | +| Native client (Azure CLI) | SSH | Provides SSH connectivity from Windows or Linux clients using `az network bastion ssh` with the `--target-ip-address` parameter. For connection steps, see [Connect from a Windows native client](connect-vm-native-client-windows.md) or [Connect from a Linux native client](connect-vm-native-client-linux.md). | |
| 45 | +| Native client (Azure CLI) | Tunnel | Creates an IP-based TCP tunnel using `az network bastion tunnel` with the `--target-ip-address` parameter. For configuration steps, see [Configure Bastion native client support](native-client.md). | |
40 | 46 |
|
41 | | - * Make sure that you have deployed Bastion to the virtual network. Once the Bastion service is provisioned and deployed in your virtual network, you can use it to connect to any VM deployed in any of the virtual networks that is reachable from Bastion. |
42 | | - * To deploy Bastion, see [Quickstart: Deploy Bastion with default settings and the Standard SKU](quickstart-host-portal.md). |
| 47 | +## SKU requirements |
43 | 48 |
|
44 | | -* A virtual machine in any reachable virtual network. This is the virtual machine to which you'll connect. |
| 49 | +IP-based connection requires the **Standard** SKU tier or higher for Azure Bastion. The Basic and Developer SKUs don't support this feature. You must also enable the **IP-based connection** setting on the Bastion **Configuration** page. |
45 | 50 |
|
46 | | -## Configure Bastion |
| 51 | +For information about SKU capabilities, see [Choose the right Azure Bastion SKU](bastion-sku-comparison.md). To upgrade your Bastion deployment, see [Upgrade a SKU](upgrade-sku.md). |
47 | 52 |
|
48 | | -1. Sign in to the [Azure portal](https://portal.azure.com/). |
| 53 | +## Limitations |
49 | 54 |
|
50 | | -1. In the Azure portal, go to your Bastion deployment. |
| 55 | +* **Force tunneling:** IP-based connection doesn't work with force tunneling over VPN, or when a default route is advertised over an ExpressRoute circuit. Azure Bastion requires access to the internet. Force tunneling or default route advertisement results in traffic being dropped. |
51 | 56 |
|
52 | | -1. IP based connection requires the Standard SKU or higher. On the **Configuration** page, for **SKU**, verify the SKU is set to the **Standard** SKU or higher. If the SKU is set to the Basic SKU, select a higher SKU from the dropdown. |
| 57 | +* **Microsoft Entra ID authentication:** Microsoft Entra authentication isn't supported for RDP connections via IP address. Microsoft Entra authentication is supported for SSH connections via native client. For more information, see [Microsoft Entra ID authentication](bastion-entra-id-authentication.md). |
53 | 58 |
|
54 | | -1. To enable **IP based connection**, select **IP based connection**. |
| 59 | +* **Custom ports and protocols:** Custom ports and protocols aren't currently supported when connecting to a virtual machine via native client with IP-based connections. |
55 | 60 |
|
56 | | -1. Select **Apply** to apply the changes. It takes a few minutes for the Bastion configuration to complete. |
57 | | - |
58 | | -## Connect to VM - Azure portal |
59 | | - |
60 | | -1. To connect to a VM using a specified private IP address, you make the connection from Bastion to the VM, not directly from the VM page. On your Bastion page, select **Connect** to open the Connect page. |
61 | | - |
62 | | -1. On the Bastion **Connect** page, for **IP address**, enter the private IP address of the target VM. |
63 | | - |
64 | | - :::image type="content" source="./media/connect-ip-address/ip-address.png" alt-text="Screenshot of the Connect using Azure Bastion page." lightbox="./media/connect-ip-address/ip-address.png"::: |
65 | | - |
66 | | -1. Adjust your connection settings to the desired **Protocol** and **Port**. |
67 | | - |
68 | | -1. Enter your credentials in **Username** and **Password**. |
69 | | - |
70 | | -1. Select **Connect** to connect to your virtual machine. |
71 | | - |
72 | | -## Connect to VM - native client |
73 | | - |
74 | | -You can connect to VMs using a specified IP address with native client via SSH, RDP, or tunneling. To learn more about configuring native client support, see [Configure Bastion native client support](native-client.md). |
75 | | - |
76 | | -> [!NOTE] |
77 | | -> This feature does not currently support Microsoft Entra authentication or custom port and protocol. |
78 | | -
|
79 | | -Use the following commands as examples: |
80 | | - |
81 | | -**RDP:** |
82 | | - |
83 | | -```azurecli |
84 | | -az network bastion rdp --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-ip-address "<VMIPAddress> |
85 | | -``` |
86 | | - |
87 | | -**SSH:** |
88 | | - |
89 | | -```azurecli |
90 | | -az network bastion ssh --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-ip-address "<VMIPAddress>" --auth-type "ssh-key" --username "<Username>" --ssh-key "<Filepath>" |
91 | | -``` |
92 | | - |
93 | | -**Tunnel:** |
94 | | - |
95 | | -```azurecli |
96 | | -az network bastion tunnel --name "<BastionName>" --resource-group "<ResourceGroupName>" --target-ip-address "<VMIPAddress>" --resource-port "<TargetVMPort>" --port "<LocalMachinePort>" |
97 | | -``` |
| 61 | +* **UDR:** User-defined routes (UDR) aren't supported on the Bastion subnet, including with IP-based connections. |
98 | 62 |
|
99 | 63 | ## Next steps |
100 | 64 |
|
101 | | -Read the [Bastion FAQ](bastion-faq.md) for additional information. |
| 65 | +* [Create an RDP connection to a Windows VM](bastion-connect-vm-rdp-windows.md) |
| 66 | +* [Connect from a Windows native client](connect-vm-native-client-windows.md) |
| 67 | +* [Connect from a Linux native client](connect-vm-native-client-linux.md) |
| 68 | +* [Configure Bastion native client support](native-client.md) |
| 69 | +* [Azure Bastion FAQ](bastion-faq.md) |
0 commit comments