Skip to content

Commit 0f47a02

Browse files
asudbringasudbring
committed
Task 544786: Replace DNAT/RDP with Azure Bastion in secure-cloud-network.md
Changes: - Added AzureBastionSubnet (10.0.2.0/26) to Spoke-01 virtual network - Changed both VMs from Windows Server 2019 to Ubuntu 22.04 LTS - Updated VM authentication to use SSH keys with Azure-generated keys - Added Nginx installation steps for both servers using Run Command - Deployed Azure Bastion (Developer SKU) in Spoke-01 - Removed DNAT rule collection entirely - Updated Network rule from RDP (port 3389) to SSH/HTTP (ports 22,80) - Changed source/destination in network rule to use CIDR ranges instead of wildcards - Updated testing section to use Bastion SSH instead of DNAT RDP - Changed IE/RDP testing to curl/SSH commands for Linux - Updated ms.date to 01/22/2026 Related to parent work item #545010 (Sprint 2 Bastion updates)
1 parent e6967c6 commit 0f47a02

1 file changed

Lines changed: 103 additions & 42 deletions

File tree

‎articles/firewall-manager/secure-cloud-network.md‎

Lines changed: 103 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ services: firewall-manager
55
author: duau
66
ms.service: azure-firewall-manager
77
ms.topic: tutorial
8-
ms.date: 02/10/2025
8+
ms.date: 01/22/2026
99
ms.author: duau
1010
ms.custom: sfi-image-nochange
1111
---
@@ -60,14 +60,18 @@ The two virtual networks each have a workload server in them and are protected b
6060

6161

6262
1. Select **Next**, then select **Next**.
63-
1. In the **Networking** tab, create a subnet with the following settings:
63+
1. In the **Networking** tab, create subnets with the following settings:
6464

6565
| Setting | Value |
6666
|--------------------------|----------------------|
6767
| Add IPv4 address space | 10.0.0.0/16 (default)|
68-
| Subnets | default |
68+
| Subnets | |
69+
| **Workload subnet** | |
6970
| Name | Workload-01-SN |
7071
| Starting address | 10.0.1.0/24 |
72+
| **Bastion subnet** | |
73+
| Name | AzureBastionSubnet |
74+
| Starting address | 10.0.2.0/26 |
7175

7276

7377

@@ -161,16 +165,20 @@ Now you can peer the hub and spoke virtual networks.
161165
## Deploy the servers
162166

163167
1. On the Azure portal, select **Create a resource**.
164-
1. Select **Windows Server 2019 Datacenter** in the **Popular** list.
168+
1. Search for **Ubuntu Server 22.04 LTS** and select it.
169+
1. Select **Create** > **Virtual machine**.
165170
1. Enter these values for the virtual machine:
166171

167172
|Setting |Value |
168173
|---------|---------|
169174
|Resource group |**fw-manager-rg**|
170175
|Virtual machine name |**Srv-workload-01**|
171176
|Region |**(US) East US**|
172-
|Administrator user name |type a user name|
173-
|Password |type a password|
177+
|Image |**Ubuntu Server 22.04 LTS - x64 Gen2**|
178+
|Authentication type |**SSH public key**|
179+
|Username |**azureuser**|
180+
|SSH public key source |**Generate new key pair**|
181+
|Key pair name |**srv-workload-01_key**|
174182

175183
1. Under **Inbound port rules**, for **Public inbound ports**, select **None**.
176184
1. Accept the other defaults and select **Next: Disks**.
@@ -182,8 +190,9 @@ Now you can peer the hub and spoke virtual networks.
182190
1. Select **Disable** to disable boot diagnostics.
183191
1. Accept the other defaults and select **Review + create**.
184192
1. Review the settings on the summary page, and then select **Create**.
193+
1. When prompted, download and save the private key file (for example, **srv-workload-01_key.pem**).
185194

186-
Use the information in the following table to configure another virtual machine named **Srv-Workload-02**. The rest of the configuration is the same as the **Srv-workload-01** virtual machine.
195+
Use the information in the following table to configure another virtual machine named **Srv-Workload-02**. The rest of the configuration is the same as the **Srv-workload-01** virtual machine, but use a different key pair name such as **srv-workload-02_key**.
187196

188197
|Setting |Value |
189198
|---------|---------|
@@ -192,6 +201,47 @@ Use the information in the following table to configure another virtual machine
192201

193202
After the servers are deployed, select a server resource, and in **Networking** note the private IP address for each server.
194203

204+
### Install Nginx on the servers
205+
206+
After the virtual machines are deployed, install Nginx on both servers to verify web connectivity later.
207+
208+
1. In the Azure portal, navigate to the **Srv-workload-01** virtual machine.
209+
1. Select **Run command** > **RunShellScript**.
210+
1. Run the following command:
211+
212+
```bash
213+
sudo apt-get update && sudo apt-get install -y nginx && echo '<h1>Srv-workload-01</h1>' | sudo tee /var/www/html/index.html
214+
```
215+
216+
1. Repeat the same steps for **Srv-workload-02**, replacing the hostname in the echo command:
217+
218+
```bash
219+
sudo apt-get update && sudo apt-get install -y nginx && echo '<h1>Srv-workload-02</h1>' | sudo tee /var/www/html/index.html
220+
```
221+
222+
### Deploy Azure Bastion
223+
224+
Deploy Azure Bastion in the Spoke-01 virtual network to securely connect to the virtual machines.
225+
226+
1. In the Azure portal, search for **Bastions** and select it.
227+
1. Select **Create**.
228+
1. Configure the Bastion with the following settings:
229+
230+
| Setting | Value |
231+
|------------------------|----------------------|
232+
| Subscription | Select your subscription |
233+
| Resource group | **fw-manager-rg** |
234+
| Name | **Bastion-01** |
235+
| Region | **East US** |
236+
| Tier | **Developer** |
237+
| Virtual network | **Spoke-01** |
238+
| Subnet | **AzureBastionSubnet (10.0.2.0/26)** |
239+
240+
1. Select **Review + create**, then select **Create**.
241+
242+
> [!NOTE]
243+
> Azure Bastion deployment can take approximately 10 minutes to complete.
244+
195245
## Create a firewall policy and secure your hub
196246

197247
A firewall policy defines collections of rules to direct traffic on one or more Secured virtual hubs. You create your firewall policy and then secure your hub.
@@ -221,44 +271,25 @@ A firewall policy defines collections of rules to direct traffic on one or more
221271
| Destination | **\*.microsoft.com** |
222272

223273

224-
1. Select **Add**.
225-
1. Add a **DNAT rule** so you can connect a remote desktop to the **Srv-Workload-01** virtual machine.
226-
1. Select **Add a rule collection** and enter the following information.
227-
228-
| Setting | Value |
229-
|------------------------|--------------------------------------------|
230-
| Name | **dnat-rdp** |
231-
| Rule collection type | **DNAT** |
232-
| Priority | **100** |
233-
| Rule Name | **Allow-rdp** |
234-
| Source type | **IP address** |
235-
| Source | **\*** |
236-
| Protocol | **TCP** |
237-
| Destination Ports | **3389** |
238-
| Destination | The firewall public IP address noted previously. |
239-
| Translated type | **IP Address** |
240-
| Translated address | The private IP address for **Srv-Workload-01** noted previously. |
241-
| Translated port | **3389** |
242-
243274
1. Select **Add**.
244275

245-
1. Add a **Network rule** so you can connect a remote desktop from **Srv-Workload-01** to **Srv-Workload-02**.
276+
1. Add a **Network rule** to allow SSH and HTTP traffic between the spoke virtual networks.
246277

247278
1. Select **Add a rule collection** and enter the following information.
248279

249280
| Setting | Value |
250281
|------------------------|--------------------------------------------|
251-
| Name | **vnet-rdp** |
282+
| Name | **vnet-access** |
252283
| Rule collection type | **Network** |
253284
| Priority | **100** |
254285
| Rule collection action | **Allow** |
255-
| Rule Name | **Allow-vnet** |
286+
| Rule Name | **Allow-SSH-HTTP** |
256287
| Source type | **IP address** |
257-
| Source | **\*** |
288+
| Source | **10.0.0.0/16,10.1.0.0/16** |
258289
| Protocol | **TCP** |
259-
| Destination Ports | **3389** |
290+
| Destination Ports | **22,80** |
260291
| Destination Type | **IP Address** |
261-
| Destination | The **Srv-Workload-02** private IP address that you noted previously. |
292+
| Destination | **10.0.0.0/16,10.1.0.0/16** |
262293

263294

264295
1. Select **Add**, then select **Next: IDPS**.
@@ -302,34 +333,64 @@ Now you must ensure that network traffic gets routed through your firewall.
302333

303334
## Test the firewall
304335

305-
To test the firewall rules, connect a remote desktop using the firewall public IP address, which is NATed to **Srv-Workload-01**. From there, use a browser to test the application rule and connect a remote desktop to **Srv-Workload-02** to test the network rule.
336+
To test the firewall rules, use Azure Bastion to connect to **Srv-Workload-01** and verify both the application and network rules are working.
306337

307338
### Test the application rule
308339

309340
Now, test the firewall rules to confirm that it works as expected.
310341

311-
1. Connect a remote desktop to firewall public IP address, and sign in.
342+
1. In the Azure portal, navigate to the **Srv-workload-01** virtual machine.
343+
1. Select **Connect** > **Connect via Bastion**.
344+
1. Provide the username **azureuser** and upload the private key `.pem` file that you downloaded when you created the VM.
345+
1. Select **Connect** to open an SSH session.
346+
347+
1. In the SSH session, run the following command to test access to Microsoft:
312348

313-
2. Open Internet Explorer and browse to `https://www.microsoft.com`.
314-
3. Select **OK** > **Close** on the Internet Explorer security alerts.
349+
```bash
350+
curl https://www.microsoft.com
351+
```
315352

316-
You should see the Microsoft home page.
353+
You should see HTML content returned, confirming access is allowed.
317354

318-
4. Browse to `https://www.google.com`.
355+
1. Test access to Google (which should be blocked):
319356

320-
The firewall should block this.
357+
```bash
358+
curl https://www.google.com
359+
```
360+
361+
The request should timeout or fail, showing the firewall is blocking this site.
321362

322363
So now you verified that the firewall application rule is working:
323364

324365
* You can browse to the one allowed FQDN, but not to any others.
325366

326367
### Test the network rule
327368

328-
Now test the network rule.
369+
Now test the network rule by connecting from **Srv-Workload-01** to **Srv-Workload-02** using SSH and HTTP.
370+
371+
1. From the SSH session on **Srv-Workload-01**, note the private IP address of **Srv-Workload-02** (visible in the Azure portal under the VM's networking settings).
372+
373+
1. Test SSH connectivity to **Srv-Workload-02**:
374+
375+
```bash
376+
ssh azureuser@<Srv-Workload-02-private-IP>
377+
```
378+
379+
Type `yes` to accept the host key, then enter the connection. You may need to upload the private key for Srv-Workload-02 if using key-based authentication.
380+
381+
1. Exit the SSH session to Srv-Workload-02:
382+
383+
```bash
384+
exit
385+
```
386+
387+
1. Test HTTP connectivity to the Nginx web server on **Srv-Workload-02**:
329388

330-
- From Srv-Workload-01, open a remote desktop to the Srv-Workload-02 private IP address.
389+
```bash
390+
curl http://<Srv-Workload-02-private-IP>
391+
```
331392

332-
A remote desktop should connect to Srv-Workload-02.
393+
You should see the HTML content `<h1>Srv-workload-02</h1>`, confirming the network rule allows HTTP traffic between spokes.
333394

334395
So now you verified that the firewall network rule is working:
335396
* You can connect a remote desktop to a server located in another virtual network.

0 commit comments

Comments
 (0)