fix merge

Author: asudbring

articles/firewall/tutorial-firewall-deploy-portal.md

@@ -25,7 +25,7 @@ Network traffic is subjected to the configured firewall rules when you route you
 
 For this article, you create a simplified single virtual network with two subnets for easy deployment.
 
-For production deployments, a [hub and spoke model](/azure/architecture/reference-architectures/hybrid-networking/hub-spoke) is recommended, where the firewall is in its own virtual network. The workload servers are in peered virtual networks in the same region with one or more subnets.
+For production deployments, a [hub and spoke model](/azure/architecture/reference-architectures/hybrid-networking/hub-spoke) is recommended, where the firewall is in its own virtual network. The workload servers are in peered virtual networks in West US with one or more subnets.
 
 * **AzureFirewallSubnet** - the firewall is in this subnet.
 * **Workload-SN** - the workload server is in this subnet. This subnet's network traffic goes through the firewall.
@@ -64,7 +64,7 @@ The resource group contains all the resources used in this procedure.
 2. On the Azure portal menu, select **Resource groups** or search for and select *Resource groups* from any page. Then select **Create**.
 4. For **Subscription**, select your subscription.
 1. For **Resource group** name, type **Test-FW-RG**.
-1. For **Region**, select a region. All other resources that you create must be in the same region.
+1. For **Region**, select **West US**. All other resources that you create must be in West US.
 1. Select **Review + create**.
 1. Select **Create**.
 
@@ -81,7 +81,7 @@ This virtual network has two subnets.
 1. For **Subscription**, select your subscription.
 1. For **Resource group**, select **Test-FW-RG**.
 1. For **Virtual network name**, type **Test-FW-VN**.
-1. For **Region**, select the same region that you used previously.
+1. For **Region**, select **West US**.
 1. Select **Next**.
 1. On the **Security** tab, select **Enable Azure Firewall**.
 1. For **Azure Firewall name**, type **Test-FW01**.
@@ -110,10 +110,13 @@ Now create the workload virtual machine, and place it in the **Workload-SN** sub
    |---------|---------|
    |Resource group     |**Test-FW-RG**|
    |Virtual machine name     |**Srv-Work**|
-   |Region     |Same as previous|
-   |Image|Windows Server 2019 Datacenter|
-   |Administrator user name     |Type a user name|
-   |Password     |Type a password|
+   |Region     |West US|
+   |Image|Ubuntu Server 22.04 LTS - x64 Gen2|
+   |Size|Standard_B2s|
+   |Authentication type|SSH public key|
+   |Username     |**azureuser**|
+   |SSH public key source|Generate new key pair|
+   |Key pair name|**Srv-Work_key**|
 
 4. Under **Inbound port rules**, **Public inbound ports**, select **None**.
 6. Accept the other defaults and select **Next: Disks**.
@@ -147,7 +150,7 @@ For the **Workload-SN** subnet, configure the outbound default route to go throu
 1. Select **Create**.
 1. For **Subscription**, select your subscription.
 1. For **Resource group**, select **Test-FW-RG**.
-1. For **Region**, select the same location that you used previously.
+1. For **Region**, select **West US**.
 1. For **Name**, type **Firewall-route**.
 1. Select **Review + create**.
 1. Select **Create**.
@@ -227,6 +230,25 @@ This rule allows you to connect a remote desktop to the Srv-Work virtual machine
 12. For **Translated port**, type **3389**.
 13. Select **Add**.
 
+   | Setting | Value |
+   |---------|-------|
+   | Subscription | Select your subscription |
+   | Resource group | **Test-FW-RG** |
+   | Name | **Test-Bastion** |
+   | Region | West US |
+   | Tier | **Developer** |
+   | Virtual network | **Test-FW-VN** |
+   | Subnet | Select **Manage subnet configuration** |
+
+1. In the **Subnets** page, select **+ Subnet**.
+1. Configure the new subnet:
+   - **Name**: **AzureBastionSubnet** (this name is required)
+   - **Subnet address range**: **10.0.4.0/26**
+1. Select **Save** and close the subnets page.
+1. Select **Review + create**.
+1. After validation passes, select **Create**.
+
+   The Bastion deployment takes about 10 minutes to complete.
 
 ### Change the primary and secondary DNS address for the **Srv-Work** network interface