Skip to content

Commit d9fc1d8

Browse files
prmerger-automator[bot]prmerger-automator[bot]
authored
Merge pull request #312013 from asudbring/tsk544797-sfi-ssh
Update diagnose network security rules article structure
2 parents c81bc1a + 387f765 commit d9fc1d8

1 file changed

Lines changed: 113 additions & 56 deletions

File tree

‎articles/network-watcher/diagnose-network-security-rules.md‎

Lines changed: 113 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ author: halkazwini
66
ms.author: halkazwini
77
ms.service: azure-network-watcher
88
ms.topic: how-to
9-
ms.date: 10/30/2024
9+
ms.date: 02/19/2026
1010
ms.custom:
1111
- devx-track-azurepowershell
1212
- devx-track-azurecli
@@ -50,9 +50,51 @@ The example in this article shows you how a misconfigured network security group
5050

5151
---
5252

53-
## Create a virtual network and a Bastion host
53+
## Create a resource group
5454

55-
In this section, you create a virtual network with two subnets and an Azure Bastion host. The first subnet is used for the virtual machine, and the second subnet is used for the Bastion host. You also create a network security group and apply it to the first subnet.
55+
# [**Portal**](#tab/portal)
56+
57+
1. Sign in to the [Azure portal](https://portal.azure.com).
58+
59+
1. In the search box at the top of the portal, enter **Resource group**. Select **Resource groups** in the search results.
60+
61+
1. Select **+ Create**.
62+
63+
1. In the **Basics** tab of **Create a resource group**, enter, or select the following information:
64+
65+
| Setting | Value |
66+
| --- | --- |
67+
| Subscription | Select your subscription. |
68+
| Resource group | Enter **myResourceGroup**. |
69+
| Region | Select **East US**. |
70+
71+
1. Select **Review + create**.
72+
73+
1. Select **Create**.
74+
75+
# [**PowerShell**](#tab/powershell)
76+
77+
Create a resource group using [New-AzResourceGroup](/powershell/module/az.resources/new-azresourcegroup). An Azure resource group is a logical container into which Azure resources are deployed and managed.
78+
79+
```azurepowershell-interactive
80+
# Create a resource group.
81+
New-AzResourceGroup -Name 'myResourceGroup' -Location 'eastus'
82+
```
83+
84+
# [**Azure CLI**](#tab/cli)
85+
86+
Create a resource group using [az group create](/cli/azure/group#az-group-create). An Azure resource group is a logical container into which Azure resources are deployed and managed.
87+
88+
```azurecli-interactive
89+
# Create a resource group.
90+
az group create --name 'myResourceGroup' --location 'eastus'
91+
```
92+
93+
---
94+
95+
## Create a virtual network
96+
97+
In this section, you create a virtual network with a subnet and a network security group applied to the subnet.
5698

5799
# [**Portal**](#tab/portal)
58100

@@ -66,21 +108,14 @@ In this section, you create a virtual network with two subnets and an Azure Bast
66108
| --- | --- |
67109
| **Project Details** | |
68110
| Subscription | Select your Azure subscription. |
69-
| Resource Group | Select **Create new**. </br> Enter ***myResourceGroup*** in **Name**. </br> Select **OK**. |
111+
| Resource Group | Select **myResourceGroup**. |
70112
| **Instance details** | |
71113
| Virtual network name | Enter ***myVNet***. |
72114
| Region | Select **(US) East US**. |
73115

74-
1. Select the **Security** tab, or select the **Next** button at the bottom of the page.
75-
76-
1. Under **Azure Bastion**, select **Enable Azure Bastion** and accept the default values:
77-
78-
| Setting | Value |
79-
| --- | --- |
80-
| Azure Bastion host name | **myVNet-Bastion**. |
81-
| Azure Bastion public IP Address | **(New) myVNet-bastion-publicIpAddress**. |
116+
1. Select **Next** to proceed to the **Security** tab.
82117

83-
1. Select the **IP Addresses** tab, or select **Next** button at the bottom of the page.
118+
1. Select **Next** to proceed to the **IP Addresses** tab.
84119

85120
1. Accept the default IP address space **10.0.0.0/16** and edit the default subnet by selecting the pencil icon. In the **Edit subnet** page, enter the following values:
86121

@@ -91,64 +126,36 @@ In this section, you create a virtual network with two subnets and an Azure Bast
91126
| **Security** | |
92127
| Network security group | Select **Create new**. </br> Enter ***mySubnet-nsg*** in **Name**. </br> Select **OK**. |
93128

94-
1. Select the **Review + create**.
129+
1. Select **Save**.
95130

96-
1. Review the settings, and then select **Create**.
131+
1. Select **Review + create** at the bottom of the screen, and when validation passes, select **Create**.
97132

98133
# [**PowerShell**](#tab/powershell)
99134

100-
1. Create a resource group using [New-AzResourceGroup](/powershell/module/az.resources/new-azresourcegroup). An Azure resource group is a logical container into which Azure resources are deployed and managed.
101-
102-
```azurepowershell-interactive
103-
# Create a resource group.
104-
New-AzResourceGroup -Name 'myResourceGroup' -Location 'eastus'
105-
```
106-
107135
1. Create a default network security group using [New-AzNetworkSecurityGroup](/powershell/module/az.network/new-aznetworksecuritygroup).
108136

109137
```azurepowershell-interactive
110138
# Create a network security group.
111139
$networkSecurityGroup = New-AzNetworkSecurityGroup -Name 'mySubnet-nsg' -ResourceGroupName 'myResourceGroup' -Location 'eastus'
112140
```
113141
114-
1. Create a subnet configuration for the virtual machine subnet and the Bastion host subnet using [New-AzVirtualNetworkSubnetConfig](/powershell/module/az.network/new-azvirtualnetworksubnetconfig).
142+
1. Create subnet configurations for the virtual machine subnet and Azure Bastion subnet using [New-AzVirtualNetworkSubnetConfig](/powershell/module/az.network/new-azvirtualnetworksubnetconfig).
115143
116144
```azurepowershell-interactive
117-
# Create subnets configuration.
145+
# Create subnet configurations.
118146
$firstSubnet = New-AzVirtualNetworkSubnetConfig -Name 'mySubnet' -AddressPrefix '10.0.0.0/24' -NetworkSecurityGroup $networkSecurityGroup
119-
$secondSubnet = New-AzVirtualNetworkSubnetConfig -Name 'AzureBastionSubnet' -AddressPrefix '10.0.1.0/26'
147+
$secondSubnet = New-AzVirtualNetworkSubnetConfig -Name 'AzureBastionSubnet' -AddressPrefix '10.0.1.0/26'
120148
```
121149
122150
1. Create a virtual network using [New-AzVirtualNetwork](/powershell/module/az.network/new-azvirtualnetwork).
123151
124152
```azurepowershell-interactive
125153
# Create a virtual network.
126-
$vnet = New-AzVirtualNetwork -Name 'myVNet' -ResourceGroupName 'myResourceGroup' -Location 'eastus' -AddressPrefix '10.0.0.0/16' -Subnet $firstSubnet, $secondSubnet
127-
```
128-
129-
1. Create the public IP address resource required for the Bastion host using [New-AzPublicIpAddress](/powershell/module/az.network/new-azpublicipaddress).
130-
131-
```azurepowershell-interactive
132-
# Create a public IP address for Azure Bastion.
133-
New-AzPublicIpAddress -ResourceGroupName 'myResourceGroup' -Name 'myBastionIp' -Location 'eastus' -AllocationMethod 'Static' -Sku 'Standard'
134-
```
135-
136-
1. Create the Bastion host using [New-AzBastion](/powershell/module/az.network/new-azbastion).
137-
138-
```azurepowershell-interactive
139-
# Create an Azure Bastion host.
140-
New-AzBastion -ResourceGroupName 'myResourceGroup' -Name 'myVNet-Bastion' -PublicIpAddressRgName 'myResourceGroup' -PublicIpAddressName 'myBastionIp' -VirtualNetwork $vnet
154+
$vnet = New-AzVirtualNetwork -Name 'myVNet' -ResourceGroupName 'myResourceGroup' -Location 'eastus' -AddressPrefix '10.0.0.0/16' -Subnet $firstSubnet,$secondSubnet
141155
```
142156
143157
# [**Azure CLI**](#tab/cli)
144158
145-
1. Create a resource group using [az group create](/cli/azure/group#az-group-create). An Azure resource group is a logical container into which Azure resources are deployed and managed.
146-
147-
```azurecli-interactive
148-
# Create a resource group.
149-
az group create --name 'myResourceGroup' --location 'eastus'
150-
```
151-
152159
1. Create a default network security group using [az network nsg create](/cli/azure/network/nsg#az-network-nsg-create).
153160
154161
```azurecli-interactive
@@ -162,24 +169,74 @@ In this section, you create a virtual network with two subnets and an Azure Bast
162169
az network vnet create --resource-group 'myResourceGroup' --name 'myVNet' --subnet-name 'mySubnet' --subnet-prefixes 10.0.0.0/24 --network-security-group 'mySubnet-nsg'
163170
```
164171
165-
1. Create a subnet for Azure Bastion using [az network vnet subnet create](/cli/azure/network/vnet/subnet#az-network-vnet-subnet-create).
172+
1. Create an Azure Bastion subnet using [az network vnet subnet create](/cli/azure/network/vnet/subnet#az-network-vnet-subnet-create).
166173
167174
```azurecli-interactive
168-
# Create AzureBastionSubnet.
169-
az network vnet subnet create --name 'AzureBastionSubnet' --resource-group 'myResourceGroup' --vnet-name 'myVNet' --address-prefixes '10.0.1.0/26'
175+
az network vnet subnet create --resource-group 'myResourceGroup' --vnet-name 'myVNet' --name 'AzureBastionSubnet' --address-prefixes 10.0.1.0/26
170176
```
171177
172-
1. Create a public IP address for the Bastion host using [az network public-ip create](/cli/azure/network/public-ip#az-network-public-ip-create).
178+
---
179+
180+
## Deploy Azure Bastion
181+
182+
Azure Bastion uses your browser to connect to virtual machines (VMs) in your virtual network over secure shell (SSH) or remote desktop protocol (RDP) by using their private IP addresses. The virtual machines don't need public IP addresses, client software, or special configuration. For more information about Azure Bastion, see [Azure Bastion](/azure/bastion/bastion-overview).
183+
184+
>[!NOTE]
185+
>[!INCLUDE [Pricing](~/reusable-content/ce-skilling/azure/includes/bastion-pricing.md)]
186+
187+
# [**Portal**](#tab/portal)
188+
189+
1. In the search box at the top of the portal, enter **Bastion**. Select **Bastions** in the search results.
190+
191+
1. Select **+ Create**.
192+
193+
1. In the **Basics** tab of **Create a Bastion**, enter, or select the following information:
194+
195+
| Setting | Value |
196+
| --- | --- |
197+
| **Project details** | |
198+
| Subscription | Select your subscription. |
199+
| Resource group | Select **myResourceGroup**. |
200+
| **Instance details** | |
201+
| Name | Enter **myVNet-Bastion**. |
202+
| Region | Select **East US**. |
203+
| Tier | Select **Developer**. |
204+
| **Configure virtual networks** | |
205+
| Virtual network | Select **myVNet**. |
206+
| Subnet | The **AzureBastionSubnet** is created automatically with an address space of **/26** or larger. |
207+
208+
1. Select **Review + create**.
209+
210+
1. Select **Create**.
211+
212+
# [**PowerShell**](#tab/powershell)
213+
214+
1. Create a public IP address for Azure Bastion using [New-AzPublicIpAddress](/powershell/module/az.network/new-azpublicipaddress).
215+
216+
```azurepowershell-interactive
217+
# Create a public IP address for Azure Bastion.
218+
$bastionIp = New-AzPublicIpAddress -ResourceGroupName 'myResourceGroup' -Name 'myBastionIp' -Location 'eastus' -Sku 'Standard' -AllocationMethod 'Static'
219+
```
220+
221+
1. Create a Basic SKU Bastion host using [New-AzBastion](/powershell/module/az.network/new-azbastion).
222+
223+
```azurepowershell-interactive
224+
# Create an Azure Bastion host.
225+
New-AzBastion -ResourceGroupName 'myResourceGroup' -Name 'myVNet-Bastion' -PublicIpAddressRgName 'myResourceGroup' -PublicIpAddressName 'myBastionIp' -VirtualNetworkRgName 'myResourceGroup' -VirtualNetworkName 'myVNet' -Sku 'Basic'
226+
```
227+
228+
# [**Azure CLI**](#tab/cli)
229+
230+
1. Create a public IP address for Azure Bastion using [az network public-ip create](/cli/azure/network/public-ip#az-network-public-ip-create).
173231
174232
```azurecli-interactive
175-
# Create a public IP address resource.
176-
az network public-ip create --resource-group 'myResourceGroup' --name 'myBastionIp' --sku Standard
233+
az network public-ip create --resource-group 'myResourceGroup' --name 'myBastionIp' --sku 'Standard' --location 'eastus'
177234
```
178235
179-
1. Create a Bastion host using [az network bastion create](/cli/azure/network/bastion#az-network-bastion-create).
236+
1. Create a Basic SKU Bastion host using [az network bastion create](/cli/azure/network/bastion#az-network-bastion-create).
180237
181238
```azurecli-interactive
182-
az network bastion create --name 'myVNet-Bastion' --public-ip-address 'myBastionIp' --resource-group 'myResourceGroup' --vnet-name 'myVNet'
239+
az network bastion create --name 'myVNet-Bastion' --resource-group 'myResourceGroup' --vnet-name 'myVNet' --public-ip-address 'myBastionIp' --sku 'Basic' --location 'eastus'
183240
```
184241
185242
---
@@ -224,7 +281,7 @@ In this section, you create a virtual machine and a network security group appli
224281
| --- | --- |
225282
| **Network interface** | |
226283
| Virtual network | Select **myVNet**. |
227-
| Subnet | Select **default**. |
284+
| Subnet | Select **mySubnet**. |
228285
| Public IP | Select **None**. |
229286
| NIC network security group | Select **Basic**. |
230287
| Public inbound ports | Select **None**. |

0 commit comments

Comments
 (0)