DEPLOYING SECURE VMs THAT CAN BE ACCESSED ONLY THROUGH NSG RULE + AZURE BASTION

*DEPLOYING SECURE VMs THAT CAN BE ACCESSED ONLY THROUGH NSG RULE + AZURE BASTION WITHOUT EXPOSURE TO THE INTERNET. *

Architectural Drawing of VM Using Bastion and NSG

Step One: Sign in to the Azure Portal and create a new Resource Group as shown below:

1. Type Resource Group in the search box and select it as indicated in the screenshot.
2. Click on “Create” in the Resource Group window.
3. Enter the Resource Group name and select your preferred region.
4. Finally, click on “review and create” to create the Resource Group .

Step Two: Create Virtual Network.

1. Search for Virtual Network by typing it in the search box as indicated in the screenshot below, and select Virtual Network.
2. On the virtual Network page, click on “Create”.
3. Select your Resource Group and enter your Virtual Network name, then click on next.
4. Under the Address space, confirm your CIDR range then review and create.
5. Finally, click on “Create” to create your Virtual Network.

**Step Three (3): Create Subnets.
**For this project, two subnets are required; the main subnet and the Azure Bastion subnet.

1. To create the main subnet, click on the virtual network you have created, then search for “Subnets” in the search box and select it as shown in the screenshot below
2. On the “Add Subnets” page, input your subnet name then click on “Add” as shown below.

*Create Azure Bastion-Subnet. *

1. To create the Azure Bastion subnet, Under the “Add a subnet” page, click on Subnets.
2. Select Azure Bastion for Subnet purpose as shown in the screenshot.
3. Finally, click on Add to create your Azure Bastion subnet.

STEP FOUR (4): Create Azure Bastion.

1. Type Bastions in the search box and select Bastions as indicated in the screenshot.
2. Click on Create on the Bastions page.
3. On the Add a Bastion page, select your Resource group, enter your Bastion name and indicate the desired instance count as shown in the screenshot.
4. Click on Review and create, then “Create” to create your Bastion.

STEP FIVE (5): Create Virtual Machine.

1. To spin up any virtual machine type “Virtual machines” in the search box as indicated in the screenshot, then select Virtual machines. On the “Compute Infrastructure” page, under virtual machine click on create and select Virtual machine as shown in the screenshot below
2. On the Create a Virtual machine page, select your Resource group, enter your virtual machine name, select your desired zone, then click on “Next: Disk” as indicated below.
3. On the next page select your desired availability zone. For windows VM select desired Windows image, architecture and size as shown in the screenshot, then click on Next: Disk
4. For Windows VM enter the username, password, and confirm password, then click on next: disk
5. Next, select your virtual network and subnet. For public IP select None, for NIC select Basic and for Public inbound port select None as shown in the screenshot.
6. Finally, click on review and create, then create.

1. For Linux VM select desired Ubuntu image, architecture and size as shown in the screenshot, then click on Next: Disk
2. Select SSH public key, input username, generate keypair, select RSA SSH format, then click on Next: Disk as shown below.
3. For public inbound port, select None as shown below, then click on Next: Disk
4. Next, select your virtual network and subnet. For public IP select None, for NIC select Basic and for Public inbound port select None as shown in the screenshot.
5. Finally, click on review and create, then create

Create a Network Security Group (NSG) for port 3389.

1. To create NSG, click on the Windows virtual machine, scroll down and click on Networking.
2. Select Network settings as indicated in the screenshot below.
3. Click on Create port rule as indicated in the screenshot, then Inbound port rule.
4. Under “Add security rule” select “Any” for source, select “asterisk” for source port ranges, “Any” for destination, and “RDP” for service and 3389 for destination port ranges as shown below. For Linux VM, select SSH for service and 22 for destination port ranges.
5. Select TCP for protocol, for Action select “Allow”, for priority select “100”

Connecting to the secure VM via Bastion using SSH Port 22.

1. Open the virtual machine, then click on connect.
2. Click on connect via Bastion
3. Click on Bastion, then select SSH.
4. Enter your username, keypair (from your download folder) and password. And connect.

Connecting to the secure VM via Bastion using RDP Port 3389.