Log in failed Azure Bastion

Ravichandran, Gopi Krishna 161

Hi,

I have created Windows VM (with private end point) and provisioned a bastion host for accessing the VM. I am getting Log in the failed message when i get connect to the bastion host. I followed some of Microsoft blog post on this topic and configured the NSGs with the support of Azure documentation.

But still, I am stuck in accessing the bastion.

Please can you help me if anything is missing.

KapilAnanth-MSFT 45,111 Reputation points Microsoft Employee

2022-10-18T11:38:27.81+00:00
Hi @Ravichandran, Gopi Krishna ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are facing challenges with your new Bastion resource.

I am not sure what you refer by "Windows VM with Private EndPoint". Private EndPoints can only be associated with a PaaS resource.
Please elaborate

Kindly let me know about the following,

Are the Bastion and VM in same VNet or different VNet (that are peered together)

Can you attach a Public IP to the VM and see if RDP succeeds (this is to make sure that VM is actually listening)

Can you deploy a new TestVM in the same subnet of the affectedVM and try to RDP using Bastion?

By the looks of the NSG you have shared, I do not see any conflict.

Can you please make sure there are no NSGs associated to the NIC/subnet of the VM other than the one you have shared?

Feel free to let us know if you face any challenges with the above.

Cheers,
Kapil
Ravichandran, Gopi Krishna 161 Reputation points

2022-10-19T08:18:43.267+00:00

Hi,

It is a typo and It should be private IP.

I tried following the above steps and RDP works when associating the public IP. Is there any possibility to diagnose the connectivity or get to know of details for login failure?

I am new to azure and trying to understand how things work
Ravichandran, Gopi Krishna 161 Reputation points

2022-10-19T08:40:55.08+00:00

I am using Windows server VM just to let you know
KapilAnanth-MSFT 45,111 Reputation points Microsoft Employee

2022-10-19T10:03:49.8+00:00
Hi @Ravichandran, Gopi Krishna ,

Can you please check if the provisioning state of Azure bastion is succeeded?

If not, you can do a simple Get and the Set on Bastion or try and recreate it (if it's a new set up)

May I ask if you are using Bastion native client or trying to use Bastion from Azure Portal?

Get the Public DNS name of the Bastion , it should be available on the overview page

And then, open powershell from a windows machine and run, *"tnc <bst-******>.bastion.azure.com -p 443"* to check if TCP succeeds

Refer :
Get-AzBastion
Set-AzBastion

Cheers,
Kapil
Ravichandran, Gopi Krishna 161 Reputation points

2022-10-20T08:10:37.617+00:00

Hi Kapil,

Thank you so much for sharing the troubleshooting steps. I recreated the VM and removed all NSG's associated with the VM or Bastion subnet. Then it started to work.

It was not clear how Bastion works without NSG's and it will be good to understand this if there is any documentation on this.

Thank you for your support!
KapilAnanth-MSFT 45,111 Reputation points Microsoft Employee

2022-10-20T10:11:32.627+00:00

Hi @Ravichandran, Gopi Krishna ,

NSG requirements for Bastion is defined in this particular document.
Working with NSG access and Azure Bastion

I already did check your NSG configuration from the screenshot you have posted, and they are on par with the requirements.

However, I would suggest you add a NSG to the newly created Bastion and double verify the rules (just to make sure we are not missing anything)

Cheers,
Kapil

Accepted answer

KapilAnanth-MSFT 45,111 Reputation points Microsoft Employee

2022-11-07T11:36:47.787+00:00

Hi @Ravichandran, Gopi Krishna ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are facing challenges with your new Bastion resource.

You informed us that you recreated the VM and removed all NSG's associated with the VM/Bastion subnet.
And it started to work. You wanted to understand how Bastion works with NSG

I suggested you refer: Working with NSG access and Azure Bastion

Thank you for your contribution to the Microsoft Q&A Community.

Thanks,
Kapil

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

1 additional answer

Ravichandran, Gopi Krishna 161 Reputation points

2022-10-18T11:05:36.72+00:00
Please sign in to rate this answer.

1 person found this answer helpful.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Log in failed Azure Bastion

1 additional answer

Your answer