9. Connecting to resources securely

Exposing management endpoints (RDP, SSH, HTTP, and others) over a public IP address is not a good idea. Any kind of management access should be controlled and allowed only over a secure connection. Usually, this is done by connecting to a private network (via S2S or P2S) and accessing resources over private IP addresses. In some situations, this is not easy to achieve. The cause of this can be insufficient local infrastructure, or in some cases, the scenario may be too complex. Fortunately, there are other ways to achieve the same goal. We can safely connect to our resources using Azure Bastion, Azure Virtual WAN, and Azure Private Link.

We will cover the following recipes in this chapter:

• Creating an Azure Bastion instance
• Connecting to a virtual machine with Azure Bastion
• Creating a virtual WAN
• Creating a hub (in Virtual WAN)
• Adding a Site-to-Site connection (in a virtual hub)
• Adding a virtual network connection...

Technical requirements

For this chapter, the following is required:

• An Azure subscription

Creating an Azure Bastion instance

Azure Bastion allows us to connect securely to our Azure resources without additional infrastructure. All we need is a browser. It is essentially a PaaS service provisioned in our virtual network that provides a secure RDP/SSH connection to Azure Virtual Machines. The connection is made directly from the Azure portal over Transport Layer Security (TLS).

Getting ready

Before we can create an Azure Bastion instance, we must prepare the subnet.

In order to create a new subnet for Azure Bastion, we must do the following:

1. Locate the virtual network that will be associated with our Azure Bastion instance.
2. Select the Subnets option under Settings and select the option to add a new subnet, as shown in Figure 9.1:
   

   Figure 9.1: Creating a new subnet for Azure Bastion

3. In the new pane, we must fill in the Name and Address range fields. It's very important that the subnet is named AzureBastionSubnet and that the subnet uses a prefix...

Connecting to a virtual machine with Azure Bastion

With Azure Bastion, we can connect to a virtual machine through the browser without a public IP address and without exposing it publicly.

Getting ready

Before you start, open the browser and go to the Azure portal via https://portal.azure.com.

How to do it…

In order to connect to a virtual machine with Azure Bastion, we must follow these steps:

1. In the Azure portal, find the virtual machine you want to connect to. The virtual machine needs to be on the same virtual network as Azure Bastion is deployed on.
2. In the Virtual machine pane, select the Connect option under Settings. Select the BASTION tab, and on that tab, select Use Bastion:
   

   Figure 9.4: Connecting to a virtual machine with Azure Bastion

3. Select the Open in new window option and fill in Username and Password:

Figure 9.5: Adding a username and password for the virtual machine

The connection will open in a new...

Creating a virtual WAN

In many situations, the network topology can get very complex. It can be difficult to keep track of all network connections, gateways, and peering processes. Azure Virtual WAN provides a single interface to manage all these points.

Getting ready

Before you start, open the browser and go to the Azure portal via https://portal.azure.com.

How to do it…

1. In the Azure portal, select Create a resource and choose Virtual WAN under Networking (or search for Virtual WAN in the search bar).
2. In the new pane, we must provide information for the Subscription, Resource group, Resource group location, Name, and Type fields:
3. 

Figure 9.6: Information for the virtual WAN resource

Azure Virtual WAN is ready for deployment and it usually takes only a few minutes to complete.

How it works…

Azure Virtual WAN brings multiple network services to a single point. From here, we can configure, control, and monitor connections such as...

Creating a hub (in Virtual WAN)

Hubs are used as regional connection points. They contain multiple service endpoints that enable connectivity between different networks and services. They're the core of networking for each region.

Getting ready

Before you start, open the browser and go to the Azure portal via https://portal.azure.com.

How to do it…

1. In the Azure portal, locate the previously created virtual WAN.
2. In the Virtual WAN pane, select Hubs under the Connectivity section. Select the option to add a new hub:
   

   Figure 9.7: Adding a new hub

3. In the new pane, we need to provide information in the Region, Name (for the new hub), and Hub private address space fields. Subscription and Resource group are grayed out as they use the same options as Virtual WAN:
   

   Figure 9.8: Information for the new virtual hub

4. The next three steps are optional, and we can choose any or all of them. The first step is to configure a Site-to-Site gateway. If we enable this...

Adding a Site-to-Site connection (in a virtual hub)

After a virtual hub is created and the Site-to-Site SKU is defined inside the hub, we can proceed to create a Site-to-Site connection. For this, we need to apply the appropriate connection settings and provide configuration details.

Getting ready

Before you start, open the browser and go to the Azure portal via https://portal.azure.com.

How to do it…

In order to create a Site-to-Site connection in a virtual hub (under a virtual WAN), we must take the following steps:

1. Find the virtual WAN and locate the previously created virtual hub under Hubs in the Connectivity section. Select that hub:
   

   Figure 9.14: Selecting the previously created hub in the Connectivity section

2. In the Virtual HUB pane, go to the VPN (Site to site) settings under Connectivity. Select the Create new VPN site option:
   

   Figure 9.15: Selecting the Create new VPN site option in the Virtual HUB pane

3. A new pane will appear. Subscription...

Adding a virtual network connection (in a virtual hub)

A virtual hub represents a central point in an Azure region. But to actually use this point, we need to connect virtual networks to a virtual hub. Then, we can use the virtual hub as intended.

Getting ready

Before you start, open the browser and go to the Azure portal via https://portal.azure.com.

How to do it…

In order to add a virtual network connection in a virtual hub (under a virtual WAN), we must take the following steps:

1. Find the virtual WAN and locate the previously created virtual hub under Virtual network connections in the Connectivity section. Select the Add connection option:
   

   Figure 9.20: Adding a previously created virtual hub

2. In the new pane, we need to provide information in the Connection name, Hubs, Subscription, Resource group, and Virtual network fields. Next, we need to provide Routing configuration information. We can select Yes for Propagate to none. If we select No, we need...

Creating a Private Link endpoint

Private Link allows us to connect to PaaS services over a secure network. As these services are usually exposed over the internet, this gives us a more secure method of access. There are two components available to make a secure connection—a Private Link endpoint and a Private Link service. Let's start by creating a Private Link endpoint first.

Getting ready

We need to create a service that will be associated with the Private Link endpoint:

1. Open the browser and go to the Azure portal via https://portal.azure.com. Select the option to create a new service. Search for SQL Server (logical server) and select the Create new option.
2. In the new pane, we must provide information in the Subscription, Resource group, Server name (must be a unique FQDN), and Location fields. Finally, we must provide credentials for the administrator login before selecting Review + create:
   

Figure 9.22: Associating a new service with a Private...

Creating a Private Link service

A Private Link service allows us to set up a secure connection to resources associated with Standard Load Balancer. For that, we need to prepare infrastructure prior to deploying the Private Link service.

Getting ready

We must create a virtual machine first. Check the Creating Azure virtual machines recipe from Chapter 2, Virtual machine networking. Note that in the Networking section, we want to select the same virtual network that was used to connect the SQL server in the previous recipe.

A Private Link service requires Standard Load Balancer as well. See the Creating a public load balancer, Creating a backend pool, Creating health probes, and Creating load balancer rules recipes from Chapter 10, Load balancers. Note that in the backend target, we need to select the virtual machine we just created.

Now, open the browser and go to the Azure portal via https://portal.azure.com.

How to do it…

In order to deploy the new Private...