0

I have a hub and spoke topologogy made up of a central vnet and then peered VNETs. Inside each peered VNET is a VM.

I want to allow RDP access to the VM (which is AAD joined) via AAD authentication. AAD auth needs to be restricted via CAP.

This, it turns out, may be tricky.

Option 1: I had hoped to place an Azure load balancer inside the hub and assign a single IP address to it. In my AAD I would the add a CAP for this IP. This would then allow me to RDP (via a jump box in the hub) onto each spoke VM.

Alas Azure load balancer doesnt support peered VNETs.

Option 2: I considered using Bastion to access the VNets... but bastion doesnt support AAD or peered networks. So thats useless.

Option 3: I could stick a public IP on each VM (and allow only outbound traffic via an NSG) with all public IPs using a prefix to simplify CAP. Although this rather confusing article https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/azure-subscription-service-limits?toc=/azure/virtual-network/toc.json#networking-limits seems to imply that the number of public ips is restricted per subscription (to 10 for basic!?!) Here I'd use IP prefixes to simplify CAP to a known range.

Option 4: I could introduce a virtual appliance. This sounds horrid and requires management etc

Are there other options Ive missed (I almost certainly have)?

Argh
  • 537
  • 1
  • 4
  • 6
  • Bastion would be the way to go, access to which you can protect with RADIUS and NPS extension for Azure. https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension With Azure authentication, you can get Conditional Access as well. You can also protect RDP with MFA. – Vick Vega Jun 29 '20 at 03:58
  • Bastion doesnt support peered networks (my topology is hub and spoke). You need a Bastion instance for every VNET which is prohibitively expensive – Argh Jun 29 '20 at 07:33
  • Also, unless Im reading this wrong (I might be) AAD isnt supported https://feedback.azure.com/forums/217313-networking/suggestions/37961281-aad-integration – Argh Jun 29 '20 at 07:58

0 Answers0