In this demo,
we're going to work with TCP/IP and Windows Server Virtual Machines.
I showed you that pretty complicated network diagram.
I've got basically the same diagram set up as my desktop background.
If you're wondering how I did this,
I'm making sure to look at the Dashboard view rather
than the Home view in the portal, and then if you edit your dashboard,
there's a tile called Markdown,
and Markdown allows you to use Markdown syntax to
point to a resource if you want to.
If I hit Edit here, I'm just simply pointing to a ping file on my website.
It's as simple as that.
Just wanted to explain that because I get asked that by
students a lot when I'm doing live training.
But anyway, I'm not going to redo my lecture,
but we're going to take a look and inspect network configuration,
specifically TCP/IP configuration for a VM.
Let's take a look at how vm2 is set up.
What we can do is come down under Settings,
Networking,
and this will leave nothing to the imagination in
terms of the TCP/IP stack on that VM.
And what's notable about this interface is that these
hyperlinks will take you to those resources.
The private,
non‑internet accessible IP is coming from Azure‑provided DHCP in the
context of the virtual network that I've deployed this VM to.
I do, in fact, have a public IP, but what if I realize,
wait a minute, this is representing a security hazard,
I'm going to come over the internet using Azure Bastion to manage this machine.
I don't want to RDP directly on this public IP, how can we get rid of it?
Maybe instead of 10.0.0.5, we need to do 10.0.0.20 instead.
How could we change the IP?
Well,
what you never want to do is RDP into the VM and
change the network properties in there.
That's never going to work.
You're going to want to make the change from the Azure control plane.
And remember what I said,
that it's at the virtual network interface level that this is done.
And we have a nice handy dandy hyperlink to the network interface right here,
and we'll head on over to that network interface,
and in particular, we'll want to use under Settings,
IP configurations, we have our ipconfig1 default configuration.
If we select it,
this is where you can associate or disassociate a public IP address.
Now note that disassociating does not delete that public IP.
I'm going to have to, after I disassociated it with it,
I'll have to track down that resource, which you can easily do.
If you do a search for public IP addresses, they're right here.
But you're going to be paying for that even if it's disassociated,
so keep that in mind.
I'm going to Disassociate, and then for Assignment,
it looks like I've already made this private IP address static.
By default, it's dynamic,
which could present the pain point if your VM is stopped and restarted,
you see.
So I'm going to do Static, and I'm going to change it to 10.0.0.20.
Now notice that it says the virtual machine will be
restarted to utilize the new address,
just like a physical machine or an on‑premises VM would have to be restarted,
same thing here when you're changing the IP address.
But let me click Save, and that will, as I said,
reboot the VM,
and it will come back with no public IP on it anymore and it will have a new,
statically‑assigned, private, non‑internet routable IP address.
Now, while that's cooking, let's come back to the vm2 networking settings.
They haven't yet been updated, as you can see.
We've got our network security group that's providing security at OSI Layer 4,
no need to say anything more about that right now,
but what I do want to say is the network on which this virtual machine lives,
we can click to it right here.
And it looks like, in my case, my VNet is called az800‑rg‑vnet,
and it has a private, non‑internet routable IP space of 10.0.0.0/16.
I set that up.
Our subnet configuration has two subnets,
one a default subnet that I'm using for my virtual machine workload,
and then I've created a Bastion subnet.
Now when you create an Azure Bastion jump host,
you have to have a separate subnet for it that has the
reserved name label AzureBastionSubnet.
It has to be there or you can't deploy the Bastion.
A Bastion, like I said,
is simply a managed jump host that goes into its own subnet as you can see here.
It has a public IP, but it listens only on TCP 443,
so any ports scans against that public IP endpoint are not going to
reveal anything juicy in terms of management ports,
hence the value proposition of Azure Bastion.
Now, this gives us the ability now to manage vm2.
Now, technically, we could RDP to vm1 on its public instance‑specific,
public IP address.
But vm2, to as you can see, no longer has an internet accessible public IP,
so that if we go to on the Overview page to the Connect menu,
and attempt an RDP session with that machine,
this is not going to work unless, of course,
you have an express route circuit, or a site‑to‑site VPN,
or a point‑to‑site VPN,
you're never going to have a path using that non‑internet IP.
But because I've got Bastion deployed, I can do a Connect,
Bastion, and there we have the connection just like I showed you earlier.
Isn't that neat?
Now, last thing I want to show you is the serial console.
Like I said, this is a nice backdoor into your VM.
If you find that its RDP connection is all bungled up and you just,
or maybe boot records,
just low‑level surgery that normally you'd never think to be able to get that
kind of serial port access to a machine because number one,
it's a VM and not a piece of hardware, and number two,
it's miles or kilometers away from you in an Azure datacenter.
Now, here's the exam alert.
In order to use Serial Console, you have to make sure,
as a prerequisite, you have Boot diagnostics enabled,
and it looks like on vm2 I don't have boot diagnostics enabled,
so I better click Settings,
and I'm going to Enable with a managed storage account.
Now, what does this do?
Enabling boot diagnostics will capture a screenshot of the desktop
state of the VM that you can verify just as a way to make sure that
the Windows VM's not in a blue screen state,
for example.
If it's a Linux machine, you just see a console screen, it's not as useful.
Once you have boot diagnostics enabled,
you can see that desktop or terminal screenshot on the
boot diagnostics blade in the portal.
Now, I just enabled it, so it's going to be a little while before it shows up.
Same thing with the live serial log,
but that again is a prerequisite to using the Serial Console.
So if we go to Serial console, it's got its own particular syntax.
Again,
the reason why you would use this is to gain backdoor access to the file system
and boot environment of the VM for troubleshooting purposes.
Okay, now Serial Console is also called SAC,
as you can see here, so we're at an SAC prompt,
and we can create a cmd​.exe channel just by typing cmd.
To see a list of channels, it says use ch ‑?
to get channel help.
And if we want to switch a channel to its number,
we can see that ch is list all channels actually,
so before we can switch to the channel, we need to know what number it is,
and it looks like the command.exe is on channel 1,
so we'll do ch ‑si1 to switch to the cmd session.
And once we're at the command prompt, we can use tools like BCDEdit.
We also can use PowerShell.
Of course, nothing in Azure is anonymous by default,
so I'm prompted for login credentials.
So on this machine I've got, hopefully I'll be using the correct credentials.
Type in my password.
There we go.
So now we're at a CMD session, and if I type powershell,
we're now in a PowerShell session.
So let's do a get‑command and see what's available to us.
Elsewhere in this AZ‑800 training,
you saw about PowerShell Just Enough Administration,
or JEA.
Wow, these are a lot of commands, a lot more than I thought,
so let me wait for all of these to enumerate.
Yikes!
But I'm seeing references to the Azure PowerShell commands as well,
so that's definitely good to see.
And if you're seeing what looks like gobbledygook,
that's my technical term for the day, by the way,
that's just that the terminal's a little bit wonky,
it's overriding previous text, but instead of scrolling cleanly,
it's kind of typing over it, so pardon the mess.
Yeah, it looks like I furiously was trying to break output with Ctrl+C.
So that's the Serial Console. I give you a link to the Serial Console docs in the exercise files, as usual.