After enabling a Bastionhost instance, refer to this topic to modify its basic network settings. This topic covers how to modify security groups, restrict access by source IP address, change default O&M port numbers, switch vSwitch zones, and obtain the egress IP address of the instance.
Log on to the Bastionhost console.
-
In the left-side navigation pane, click Instances.
-
On the Instances page, find your Bastionhost instance and use the following table to configure it.
Feature
Description
Configure security group
Lets the Bastionhost instance access assets in a specified security group.
NoteYou can select multiple security groups.
Configure whitelist
Restricts which IP addresses can access the public domain name of the Bastionhost instance.
Configure port number
The default O&M port is 60022 for the SSH protocol and 63389 for the RDP protocol. Customize the O&M ports for your Bastionhost instance.
NotePorts 1 to 1024 are reserved by Bastionhost. We recommend that you do not set an O&M port to a number in this range.
Obtain egress IP address and related configurations
The egress IP address of a Bastionhost instance is the source IP address that the instance uses to access assets. It can be a public or a private egress IP address. To ensure connectivity, allow this egress IP address in your ECS security groups, firewall rules, and database whitelists. For more information about database whitelists, see Set an IP address whitelist.
NoteWhen you add a Bastionhost instance to a basic security group, a rule allowing its egress IP address is automatically added. If your ECS instance is in an advanced security group, you must manually add a rule to allow the egress IP address because Bastionhost instances cannot be added to advanced security groups. For more information, see Add a security group rule.
Configure public IP for private use
If your assets use public IP addresses for internal communication (a scenario known as public IP for private use), enable this feature to let the Bastionhost instance access them. Use the format
IP address/mask. Separate multiple entries with a comma (,), with a maximum of 50 entries. For example,192.168.XX.XX/32,172.16.XX.XX/32.WarningConfiguring public IP for private use disconnects active O&M sessions. We recommend that you perform this operation during off-peak hours.
Configure multi-zone
If you use the Enterprise Dual-Engine or National Cryptography edition of Bastionhost, place the vSwitches in your VPC across different zones to ensure high availability.
Warning-
Configuring primary and secondary zones disconnects active O&M sessions. We recommend that you perform this operation during off-peak hours.
-
Switching networks changes the IP address that the private O&M domain name resolves to. Always use the domain name provided in the console for O&M access.
-
Switching networks changes the private egress IP address. If your security group rules are based on specific IP addresses, O&M access may fail. You must reconfigure your security group.
-
If you have other access control policies, such as a firewall, that rely on a private IP address, update these policies with the new address after the switch.
-
If you configure the primary and secondary vSwitches in different zones, the private O&M domain name resolves to two IP addresses.
Switch to a single zone
If you use the Basic edition of Bastionhost, you can switch the vSwitch in your VPC to a different zone. This prevents service disruption if the current zone becomes unavailable.
Warning-
Switching the zone disconnects active O&M sessions. We recommend that you perform this operation during off-peak hours.
-
Switching networks changes the IP address that the private O&M domain name resolves to. Always use the domain name provided in the console for O&M access.
-
Switching networks changes the private egress IP address. If your security group rules are based on specific IP addresses, O&M access may fail. You must reconfigure your security group.
-
If you have other access control policies, such as a firewall, that rely on a private IP address, update these policies with the new address after the switch.
Enable O&M access via private network
Enables O&M access to the Bastionhost instance exclusively from a private network environment. For more information, see Enable the private O&M portal.
-