Integrate NAT gateway with Azure Firewall in a hub and spoke network for outbound connectivity

• An Azure account with an active subscription. Create an account for free.

• An Azure account with an active subscription. Create an account for free.

Azure Cloud Shell

Azure hosts Azure Cloud Shell, an interactive shell environment that you can use through your browser. You can use either Bash or PowerShell with Cloud Shell to work with Azure services. You can use the Cloud Shell preinstalled commands to run the code in this article, without having to install anything on your local environment.

To start Azure Cloud Shell:

Option	Example/Link
Select Try It in the upper-right corner of a code or command block. Selecting Try It doesn't automatically copy the code or command to Cloud Shell.
Go to https://shell.azure.com, or select the Launch Cloud Shell button to open Cloud Shell in your browser.
Select the Cloud Shell button on the menu bar at the upper right in the Azure portal.

To use Azure Cloud Shell:

1. Start Cloud Shell.

2. Select the Copy button on a code block (or command block) to copy the code or command.

3. Paste the code or command into the Cloud Shell session by selecting Ctrl+Shift+V on Windows and Linux, or by selecting Cmd+Shift+V on macOS.

4. Select Enter to run the code or command.

If you run the commands locally, install or update to the current Azure PowerShell release, including the Az.Network module, before you begin. The examples use the StandardV2 SKU. Use Get-Module with -ListAvailable Az.Network to check your installed network module. Sign in with Connect-AzAccount.

1. Sign in to the Azure portal.

2. In the search box at the top of the portal enter Resource group. Select Resource groups in the search results.

3. Select + Create.

4. In the Basics tab of Create a resource group, enter or select the following information.

   Setting	Value
   Subscription	Select your subscription
   Resource group	test-rg
   Region	West US

5. Select Review + create.

6. Select Create.

Create a resource group with New-AzResourceGroup. An Azure resource group is a logical container into which Azure resources are deployed and managed.

The following example creates a resource group named test-rg in the westus location:

$rsg = @{
    Name = 'test-rg'
    Location = 'westus'
}
New-AzResourceGroup @rsg

1. Sign in to the Azure portal.

2. In the search box at the top of the Azure portal, enter Virtual network. Select Virtual networks in the search results.

3. Select Create.

4. Enter or select the following information in the Basics tab of Create virtual network.

   Setting	Value
   Project details
   Subscription	Select your subscription.
   Resource group	Select test-rg or your resource group.
   Instance details
   Name	Enter vnet-hub.
   Region	Select your region. This example uses West US.

5. Select the IP Addresses tab, or select Next: Security, then Next: IP Addresses.

6. In Subnets select the default subnet.

7. Enter or select the following information in Edit subnet.

   Setting	Value
   Subnet purpose	Leave the default.
   Name	Enter subnet-1.

8. Leave the rest of the settings as default, then select Save.

9. Select + Add a subnet.

10. In Add a subnet enter or select the following information.

    Setting	Value
    Subnet purpose	Select Azure Bastion.

11. Leave the rest of the settings as default, then select Add.

12. Select + Add a subnet.

13. In Add a subnet enter or select the following information.

    Setting	Value
    Subnet purpose	Select Azure Firewall.

14. Leave the rest of the settings as default, then select Add.

15. Select Review + create, then select Create.

Use New-AzVirtualNetwork to create the hub virtual network.

# Create hub virtual network
$vnetParams = @{
    ResourceGroupName = 'test-rg'
    Location = 'westus'
    Name = 'vnet-hub'
    AddressPrefix = '10.0.0.0/16'
}
$hubVnet = New-AzVirtualNetwork @vnetParams

Use Add-AzVirtualNetworkSubnetConfig to create a subnet for Azure Firewall and Azure Bastion.

# Create default subnet
$subnetParams = @{
    Name = 'subnet-1'
    AddressPrefix = '10.0.0.0/24'
    VirtualNetwork = $hubVnet
}
Add-AzVirtualNetworkSubnetConfig @subnetParams

# Create subnet for Azure Firewall
$subnetParams = @{
    Name = 'AzureFirewallSubnet'
    AddressPrefix  = '10.0.1.64/26'
    VirtualNetwork = $hubVnet
}
Add-AzVirtualNetworkSubnetConfig @subnetParams

# Create subnet for Azure Bastion
$subnetParams = @{
    Name = 'AzureBastionSubnet'
    AddressPrefix  = '10.0.1.0/26'
    VirtualNetwork = $hubVnet
}
Add-AzVirtualNetworkSubnetConfig @subnetParams

Use Set-AzVirtualNetwork to update the virtual network.

# Create the virtual network
$hubVnet | Set-AzVirtualNetwork

1. In the search box at the top of the Azure portal, enter Bastion. Select Bastions in the search results.

2. Select Create.

3. Enter or select the following information in the Basics tab of Create a Bastion.

   Setting	Value
   Project details
   Subscription	Select your subscription.
   Resource group	Select test-rg or your resource group.
   Instance details
   Name	Enter bastion.
   Region	Select your region. This example uses West US.
   Tier	Select Basic.
   Virtual network	Select vnet-hub.
   Subnet	Select AzureBastionSubnet.
   Public IP address	Create a new Standard, static public IP address named public-ip-bastion.

   Bastion Basic supports connecting to the test VM in the peered spoke virtual network. Bastion Developer doesn't support connections to peered virtual networks. For more information, see Bastion SKU comparison.

4. Select Review + create, then select Create.

Use New-AzPublicIpAddress to create a public IP for Azure Bastion.

# Create public IP for Azure Bastion
$publicIpBastionParams = @{
    ResourceGroupName = 'test-rg'
    Location = 'westus'
    Name = 'public-ip-bastion'
    Sku = 'Standard'
    AllocationMethod = 'Static'
}
$publicIpBastion = New-AzPublicIpAddress @publicIpBastionParams

Use New-AzBastion to create Azure Bastion.

# Create Azure Bastion
$bastionParams = @{
    ResourceGroupName = "test-rg"
    Name = "bastion"
    VirtualNetworkName = "vnet-hub"
    PublicIpAddressName = "public-ip-bastion"
    PublicIPAddressRgName = "test-rg"
    VirtualNetworkRgName = "test-rg"
    Sku = "Basic"
}
New-AzBastion @bastionParams

1. In the search box at the top of the portal, enter Firewall. Select Firewalls in the search results.

2. Select + Create.

3. On the Basics tab of Create a firewall, use the following table to configure the firewall:

   Setting	Value
   Project details
   Subscription	Select your subscription.
   Resource group	Select test-rg.
   Instance details
   Name	Enter firewall.
   Region	Select West US.
   Firewall SKU	Select Standard.
   Firewall management	Select Use a Firewall Policy to manage this firewall.
   Firewall policy	Select Add new. Name: Enter firewall-policy. Region: Select West US. Policy tier: Standard. Select OK.
   Choose a virtual network
   Virtual network	Select Use existing.
   Virtual network	Select vnet-hub.
   Public IP address
   Public IP address	Select Add new. Name: Enter public-ip-firewall. SKU: Standard. Assignment: Static. Select OK.

4. Clear Enable Firewall Management NIC for this tutorial, and then select Next: Advanced.

5. On the Advanced tab, select Enable NAT gateway. Under StandardV2 NAT gateway, select Create new.

   NAT Gateway is optional when you create a firewall. This tutorial enables it to provide outbound SNAT through the NAT gateway's public IP address. In a region that doesn't support StandardV2 NAT Gateway, the form displays a validation error. Choose a supported region on Basics to continue with this tutorial.

6. In Create a new StandardV2 NAT Gateway, enter nat-gateway for Name.

7. Under Public IPv4 addresses, select Create a public IP address. Enter public-ip-nat for Name.

8. Confirm that SKU is StandardV2 and Assignment is Static, and then select OK.

9. Confirm that (New) public-ip-nat is selected under Public IPv4 addresses. Leave the IPv6 address and public IP prefix fields unselected for this IPv4 tutorial.

   

10. Select Add. On Advanced, confirm that Enable NAT gateway is selected and StandardV2 NAT gateway shows (New) nat-gateway.

    

11. Select Review + create. Confirm the summary shows West US, the Standard firewall SKU, vnet-hub, public-ip-firewall, and the new StandardV2 NAT gateway.

12. Select Create.

    The deployment creates the firewall, NAT gateway, and their public IP addresses. It also associates the NAT gateway with AzureFirewallSubnet. Deployment takes a few minutes.

    Keep the firewall's own public IP address. Outbound SNAT uses the NAT gateway public IP, while inbound DNAT uses the firewall public IP. Workload routes still point to the firewall's private IP address.

13. After deployment completes, go to the test-rg resource group, and select the firewall resource.

14. Note the firewall private and public IP addresses. You use these addresses later.

Use New-AzPublicIpAddress to create a public IP for Azure Firewall.

# Create public IP for Azure Firewall
$publicIpFirewallParams = @{
    ResourceGroupName = 'test-rg'
    Location = 'westus'
    Name = 'public-ip-firewall'
    AllocationMethod  = 'Static'
    Sku = 'Standard'
}
$publicIpFirewall = New-AzPublicIpAddress @publicIpFirewallParams

Use New-AzFirewallPolicy to create a firewall policy.

# Create firewall policy
$firewallPolicyParams = @{
    ResourceGroupName = 'test-rg'
    Location = 'westus'
    Name = 'firewall-policy'
}
$firewallPolicy = New-AzFirewallPolicy @firewallPolicyParams

Use New-AzFirewall to create Azure Firewall.

# Create Azure Firewall
    $firewallParams = @{
        ResourceGroupName = 'test-rg'
        Location = 'westus'
        Name = 'firewall'
        VirtualNetworkName = 'vnet-hub'
        PublicIpName = 'public-ip-firewall'
        FirewallPolicyId = $firewallPolicy.Id
    }
    $firewall = New-AzFirewall @firewallParams

Don't create another NAT gateway. Verify the resources and association created in the preceding section:

1. Open test-rg, and select nat-gateway. Confirm that its SKU is StandardV2 and its location matches the firewall.
2. Open vnet-hub, select Subnets, and select AzureFirewallSubnet.
3. Confirm that NAT gateway is set to nat-gateway. Leave the subnet settings unchanged.
4. Open public-ip-nat and confirm that it uses the StandardV2 SKU. This address is separate from public-ip-firewall, which uses the Standard SKU.

Use New-AzPublicIpAddress to create a zone redundant IPv4 public IP address for the NAT gateway.

## Create public IP address for NAT gateway ##
$ip = @{
    Name = 'public-ip-nat'
    ResourceGroupName = 'test-rg'
    Location = 'westus'
    Sku = 'StandardV2'
    AllocationMethod = 'Static'
    IpAddressVersion = 'IPv4'
    Zone = 1,2,3
}
$publicIPIPv4 = New-AzPublicIpAddress @ip

Use New-AzNatGateway to create the NAT gateway resource.

A StandardV2 NAT Gateway is zone redundant by default. Omit the optional Zone parameter rather than assigning this gateway to a single zone.

## Create NAT gateway resource ##
$nat = @{
    ResourceGroupName = 'test-rg'
    Name = 'nat-gateway'
    IdleTimeoutInMinutes = '4'
    Sku = 'StandardV2'
    Location = 'westus'
    PublicIpAddress = $publicIPIPv4
}
$natGateway = New-AzNatGateway @nat

Use Set-AzVirtualNetworkSubnetConfig to associate NAT gateway with AzureFirewallSubnet.

# Get the hub virtual network
$vnetHub = Get-AzVirtualNetwork -ResourceGroupName 'test-rg' -Name 'vnet-hub'

# Associate NAT gateway with AzureFirewallSubnet
$subnetParams = @{
    VirtualNetwork = $vnetHub
    Name = 'AzureFirewallSubnet'
    AddressPrefix = '10.0.1.64/26'
    NatGateway = $natGateway
}
Set-AzVirtualNetworkSubnetConfig @subnetParams

# Update the virtual network
$vnetHub | Set-AzVirtualNetwork

1. In the search box at the top of the portal, enter Virtual network. Select Virtual networks in the search results.

2. Select + Create.

3. In the Basics tab of Create virtual network, enter or select the following information:

   Setting	Value
   Project details
   Subscription	Select your subscription.
   Resource group	Select test-rg.
   Instance details
   Name	Enter vnet-spoke.
   Region	Select West US.

4. Select Next to proceed to the Security tab.

5. Select Next to proceed to the IP addresses tab.

6. In the IP Addresses tab in IPv4 address space, select Delete address space to delete the address space that is auto populated.

7. Select + Add IPv4 address space.

8. In IPv4 address space enter 10.1.0.0. Leave the default of /16 (65,536 addresses) in the mask selection.

9. Select + Add a subnet.

10. In Add a subnet enter or select the following information:

    Setting	Value
    Subnet purpose	Leave the default Default.
    Name	Enter subnet-private.
    IPv4
    IPv4 address range	Leave the default of 10.1.0.0/16.
    Starting address	Leave the default of 10.1.0.0.
    Size	Leave the default of /24(256 addresses).

11. Select Add.

12. Select Review + create.

13. Select Create.

Use New-AzVirtualNetwork to create the spoke virtual network.

# Create spoke virtual network
$vnetParams = @{
    ResourceGroupName = 'test-rg'
    Location = 'westus'
    Name = 'vnet-spoke'
    AddressPrefix = '10.1.0.0/16'
}
$spokeVnet = New-AzVirtualNetwork @vnetParams

Use Add-AzVirtualNetworkSubnetConfig to create a subnet for the spoke virtual network.

# Create subnet in spoke virtual network
$subnetParams = @{
    Name = 'subnet-private'
    AddressPrefix = '10.1.0.0/24'
    VirtualNetwork = $spokeVnet
}
Add-AzVirtualNetworkSubnetConfig @subnetParams

Use Set-AzVirtualNetwork to update the spoke virtual network.

# Create the virtual network
$spokeVnet | Set-AzVirtualNetwork

1. In the search box at the top of the portal, enter Virtual network. Select Virtual networks in the search results.

2. Select vnet-hub.

3. Select Peerings in Settings.

4. Select + Add.

5. Enter or select the following information in Add peering:

   Setting	Value
   Remote virtual network summary
   Peering link name	Enter vnet-spoke-to-vnet-hub.
   Virtual network deployment model	Leave the default of Resource manager.
   Subscription	Select your subscription.
   Virtual network	Select vnet-spoke (test-rg).
   Remote virtual network peering settings
   Allow 'vnet-spoke' to access 'vnet-hub'	Leave the default of Selected.
   Allow 'vnet-spoke' to receive forwarded traffic from 'vnet-hub'	Select the checkbox.
   Allow gateway or route server in 'vnet-spoke' to forward traffic to 'vnet-hub'	Leave the default of Unselected.
   Enable 'vnet-spoke' to use 'vnet-hub's' remote gateway or route server	Leave the default of Unselected.
   Local virtual network summary
   Peering link name	Enter vnet-hub-to-vnet-spoke.
   Local virtual network peering settings
   Allow 'vnet-hub' to access 'vnet-spoke'	Leave the default of Selected.
   Allow 'vnet-hub' to receive forwarded traffic from 'vnet-spoke'	Select the checkbox.
   Allow gateway or route server in 'vnet-hub' to forward traffic to 'vnet-spoke'	Leave the default of Unselected.
   Enable 'vnet-hub' to use 'vnet-spoke's' remote gateway or route server	Leave the default of Unselected.

6. Select Add.

7. Select Refresh and verify Peering status is Connected.

Use Add-AzVirtualNetworkPeering to create a peering from the hub to the spoke.

# Create peering from hub to spoke
$peeringParams = @{
    Name = 'vnet-hub-to-vnet-spoke'
    VirtualNetwork = $hubVnet
    RemoteVirtualNetworkId = $spokeVnet.Id
    AllowForwardedTraffic = $true
}
Add-AzVirtualNetworkPeering @peeringParams

Use Add-AzVirtualNetworkPeering to create a peering from the spoke to the hub.

# Create peering from spoke to hub
$peeringParams = @{
    Name = 'vnet-spoke-to-vnet-hub'
    VirtualNetwork = $spokeVnet
    RemoteVirtualNetworkId = $hubVnet.Id
    AllowForwardedTraffic = $true
}
Add-AzVirtualNetworkPeering @peeringParams

1. In the search box at the top of the portal, enter Firewall. Select Firewalls in the search results.

2. Select firewall.

3. In the Overview of firewall, note the IP address in the field Firewall private IP. The IP address in this example is 10.0.1.68.

Use Get-AzFirewall to obtain the private IP address of the firewall.

# Get the private IP address of the firewall
$firewallParams = @{
    ResourceGroupName = 'test-rg'
    Name = 'firewall'
}
$firewall = Get-AzFirewall @firewallParams
$firewall.IpConfigurations[0].PrivateIpAddress

1. In the search box at the top of the portal, enter Route table. Select Route tables in the search results.

2. Select + Create.

3. In Create Route table enter or select the following information:

   Setting	Value
   Project details
   Subscription	Select your subscription.
   Resource group	Select test-rg.
   Instance details
   Region	Select West US.
   Name	Enter route-table-spoke.
   Propagate gateway routes	Select No.

4. Select Review + create.

5. Select Create.

6. In the search box at the top of the portal, enter Route table. Select Route tables in the search results.

7. Select route-table-spoke.

8. In Settings select Routes.

9. Select + Add in Routes.

10. Enter or select the following information in Add route:

    Setting	Value
    Route name	Enter route-to-hub.
    Destination type	Select IP Addresses.
    Destination IP addresses/CIDR ranges	Enter 0.0.0.0/0.
    Next hop type	Select Virtual appliance.
    Next hop address	Enter the firewall's private IP address that you recorded earlier. Don't use the NAT gateway's public IP address.

11. Select Add.

12. Select Subnets in Settings.

13. Select + Associate.

14. Enter or select the following information in Associate subnet:

    Setting	Value
    Virtual network	Select vnet-spoke (test-rg).
    Subnet	Select subnet-private.

15. Select OK.

Use New-AzRouteTable to create the route table.

# Create route table
$routeTableParams = @{
    ResourceGroupName = 'test-rg'
    Location = 'westus'
    Name = 'route-table-spoke'
}
$routeTable = New-AzRouteTable @routeTableParams

Use Add-AzRouteConfig to create a route in the route table.

# Create route
$routeConfigParams = @{
    Name = 'route-to-hub'
    AddressPrefix = '0.0.0.0/0'
    NextHopType = 'VirtualAppliance'
    NextHopIpAddress = $firewall.IpConfigurations[0].PrivateIpAddress
    RouteTable = $routeTable
}
Add-AzRouteConfig @routeConfigParams

Use Set-AzRouteTable to update the route table.

# Update the route table
$routeTable | Set-AzRouteTable

Use Set-AzVirtualNetworkSubnetConfig to associate the route table with the spoke subnet.

# Associate route table with subnet
$subnetConfigParams = @{
    VirtualNetwork = $spokeVnet
    Name = 'subnet-private'
    AddressPrefix = '10.1.0.0/24'
    RouteTable = $routeTable
}
Set-AzVirtualNetworkSubnetConfig @subnetConfigParams

Use Set-AzVirtualNetwork to update the spoke virtual network.

# Update the virtual network
$spokeVnet | Set-AzVirtualNetwork

1. In the search box at the top of the portal, enter Firewall. Select Firewall Policies in the search results.

2. Select firewall-policy.

3. Expand Settings then select Network rules.

4. Select + Add a rule collection.

5. In Add a rule collection enter or select the following information:

   Setting	Value
   Name	Enter spoke-to-internet.
   Rule collection type	Select Network.
   Priority	Enter 100.
   Rule collection action	Select Allow.
   Rule collection group	Select DefaultNetworkRuleCollectionGroup.
   Rules
   Name	Enter allow-web.
   Source type	IP Address.
   Source	Enter 10.1.0.0/24.
   Protocol	Select TCP.
   Destination Ports	Enter 80,443.
   Destination Type	Select IP Address.
   Destination	Enter *

6. Select Add.

Use Get-AzFirewallPolicy to get the existing firewall policy.

# Get the existing firewall policy
$firewallPolicyParams = @{
    Name = 'firewall-policy'
    ResourceGroupName = 'test-rg'
}
$firewallPolicy = Get-AzFirewallPolicy @firewallPolicyParams

Use New-AzFirewallPolicyNetworkRule to create a network rule.

# Create a network rule for web traffic
$networkRuleParams = @{
    Name = 'allow-internet'
    SourceAddress = '10.1.0.0/24'
    Protocol = 'TCP'
    DestinationAddress = '*'
    DestinationPort = '80', '443'
}
$networkRule = New-AzFirewallPolicyNetworkRule @networkRuleParams

Use New-AzFirewallPolicyFilterRuleCollection to create a rule collection for the network rule.

# Create a rule collection for the network rule
$ruleCollectionParams = @{
    Name = 'spoke-to-internet'
    Priority = 100
    Rule = $networkRule
    ActionType = 'Allow'
}
$ruleCollection = New-AzFirewallPolicyFilterRuleCollection @ruleCollectionParams

Use New-AzFirewallPolicyRuleCollectionGroup to create a rule collection group.

$newRuleCollectionGroupParams = @{
        Name = 'DefaultNetworkRuleCollectionGroup'
        Priority = 200
        FirewallPolicyObject = $firewallPolicy
        RuleCollection = $ruleCollection
    }
New-AzFirewallPolicyRuleCollectionGroup @newRuleCollectionGroupParams

1. In the portal, search for and select Virtual machines.

2. In Virtual machines, select + Create, then Azure virtual machine.

3. On the Basics tab of Create a virtual machine, enter or select the following information:

   Setting	Value
   Project details
   Subscription	Select your subscription.
   Resource group	Select test-rg.
   Instance details
   Virtual machine name	Enter vm-spoke.
   Region	Select West US.
   Availability options	Select No infrastructure redundancy required.
   Security type	Leave the default of Standard.
   Image	Select Ubuntu Server 24.04 LTS - x64 Gen2.
   VM architecture	Leave the default of x64.
   Size	Select a size.
   Administrator account
   Authentication type	Select SSH public key.
   Username	Enter azureuser.
   SSH public key source	Select Generate new key pair.
   Key pair name	Enter vm-spoke-key.
   Inbound port rules
   Public inbound ports	Select None.

4. Select the Networking tab at the top of the page or select Next:Disks, then Next:Networking.

5. Enter or select the following information in the Networking tab:

   Setting	Value
   Network interface
   Virtual network	Select vnet-spoke.
   Subnet	Select subnet-private (10.1.0.0/24).
   Public IP	Select None.
   NIC network security group	Select Advanced.
   Configure network security group	Select Create new. Enter nsg-1 for the name. Leave the rest at the defaults and select OK.

6. Leave the rest of the settings at the defaults and select Review + create.

7. Review the settings and select Create.

8. The Generate new key pair dialog box appears. Select Download private key and create resource.

The private key downloads to your local machine. You need the downloaded private key for vm-spoke-key when you connect to the virtual machine with Azure Bastion later in this tutorial.

Wait for the virtual machine to finish deploying before proceeding to the next steps.

Use New-AzNetworkSecurityGroup to create the network security group.

$nsgParams = @{
    ResourceGroupName = "test-rg"
    Name = "nsg-1"
    Location = "westus"
}
New-AzNetworkSecurityGroup @nsgParams

Use New-AzNetworkInterface to create the network interface.

$nicParams = @{
    ResourceGroupName = "test-rg"
    Name = "nic-1"
    SubnetId = (Get-AzVirtualNetwork -ResourceGroupName "test-rg" -Name "vnet-spoke").Subnets[0].Id
    NetworkSecurityGroupId = (Get-AzNetworkSecurityGroup -ResourceGroupName "test-rg" -Name "nsg-1").Id
    Location = "westus"
}
New-AzNetworkInterface @nicParams

Use Get-Credential to set a user name and password for the VM and store them in the $cred variable.

$cred = Get-Credential

Use New-AzVMConfig to define a VM.

$vmConfigParams = @{
    VMName = "vm-spoke"
    VMSize = "Standard_DS4_v2"
    }
$vmConfig = New-AzVMConfig @vmConfigParams

Use Set-AzVMOperatingSystem and Set-AzVMSourceImage to create the rest of the VM configuration. The following example creates an Ubuntu Server virtual machine:

$osParams = @{
    VM = $vmConfig
    ComputerName = "vm-spoke"
    Credential = $cred
    }
$vmConfig = Set-AzVMOperatingSystem @osParams -Linux -DisablePasswordAuthentication

$imageParams = @{
    VM = $vmConfig
    PublisherName = "Canonical"
    Offer = "ubuntu-24_04-lts"
    Skus = "server"
    Version = "latest"
    }
$vmConfig = Set-AzVMSourceImage @imageParams

Use Add-AzVMNetworkInterface to attach the NIC that you previously created to the VM.

# Get the network interface object
$nicParams = @{
    ResourceGroupName = "test-rg"
    Name = "nic-1"
    }
$nic = Get-AzNetworkInterface @nicParams

$vmConfigParams = @{
    VM = $vmConfig
    Id = $nic.Id
    }
$vmConfig = Add-AzVMNetworkInterface @vmConfigParams

Use New-AzVM to create the VM. The command generates SSH keys for the virtual machine for sign-in. Make note of the location of the private key. The private key is needed in later steps for connecting to the virtual machine with Azure Bastion.

$vmParams = @{
    VM = $vmConfig
    ResourceGroupName = "test-rg"
    Location = "westus"
    SshKeyName = "vm-spoke-key"
    }
New-AzVM @vmParams -GenerateSshKey

1. In the search box at the top of the portal, enter Public IP. Select Public IP addresses in the search results.

2. Select public-ip-nat.

3. Make note of the value in IP address. The example used in this article is 203.0.113.25.

Use Get-AzPublicIpAddress to obtain the public IP address of the NAT gateway.

# Get the public IP address of the NAT gateway
$publicIpNatParams = @{
    ResourceGroupName = 'test-rg'
    Name = 'public-ip-nat'
}
$publicIpNat = Get-AzPublicIpAddress @publicIpNatParams
$publicIpNat.IpAddress

When you finish using the resources that you created, you can delete the resource group and all its resources.

1. In the Azure portal, search for and select Resource groups.

2. On the Resource groups page, select the test-rg resource group.

3. On the test-rg page, select Delete resource group.

4. Enter test-rg in Enter resource group name to confirm deletion, and then select Delete.

Use Remove-AzResourceGroup to remove the resource group.

# Remove resource group
$rgParams = @{
    Name = 'test-rg'
}
Remove-AzResourceGroup @rgParams