You deploy Azure Bastion into a VNet named VNet1 in the East US region. You need to use this Bastion host to connect to a virtual machine named VM2 that resides in a separate VNet named VNet2 in the same region. VM2 has no public IP address. What must you configure to allow the Bastion host in VNet1 to connect to VM2?