diff --git a/content/rancher/v2.x/en/installation/air-gap-installation/_index.md b/content/rancher/v2.x/en/installation/air-gap-installation/_index.md
index 19d83c0038e..c929ba3a2b9 100644
--- a/content/rancher/v2.x/en/installation/air-gap-installation/_index.md
+++ b/content/rancher/v2.x/en/installation/air-gap-installation/_index.md
@@ -6,9 +6,11 @@ In environments where security is high priority, you can set up Rancher in an ai
 
 ## Prerequisites
 
-Rancher supports air gap installs using a private registry. You must have your own private registry or other means of distributing docker images to your machine. If you need help with creating a private registry, please refer to the [Docker documentation for private registries](https://docs.docker.com/registry/).
+- Rancher supports air gap installs using a private registry. You must have your own private registry or other means of distributing docker images to your machine. If you need help with creating a private registry, please refer to the [Docker documentation for private registries](https://docs.docker.com/registry/).
 
-In every [release](https://github.com/rancher/rancher/releases), we provide you with the needed Docker images and scripts to mirror those images to your own registry. The Docker images are used when nodes are added to a cluster, or when you enable features like pipelines or logging.
+    In every [release](https://github.com/rancher/rancher/releases), we provide you with the needed Docker images and scripts to mirror those images to your own registry. The Docker images are used when nodes are added to a cluster, or when you enable features like pipelines or logging.
+
+- **Installation Option:** Before beginning your air gap installation, choose whether your want it to be a [single-node install]({{< baseurl >}}/rancher/v2.x/en/installation/single-node) or a [high availability install]({{< baseurl >}}/rancher/v2.x/en/installation/ha). View your chosen configuration's introduction notes along with Rancher's [node requirements]({{< baseurl >}}/rancher/v2.x/en/installation/requirements).
 
 ## Caveats
 
diff --git a/content/rancher/v2.x/en/installation/air-gap-installation/install-rancher/_index.md b/content/rancher/v2.x/en/installation/air-gap-installation/install-rancher/_index.md
index 011c59ab297..48fab2f5320 100644
--- a/content/rancher/v2.x/en/installation/air-gap-installation/install-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/air-gap-installation/install-rancher/_index.md
@@ -36,6 +36,8 @@ To install Rancher in a high availability configuration within an air gap enviro
 
 When you get to [Create the rancher-cluster.yml File]({{< baseurl >}}/rancher/v2.x/en/installation/ha/kubernetes-rke/#create-the-rancher-cluster-yml-file), replace its code sample with the one below, which adds the `private registries` block:
 
+>**Note:** When declaring the `address` for each of your air gap nodes, use its external IP address.
+
 ```yaml
 nodes:
     - address: 18.222.121.187
@@ -60,6 +62,63 @@ nodes:
         is_default: true
 ```
 
+#### Optional: Run RKE Through Bastion Host
+
+When setting up an air gap environment, it may be useful to run RKE through a [bastion host]({{< baseurl >}}/rke/v0.1.x/en/config-options/bastion-host/). This configuration can be helpful if you want to keep your RKE config (`rancher-cluster.yml`) or SSH keys on your local machine. Use of a bastion host requires it to be accessible from both the Internet and your air gap nodes over port 22.
+
+**Port Requirements:**
+
+| Port   | Outgoing Host  | Incoming Host     |
+| ------ | -------------- | ----------------- |
+| 22 TCP | local RKE host | bastion host      |
+| 22 TCP | bastion host   | each air gap node |
+
+To enable running RKE through a bastion server, add the following sample to `rancher-cluster.yml`:
+
+```yaml
+bastion_host:
+    address: 18.224.54.35 # public IP of the bastion server
+    user: rancher
+    port: 22
+    ssh_key_path: /path/to/ssh/key
+```
+
+>**Note:** When declaring the `address` for each of your air gap nodes and bastion host, use its external IP address.
+
+
+**Example in context:**
+
+```yaml
+bastion_host:
+    address: 18.224.54.35 # public IP of the bastion server
+    user: rancher
+    port: 22
+    ssh_key_path: /home/user/.ssh/id_rsa
+nodes:
+    - address: 18.222.121.187
+        internal_address: 172.31.7.22
+        user: rancher
+        role: [ "controlplane", "etcd", "worker" ]
+        ssh_key_file: /home/user/.ssh/id_rsa
+    - address: 18.220.193.254
+        internal_address: 172.31.13.132
+        user: rancher
+        role: [ "controlplane", "etcd", "worker" ]
+        ssh_key_file: /home/user/.ssh/id_rsa
+    - address: 13.59.83.89
+        internal_address: 172.31.3.216
+        user: rancher
+        role: [ "controlplane", "etcd", "worker" ]
+        ssh_key_file: /home/user/.ssh/id_rsa
+    private_registries:
+    - url: my_registry.example.com
+        user: rancher
+        password: "*********"
+        is_default: true
+```
+
+After adding the bastion host to `rancher-cluster.yml`,  running `rke up` provisions the Kubernetes cluster through the bastion server, and provides the resulting `kube_config`. However, it's important to note that as your nodes are not accessible by public IP, the machine from which you run `kubectl` in later steps must be able to access your air gapped nodes at the addresses provided. Due to this requirement, you may need to move the resulting `kube_config` after its creation.
+
 ### Initialize Helm Using Private Registry
 
 When you get to [Helm Init]({{< baseurl >}}/rancher/v2.x/en/installation/ha/helm-init/#helm-init), add your private registry in the step to initialize Helm, as shown below:
diff --git a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md
index 310e0cc12ef..8787f4fd931 100644
--- a/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md
+++ b/content/rancher/v2.x/en/installation/ha/helm-rancher/_index.md
@@ -42,7 +42,7 @@ There are three options for the source of the certificate.
 2. `letsEncrypt` - Use [LetsEncrypt](https://letsencrypt.org/) to issue a cert.
 3. `secret` - Configure a Kubernetes Secret with your certificate files.
 
-<br\>
+<br/>
 
 #### (Default) Rancher Generated Certificates
 
diff --git a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md
index c7353e5a176..63815a7f85d 100644
--- a/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md
+++ b/content/rancher/v2.x/en/installation/ha/kubernetes-rke/_index.md
@@ -11,7 +11,7 @@ Using the sample below create the `rancher-cluster.yml` file. Replace the IP Add
 
 > **Notes:** 
 >
->- Air Gap User? [Add a private registry section]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/#add-private-registry-to-rke-yaml) to the sample below.
+>- Air Gap User? [Add a private registry section]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/#add-private-registry-to-rke-yaml) to the sample below. Optionally, if you want to run RKE through a bastion host you have set up, you can [add one]({{< baseurl >}}/rancher/v2.x/en/installation/air-gap-installation/install-rancher/#optional-run-rke-through-bastion-host) to `rancher-cluster.yml`.
 >- If your node has public and internal addresses, it is recommended to set the `internal_address:` so Kubernetes will use it for intra-cluster communication.  Some services like AWS EC2 require setting the `internal_address:` if you want to use self-referencing security groups or firewalls.