bast3001 is having disk issues (T154603) that are unlikely to be fixed soon by a site visit (the hardware is super old). esams does have other unused servers though, and we could use those to replace the bastion with.
A good start would be hooft. This was our previous bastion, but we switched to slauerhoff when we were unable to reformat hooft to jessie, if memory serves. I think what happened back then with hooft was the PXE firmware was getting confused with all of the Ganglia UDP packets hooft was receiving, an issue that we figured out later in a different part of the infrastructure.