Configure Network Security Groups
determine when to use network security groups
create network security groups
implement and evaluate network security group rules
describe the function of application security groups
Network security groups are a way to limit network traffic to resources in your virtual network. Network security groups contain a list of security rules that allow or deny inbound or outbound network traffic.
You can assign a network security group to a subnet or a network interface. and define security rules in the group to control network traffic.
Characteristics of network security groups
NSG contains a list of security rules that allow or deny inbound or outbound network traffic
NSG can be associated to a subnet or a network interface
NSG can be associated multiple times
you create a NSG and define security rules in the azure portal
Azure creates several default security rules within each network security group, including inbound traffic and outbound traffic. Examples of default rules include DenyAllInbound traffic and AllowInternetOutBound traffic
Azure creates the default security rules in each network security group that you create
You can dd more security rules to a network security group by specifying conditions for any of the following settings:
Name
Priority
Port
Protocol
Source
Destination
Action
Each security rule is assigned a priority value. All security rules for a network security group are processed in priority order. When a rule has a low priority value, the rule has a higher priority or precedence in terms of order processing.
You cant remove the default security rules.
You can override a default security rule by creating another security rule that has a higher priority setting for your network security group
Azure defines three default inbound security rules for your network security group. These rules deny all inbound traffic except traffic from your virtual network and Azure load balancers
Azure defines three default outbound security rules for your network security group. These rules only allow outbound traffic to the internet and your virtual network.
![[default-security-group-rules.png]]
Each network security group and its defined rules are evaluated independently. Azure processes the conditions in each rule defined for each virtual machine in your configuration
For inbound traffic, azure first processes network security rules for any associated subnets and then any associated network interfaces
For outbound traffic, the process is reversed, azure first evaluates nsg rules for any associated network interfaces followed by any associated subnets
for both the inbound and outbound evaluation process, azure also checks how to apply the rules for intra-subnet traffic
![[network-security-group-rules.png]]
If you have several network security groups and arent sure which security rules are being applied, you can use the Effective security rules link the azure portal. You can use the link to verify which security rules are applied to your machines, subnets and network interfaces
You can implement application security groups in your azure virtual network to logically group your virtual machines by workload. You can then define your network security group rules based on your application security groups.
Application security groups works in the same way as network security groups, but they provide an application-centric way of looking at your infrastructure
Last updated