Network Security Group (NSG)

Network Security Group (NSG) helps to filter inbound and outbound traffic from Azure Virtual Machine and PAAS(Web and Worker Role - Classic Model). These rules can be applied on the Network Interface Card(NIC), Subnet, and in the Network Configuration Schema. It function as a mini firewall. Rules are evaluated based on the weight assigned to them. Lower weight will be evaluated first. By default, it contain at least 3 inbound (AllowVNetInBound, AllowAzureLoadBalancerInBound, DenyAllInBound) and 3 outbound rules(AllowVnetOutBound, AllowInternetBound, DenyAllOutBound).

NSG can be applied using portal, PowerShell, CLI and using Template and easy way is via portal.

NSG FAQ

1. How can I check if my rules are applied or not?
Ans: Using the built in tool Network Watcher you can verify is rules is being applied and working or not. Remember, Network Watcher needs to be enabled before performing check.


2. How to know which rules will be evaluated first? / How priority is defined in NSG?
Ans: All rules are evaluated based on their weight/priority. Smaller the value (higher priority) will be evaluated first.  

3. What are the resources that I can protect using NSG?
Ans: NSG can be applied to subnet. So, all the resources can generate network traffic or have IP address enabled can be protected using NSG. Ex. Virtual Machine, where NSG will be attached to NIC. 

4. Does it replace deploying third party firewall?
Ans: No, the objective of Firewall and NSG is very different, however NSG also works as a firewall with very limited functionality.  

5. Is there any limitation of NSG?
Ans: By default we are able to create upto 100 NSG group's and under each group maximum of 200 rules are allowed. If you need more, then we need to open support ticket with Microsoft.

How to apply NSG using Azure Portal 

Step 1: In Azure ARM Portal, Click at +
Step 2: Search for Network Security Group


Step 3: Select Network Security Group
Step 4: Create
Step 5: Specify Name, Subscription, Resource Group and Location 
Step 6: Create and wait till its Deployed 
Step 7: Click at Go to Resource


Step 8: Following User Interface will be displayed.


Step 9: From Setting blade, Configure Inbound, Outbound Rule as required and attached it to the Network Interface or Subnet.

Comments

Post a Comment

Popular posts from this blog

Deploy Palo Alto in Azure

Image
There are many ways to deploy Palo Alto Firewall in Azure. Out of those options today I will discuss how Palo Alto can be configured to protect your Azure workload. This setup is suitable for Proof of Concept only. Planning-Includes Minimum Requirement - Without HA Logical Diagram:  Create Virtual Network Name: PAN-VNet Address Space: 10.0.0.0/16 Subnet Name: Management Subnet Address Space: 10.0.1.0/24 Subnet Name: Untrust Subnet Address Space: 10.0.2.0/24 Subnet Name: Trust Subnet Address Space: 10.0.3.0/24 Resource Group: PA-VNet    Subnet Spin Web Server Virtual Machine  Name: SecureWebServices Image: Windows Server 2016 Resource Group: Services Network: PAN-VNet Subnet: Trust Role: Web Server (IIS) Installed Change NSG rules of Web Server to accept request on port 80, if you wish to test the web request. However, later on, this behaviour will be controlled through firewall. Spin Palo Alto Firewall Virtual Machine Name: vmseries300 Im
Read more

Demystifying System and User Define Routes of Azure

Image
As Virtual Network is created, Azure automatically create its own route tables for that Virtual Network, so that all the packets which enters the virtual network can traverse within its address prefix and leave the subnet for its destination. These are known as the Default Routes . We can’t modify these routes; however, we can add our custom routes on top of default routes for the traffic leaving the subnet. These custome route is known as User Define Routes . In this case, we are modifying the default behaviour of packets routing but still the internal and external routing of packet is done by virtual network to ensure that our packets are never hijacked.  In another word, we are adding routes and requesting virtual network to routes traffic in the way we want. So far its not possible to route the traffic independently bypassing the Azure Virtual Network routing mechanism and for security reason I do not think this will ever be possible. Common Use Case of UDR:  Every bus
Read more

Azure Private DNS Zone - App Service Environment V2 Step by step - Part 2

Image
Create a Private DNS Zone for App Service Environment  From the Azure Portal, Click at +, and search for Private DNS Zone, and select Create. Provide the resource group name and Zone name. Make sure it matches with the domain name used in web app running inside the Isolated Environment. Once is completed, create "A" record for '*', '*.scm", web app name, ftp, and publish.  I have not created pointer for ftp and publish.   We can bind this to Virtual Network. App Service Environment V2 Step by step - Part 2
Read more