The booking portal of Nordlicht Reisen GmbH, a fictional travel agency, has three tiers: web servers, application servers and database servers. Only the web servers should be reachable from the internet, and only over HTTPS. The application servers should accept calls only from the web servers, the database servers only from the application servers. RDP and SSH should never come in from the internet. The exam calls this: create and configure network security groups (NSGs) and application security groups (ASGs) and evaluate effective security rules in NSGs.
Prior knowledge: How firewalls, ports and SSH work is covered in K3, lesson 3.0.6 ("Firewalls, NSGs and SSH"); the idea of "allow as little as necessary" is in K3, lesson 3.3.5 ("Least privilege and Defender for Cloud"). The virtual network with subnets comes from lesson 4.1. This lesson shows how you create, order and check the rules.
The network security group
A network security group (NSG) contains rules that allow or deny inbound and outbound traffic. You associate an NSG with a subnet or a network interface (NIC). The same NSG can be associated with several subnets and network interfaces, but each subnet and each network interface has at most one NSG.
Rules
A rule has these properties:
| Property | Meaning |
|---|---|
| Name | unique within the NSG, up to 80 characters |
| Priority | number from 100 to 4096; the smaller number is checked first; two rules with the same priority and direction are not allowed |
| Source, destination | any, a single IP, a CIDR block, a service tag or an application security group |
| Source and destination ports | one port, a range or a list |
| Protocol | TCP, UDP, ICMP, ESP, AH or any |
| Direction | inbound or outbound |
| Action | allow or deny |
Azure evaluates every rule by the five values source, source port, destination, destination port and protocol. If traffic matches a rule, evaluation ends; further rules are not looked at. NSGs filter at layers 3 and 4; they do not inspect the content.
NSGs are stateful. If you have allowed inbound traffic on a port, the response needs no outbound rule, and vice versa: whoever allows an outbound call needs no inbound rule for the response. New and changed rules affect only new connections; an existing SSH session stays open even after you delete the rule.
The six default rules
Every NSG contains default rules with the lowest priorities. They cannot be deleted, but you can override them with your own rules (your own rules have numbers between 100 and 4096, so a higher priority):
| Priority | Name | Direction | Action | Meaning |
|---|---|---|---|---|
| 65000 | AllowVnetInBound |
in | allow | traffic from the virtual network |
| 65001 | AllowAzureLoadBalancerInBound |
in | allow | traffic from the Azure load balancer |
| 65500 | DenyAllInBound |
in | deny | everything else inbound |
| 65000 | AllowVnetOutBound |
out | allow | traffic into the virtual network |
| 65001 | AllowInternetOutBound |
out | allow | outbound to the internet |
| 65500 | DenyAllOutBound |
out | deny | everything else outbound |
For the exam this means: nothing comes in from the internet that you have not explicitly allowed (DenyAllInBound). But inside the virtual network, everything is allowed by default (AllowVnetInBound). The service tag VirtualNetwork covers the network's address space, connected address spaces (peerings), on-premises networks connected over VPN or ExpressRoute, and service endpoints. If you want to separate tiers inside the network, you therefore need deny rules of your own.
Subnet and network interface together
If you have NSGs on both the subnet and the network interface, both must allow the traffic:
| Direction | Order |
|---|---|
| inbound | first the NSG on the subnet, then the one on the network interface |
| outbound | first the NSG on the network interface, then the one on the subnet |
Microsoft advises choosing one standard (subnet or network interface) and documenting deviations: two NSGs produce blocks that are hard to find. An NSG on the subnet applies to everything in it; one on the network interface is for exceptions, such as a jump host. A Standard load balancer or a Standard public address (lesson 4.1) lets inbound traffic through only once an NSG allows it.
Service tags
A service tag stands for the IP ranges of an Azure service, which Microsoft maintains: for example Internet (all public addresses outside your network), VirtualNetwork, AzureLoadBalancer, Storage, Sql and AzureCloud. You cannot create service tags of your own. A rule holds only one service tag. Augmented security rules allow several IP ranges and ports in one rule.