Network Security Groups
NSGs filter inbound and outbound traffic at subnet or network interface scope. Rules are processed by priority. Lower numbers win. Default rules allow VNet internal traffic and outbound internet, while denying unsolicited inbound traffic.
NSG Rule Anatomy
| Field | Meaning |
|---|---|
| Priority | Lower number is processed first. |
| Source and destination | IP prefix, service tag, application security group, or any. |
| Protocol | TCP, UDP, ICMP, ESP, AH, or any depending on rule support. |
| Port | Single port or range. |
| Action | Allow or deny. |
Application Security Groups
ASGs let you group VM NICs logically and use those groups in NSG rules. Use them when IP-based rules would be fragile because application tiers scale or change.
Flow Logs
Virtual network flow logs record traffic metadata. They help answer whether traffic was allowed or denied, from where, to where, on which port and protocol. For exam scenarios, flow logs are for investigation and visibility; NSG rules are for enforcement.
Network Watcher Security Tools
- IP flow verify checks whether a specific flow is allowed or denied.
- Effective security rules show the combined NSG effect on a NIC.
- Connection troubleshoot validates connectivity and reports likely failure points.
- Packet capture provides packet-level evidence for deeper debugging.
Azure Bastion
Azure Bastion provides browser-based or native-client RDP/SSH access to VMs without exposing public RDP/SSH ports. It requires AzureBastionSubnet and should be preferred over direct public management exposure.
Virtual Network Manager Security Admin Rules
Security admin rules apply centrally through Azure Virtual Network Manager. They can enforce organization-wide network rules across network groups and are useful when local NSG management is too decentralized.
Exam Scenarios
| Problem | Check first |
|---|---|
| VM cannot be reached over RDP | Prefer Bastion; if troubleshooting, check NSG, route, VM firewall, and public IP exposure. |
| App tier cannot reach database tier | Effective security rules, NSG priority, ASG membership, UDR next hop. |
| Need proof of denied traffic | Virtual network flow logs and Network Watcher tools. |
| Need central deny rule across many VNets | Virtual Network Manager security admin rules. |
Feature Deep Dive
Subnet NSG vs NIC NSG
You can associate NSGs with subnets and NICs. The effective result is the combination of both scopes. Subnet-level NSGs are easier to govern. NIC-level NSGs are more granular but can become harder to reason about. In troubleshooting, always inspect effective security rules rather than assuming which NSG wins.
Service Tags
Service tags represent Azure service IP ranges, such as AzureCloud, Storage, AzureMonitor, or VirtualNetwork. They reduce rule maintenance because Microsoft updates the underlying prefixes. Use them when rules should follow Azure service boundaries instead of hard-coded IP ranges.
ASG Tiering Pattern
ASGs are useful for classic three-tier apps. You can create ASGs such as web, app, and db, assign VM NICs to them, and write NSG rules like "web can reach app on 443" and "app can reach db on 1433" without embedding IP addresses.
Bastion Design
Bastion removes the need for public management ports on VMs. It still depends on VNet reachability and proper RBAC. For exam questions, public RDP or SSH exposure is usually the thing to avoid unless the question is explicitly about troubleshooting an existing exposure.
Rule Evaluation Example
If a VM cannot reach a database VM, check the outbound rule on the source subnet or NIC, the inbound rule on the destination subnet or NIC, route tables on both subnets, and the guest OS firewall. NSG flow logs can show the deny, but effective security rules explain the applied policy.
Scenario Workshop: The NSG Looks Right But Traffic Fails
Scenario: A subnet NSG allows app-to-database traffic, but connections still fail. The missing clue is often a NIC-level NSG, a UDR to a firewall, or the guest OS firewall. Azure network security is cumulative across several enforcement points.
| Control point | Question to ask |
|---|---|
| Source subnet NSG | Is outbound allowed? |
| Source NIC NSG | Is there a more specific outbound deny? |
| Route table | Does traffic go directly or through a firewall/NVA? |
| Destination subnet NSG | Is inbound allowed? |
| Destination NIC NSG | Is inbound denied at NIC scope? |
| Guest OS firewall | Is the workload accepting the port? |
Flow Log Reading Pattern
- Identify source IP, destination IP, destination port, protocol, and flow direction.
- Check whether the action is allow or deny.
- Correlate timestamp with the application failure.
- Use effective security rules to find the rule that produced the result.
- Use packet capture only when metadata is not enough.
Bastion Exam Pattern
If a requirement says administrators must connect to private VMs without exposing public IP addresses, Azure Bastion is the expected answer. If the requirement says Entra-based RDP in the portal or native client access, check Bastion SKU and feature support.
Previous | Next: Part 10 - Azure Firewall, WAF, and Final Review