Azure Network Security GroupsFirewall

Azure Network Security Groups (NSG): Overview and Configuration Example

Azure Network Security Groups (NSGs) are a fundamental component of Azure's network security model. They act as virtual firewalls for controlling inbound and outbound traffic to network interfaces (NIC), virtual machine (VM), and other Azure resources. Here's a detailed overview of Azure NSGs along with a configuration example:

Features of Azure Network Security Groups

  1. Stateful Filtering:

    • Provides stateful packet filtering, allowing the definition of rules for both inbound and outbound traffic.
  2. Application Security Groups:
    • Enables the use of Application Security Groups to simplify network security group rule management.
  3. Inbound and Outbound Rules:
    • Defines rules for controlling traffic entering (inbound) and leaving (outbound) Azure resources.
  4. Priority and Order:
    • Assigns priorities to rules for precise control over rule enforcement order.
  5. Port and Protocol Filtering:
    • Filters traffic based on specific ports, protocols, and IP addresses.
  6. Network Virtual Appliances (NVA) Integration:
    • Integrates with third-party network virtual appliances for advanced networking scenarios.
  7. Security Rules Logging:
    • Logs security rules to Azure Monitor for auditing and compliance purposes.
  8. Integration with Azure Virtual Networks:
    • Associates NSGs with Azure Virtual Networks and subnets.

Configuration Example

Let's configure an Azure Network Security Group for a sample scenario:

  1. Login to Azure Portal:

  2. Create an Azure Network Security Group:
    • Click on "Create a resource" and search for "Network Security Group."
    • Click "Create" to start the Azure Network Security Group creation wizard.
  3. Configure NSG Settings:
    • Specify details such as subscription, resource group, NSG name, region, and whether you want to associate it with an existing virtual network or create a new one.
  4. Define Inbound and Outbound Rules:
    • Create inbound and outbound rules based on your application's requirements. Define rules for specific IP addresses, ports, and protocols.
  5. Configure Security Rules Priority:
    • Assign priorities to rules to control the order of rule enforcement. Lower numbers have higher priority.
  6. Associate NSG with Azure Resources:
    • Associate the NSG with Azure resources, such as virtual machines or subnets, to enforce security rules.
  7. Configure Application Security Groups (Optional):
    • If needed, create and configure Application Security Groups to simplify rule management.
  8. Enable Security Rules Logging (Optional):
    • Enable logging for security rules to capture information for auditing and compliance.
  9. Review and Create:
    • Review the configured settings and click "Create" to deploy the Azure Network Security Group.
  10. Monitor NSG Usage:
    • Use Azure Monitor or other monitoring tools to track NSG usage, rule hits, and logs.
  11. Scale Resources (Optional):
    • Depending on your security requirements, scale resources by adjusting NSG rules, priorities, or associating with additional resources.
  12. Clean Up Resources:
    • Once done, clean up resources by deleting the Azure Network Security Group or specific resources as needed.
IT Knowledge Base · Azure · Azure Network Security Groups