Network Security Groups (NSG) in Azure - Step-by-Step Execution

Process Flow - Network Security Groups (NSG)

Create NSG

↓

Define Security Rules

↓

Associate NSG to Subnet or NIC

↓

Traffic Arrives

↓

Check Rules in Priority Order

↓

Allow or Deny Traffic

↓

Traffic Allowed or Blocked

This flow shows how an NSG is created, rules are defined, associated to network resources, and how incoming traffic is checked against these rules to allow or block it.

Execution Sample

Azure

Create NSG "web-nsg"
Add rule: Allow TCP 80 inbound priority 100
Add rule: Deny all inbound priority 200
Associate NSG to subnet "web-subnet"

This example creates an NSG with two rules and associates it to a subnet to control inbound traffic.

Process Table

Step	Action	Rule Checked	Traffic Port	Rule Result	Traffic Outcome
1	Create NSG 'web-nsg'	N/A	N/A	N/A	NSG created
2	Add rule: Allow TCP 80 inbound priority 100	Allow TCP 80 inbound	N/A	Rule added	N/A
3	Add rule: Deny all inbound priority 200	Deny all inbound	N/A	Rule added	N/A
4	Associate NSG to subnet 'web-subnet'	N/A	N/A	N/A	NSG associated
5	Inbound traffic arrives on port 80	Allow TCP 80 inbound	80	Match	Allowed
6	Inbound traffic arrives on port 22	Allow TCP 80 inbound	22	No match	Check next rule
7	Inbound traffic arrives on port 22	Deny all inbound	22	Match	Denied
8	Inbound traffic arrives on port 443	Allow TCP 80 inbound	443	No match	Check next rule
9	Inbound traffic arrives on port 443	Deny all inbound	443	Match	Denied
10	Inbound traffic arrives on port 80	Allow TCP 80 inbound	80	Match	Allowed

💡 Traffic is allowed or denied based on the first matching rule in priority order.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5-10
NSG Rules	None	[Allow TCP 80 inbound, priority 100]	[Allow TCP 80 inbound, priority 100; Deny all inbound, priority 200]	[Rules associated to subnet]	[Rules applied to incoming traffic]
Traffic Port	N/A	N/A	N/A	N/A	80, 22, 443, 80 (varies per step)
Traffic Outcome	N/A	N/A	N/A	N/A	Allowed or Denied based on rules

Key Moments - 3 Insights

Why does traffic on port 22 get denied even though there is no explicit deny rule for port 22?

Because the deny all inbound rule with lower priority (higher number) matches all ports not allowed by earlier rules, so port 22 traffic is denied as shown in steps 6 and 7.

What happens if multiple rules match the same traffic?

The rule with the highest priority (lowest number) is applied first, so traffic is allowed or denied based on the first matching rule, as seen in step 5 where port 80 is allowed by the first rule.

Why do we associate the NSG to a subnet or NIC?

Associating the NSG to a subnet or NIC applies the rules to all traffic entering or leaving that resource, controlling network access as shown in step 4.

Visual Quiz - 3 Questions

Look at the execution table, what is the traffic outcome for inbound traffic on port 443 at step 9?

A Allowed

B No decision yet

C Denied

D Rule not found

💡 Hint

Check the 'Traffic Outcome' column at step 9 in the execution table.

At which step does the NSG get associated to the subnet?

A Step 4

B Step 3

C Step 2

D Step 5

💡 Hint

Look for the action mentioning 'Associate NSG to subnet' in the execution table.

If the deny all inbound rule was removed, what would happen to traffic on port 22?

A It would be allowed by default

B It would be denied by default

C It would match the allow TCP 80 rule

D It would cause an error

💡 Hint

Refer to the key moment explaining the deny all inbound rule effect on unmatched ports.

Concept Snapshot

Network Security Groups (NSG) control network traffic by applying rules.
Rules have priorities; lower numbers run first.
Traffic is allowed or denied based on the first matching rule.
NSGs are associated with subnets or network interfaces.
Default deny applies if no rule matches.
Use NSGs to protect Azure resources from unwanted traffic.

Full Transcript

Network Security Groups (NSG) are used in Azure to control network traffic to and from resources. First, you create an NSG and add security rules with priorities. Then, you associate the NSG to a subnet or network interface. When traffic arrives, Azure checks the rules in priority order. The first rule that matches the traffic decides if it is allowed or denied. For example, if there is a rule allowing TCP traffic on port 80 with priority 100, and a deny all inbound rule with priority 200, traffic on port 80 is allowed, but traffic on other ports like 22 or 443 is denied. This process helps secure your network by controlling access. If no rule matches, traffic is denied by default. Associating NSGs to subnets or NICs applies these rules to all traffic entering or leaving those resources.

Practice

1. What is the primary purpose of an Azure Network Security Group (NSG)?

easy

A. To monitor application performance

B. To store data securely in Azure Blob Storage

C. To control inbound and outbound traffic to Azure resources

D. To manage user identities and access

Solution

1. Step 1: Understand NSG function

   NSGs are designed to filter network traffic to and from Azure resources.

2. Step 2: Identify correct purpose

   They do not store data, manage identities, or monitor performance.

3. Final Answer:

   To control inbound and outbound traffic to Azure resources -> Option C

4. Quick Check:

   NSG controls traffic [OK]

Hint: NSG controls network traffic, not data or users [OK]

Common Mistakes:

• Confusing NSG with storage or identity services
• Thinking NSG monitors performance
• Assuming NSG stores data

2. Which of the following is the correct way to specify a rule priority in an NSG rule?

easy

A. Priority is a string describing the rule

B. Priority is an IP address range

C. Priority is a boolean value true or false

D. Priority must be a unique integer between 100 and 4096

Solution

1. Step 1: Understand NSG rule priority format

   NSG rule priority is a unique integer between 100 and 4096 that determines rule evaluation order.

2. Step 2: Eliminate incorrect types

   Priority is not a string, boolean, or IP range.

3. Final Answer:

   Priority must be a unique integer between 100 and 4096 -> Option D

4. Quick Check:

   Priority = integer 100-4096 [OK]

Hint: Priority is a number from 100 to 4096 [OK]

Common Mistakes:

• Using strings or booleans for priority
• Confusing priority with IP ranges
• Not using unique priority numbers

3. Given this NSG rule:
Priority: 200, Direction: Inbound, Access: Deny, Source: Any, Destination: 10.0.0.4, Protocol: TCP, Port: 22
What happens when a user tries to SSH (port 22) to 10.0.0.4?

medium

A. The connection is denied

B. The connection is allowed only if from a specific IP

C. The connection is allowed

D. The connection is logged but allowed

Solution

1. Step 1: Analyze rule details

   The rule denies inbound TCP traffic on port 22 to destination 10.0.0.4 from any source.

2. Step 2: Determine effect on SSH connection

   SSH uses TCP port 22, so the connection attempt matches the deny rule and is blocked.

3. Final Answer:

   The connection is denied -> Option A

4. Quick Check:

   Deny inbound TCP port 22 = connection denied [OK]

Hint: Deny inbound on port 22 blocks SSH connections [OK]

Common Mistakes:

• Assuming 'Any' source means allow
• Confusing deny with logging
• Ignoring direction and port in rule

4. You created an NSG rule to allow inbound HTTP traffic on port 80, but the traffic is still blocked. What is the most likely cause?

medium

A. The NSG is not attached to the subnet or network interface

B. A higher priority deny rule blocks port 80 traffic

C. The source IP address is not specified

D. The protocol is set to UDP instead of TCP

Solution

1. Step 1: Check rule priority and conflicts

   NSG rules are evaluated by priority; a deny rule with higher priority can block traffic despite allow rules.

2. Step 2: Confirm rule attachment and protocol

   While attachment and protocol matter, the most common cause is a conflicting higher priority deny rule.

3. Final Answer:

   A higher priority deny rule blocks port 80 traffic -> Option B

4. Quick Check:

   Higher priority deny overrides allow [OK]

Hint: Check for higher priority deny rules first [OK]

Common Mistakes:

• Ignoring rule priority order
• Assuming NSG attachment is always correct
• Confusing protocol types

5. You want to restrict access so only a specific IP address (203.0.113.5) can access a VM on port 3389 (RDP). Which NSG rule configuration achieves this securely?

hard

A. Priority: 300, Direction: Inbound, Access: Allow, Source: 203.0.113.5, Destination: Any, Protocol: TCP, Port: 3389

B. Priority: 100, Direction: Inbound, Access: Deny, Source: Any, Destination: Any, Protocol: TCP, Port: 3389

C. Priority: 200, Direction: Inbound, Access: Allow, Source: Any, Destination: Any, Protocol: TCP, Port: 3389

D. Priority: 400, Direction: Outbound, Access: Allow, Source: 203.0.113.5, Destination: Any, Protocol: TCP, Port: 3389

Solution

1. Step 1: Allow only specific IP inbound on port 3389

   Priority: 300, Direction: Inbound, Access: Allow, Source: 203.0.113.5, Destination: Any, Protocol: TCP, Port: 3389 allows inbound TCP traffic on port 3389 only from IP 203.0.113.5, which matches the requirement.

2. Step 2: Check other options for correctness

   Priority: 100, Direction: Inbound, Access: Deny, Source: Any, Destination: Any, Protocol: TCP, Port: 3389 denies all inbound TCP 3389 traffic, blocking access. Priority: 200, Direction: Inbound, Access: Allow, Source: Any, Destination: Any, Protocol: TCP, Port: 3389 allows all sources, which is insecure. Priority: 400, Direction: Outbound, Access: Allow, Source: 203.0.113.5, Destination: Any, Protocol: TCP, Port: 3389 is outbound, irrelevant for inbound access.

3. Final Answer:

   Priority: 300, Direction: Inbound, Access: Allow, Source: 203.0.113.5, Destination: Any, Protocol: TCP, Port: 3389 -> Option A

4. Quick Check:

   Allow inbound TCP 3389 from specific IP [OK]

Hint: Allow inbound from specific IP, deny others by priority [OK]

Common Mistakes:

• Allowing all sources instead of specific IP
• Using outbound direction instead of inbound
• Denying all traffic without exception