Create and attach an NSG

Security wants a network security group (NSG, a set of allow and deny rules) in front of subnet-web, where vm-web serves HTTPS. Create nsg-web, attach it to subnet-web, and look at the rules it starts with. vm-client in subnet-client, in the same VNet, should still reach vm-web afterward. Find out which rule allows it.

1. Create the NSG.

   az network nsg create -g rg-lab --name nsg-webType it
   What's this?

   Creates a network security group. It filters nothing until you attach it to a subnet or a network interface.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change

2. List its rules including the defaults.

   az network nsg rule list -g rg-lab --nsg-name nsg-web --include-default -o tableType it
   What's this?

   Lists the rules in a network security group, so you can read them in priority order.

   • -g the resource group the resources live in
   • --nsg-name the network security group the rule is in
   • --include-default also show the built-in default rules

3. Attach it to subnet-web.

   az network vnet subnet update -g rg-lab --vnet-name vnet-app --name subnet-web --network-security-group nsg-webType it
   What's this?

   Changes a subnet's settings, such as which NSG or route table is attached to it.

   • -g the resource group the resources live in
   • --vnet-name the virtual network
   • --name the name of the thing to look at or change

4. Answer question 1 from the table in step 2. For question 2, find the default rule that matches traffic from inside the VNet.

   What priority does DenyAllInBound have?

   Priority

   A number on each rule that sets the order Azure checks the rules in.

   Default rule

   A rule Azure puts in every NSG. You can't delete it.

   Check

   Which default rule lets vm-client reach vm-web?

   Default rule

   A rule Azure puts in every NSG. You can't delete it.

   Check