Find the blocking rule with IP flow verify

vm-client (10.1.2.4, in subnet-client) can't reach the HTTPS site on vm-web (10.1.1.4, in subnet-web). subnet-web has nsg-web attached. Instead of guessing, ask Network Watcher which rule is blocking it, then add a rule to nsg-web that allows only HTTPS (port 443) from subnet-client. SSH (port 22) must stay blocked.

1. Test an inbound TCP packet to vm-web on 443 from vm-client.

   az network watcher test-ip-flow -g rg-lab --vm vm-web --direction Inbound --protocol TCP --local 10.1.1.4:443 --remote 10.1.2.4:*Type it
   What's this?

   Checks whether one packet is allowed or denied to or from a VM, and names the security rule that decided. Use it for security rule problems.

   • -g the resource group the resources live in
   • --vm the virtual machine to test from
   • --direction Inbound for traffic coming in to the VM, Outbound for traffic leaving it
   • --protocol TCP or UDP
   • --local the VM's own IP and port
   • --remote the other side's IP and port (* means any port)
   • --vm vm-web the VM to test
   • --direction Inbound traffic coming into the VM
   • --local 10.1.1.4:443 the VM's own IP and port
   • --remote 10.1.2.4:* the other side, any source port

2. Answer below with the rule name that comes after securityRules/.

   Which rule denied the traffic?

   Check

3. Add an allow rule for HTTPS from subnet-client at a lower priority number than the deny.

   az network nsg rule create -g rg-lab --nsg-name nsg-web --name Allow-HTTPS-Client --priority 300 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes 10.1.2.0/24 --destination-port-ranges 443Type it
   What's this?

   Adds or changes one rule in a network security group (NSG). Rules are checked from the lowest priority number up, and the first match decides.

   • -g the resource group the resources live in
   • --nsg-name the network security group the rule is in
   • --name the name of the thing to look at or change
   • --priority where the rule sits in the order. Lower numbers are checked first
   • --direction Inbound for traffic coming in to the VM, Outbound for traffic leaving it
   • --access Allow or Deny
   • --protocol TCP or UDP
   • --source-address-prefixes which source addresses the rule matches
   • --destination-port-ranges which ports the rule matches
   • --priority 300 runs before the deny at 4000
   • --source-address-prefixes 10.1.2.0/24 only subnet-client
   • --destination-port-ranges 443 only HTTPS

4. Run the same test again and see the new verdict.

   az network watcher test-ip-flow -g rg-lab --vm vm-web --direction Inbound --protocol TCP --local 10.1.1.4:443 --remote 10.1.2.4:*Type it
   What's this?

   Checks whether one packet is allowed or denied to or from a VM, and names the security rule that decided. Use it for security rule problems.

   • -g the resource group the resources live in
   • --vm the virtual machine to test from
   • --direction Inbound for traffic coming in to the VM, Outbound for traffic leaving it
   • --protocol TCP or UDP
   • --local the VM's own IP and port
   • --remote the other side's IP and port (* means any port)