Attach an NSG to a single NIC

vm-admin (10.1.1.5) shares subnet-app with vm-app (10.1.1.4), which serves HTTPS to everyone in the VNet. Only subnet-ops, where vm-ops lives, should reach vm-admin, and only on SSH (22). nsg-admin already has those rules. Attach it to vm-admin's NIC, vm-admin-nic, not the subnet, so vm-app isn't affected.

1. Attach nsg-admin to vm-admin's NIC.

   az network nic update -g rg-lab --name vm-admin-nic --network-security-group nsg-adminType it
   What's this?

   Changes a VM's network interface, such as its NSG or IP forwarding.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change
   • --name vm-admin-nic the network interface, not the VM
   • --network-security-group nsg-admin the NSG to associate

2. List everything that now filters vm-admin.

   az network nic list-effective-nsg -g rg-lab --name vm-admin-nicType it
   What's this?

   Shows every security rule applied to a VM's network interface, from the subnet's NSG and the NIC's NSG, in the order they're checked.

   • -g the resource group the resources live in
   • --name the name of the thing to look at or change

3. Answer the question below.

   For inbound traffic, which NSG does Azure check first: the subnet's or the NIC's?

   NSG

   Network security group: a list of allow and deny rules on a subnet or a network interface.

   NIC

   Network interface: a VM's network card in Azure. It holds the VM's private IP.

   Check