Allow HTTPS with a service tag

nsg-web on subnet-web blocks everything inbound to vm-web (10.1.1.4). HTTPS (443) on vm-web should be open to vm-client in vnet-app and to vm-partner in vnet-partner, with one rule. vnet-partner is already peered to vnet-app, which means the two VNets are joined so their VMs can talk. You'll build a peering yourself later. SSH (22) stays closed.

1. See the rule that blocks everything.

   az network nsg rule list -g rg-lab --nsg-name nsg-web -o tableType it
   What's this?

   Lists the rules in a network security group, so you can read them in priority order.

   • -g the resource group the resources live in
   • --nsg-name the network security group the rule is in

2. Allow HTTPS from the VirtualNetwork tag, at a priority that runs before the deny.

   az network nsg rule create -g rg-lab --nsg-name nsg-web --name Allow-HTTPS-VNet --priority 300 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes VirtualNetwork --destination-port-ranges 443Type it
   What's this?

   Adds or changes one rule in a network security group (NSG). Rules are checked from the lowest priority number up, and the first match decides.

   • -g the resource group the resources live in
   • --nsg-name the network security group the rule is in
   • --name the name of the thing to look at or change
   • --priority where the rule sits in the order. Lower numbers are checked first
   • --direction Inbound for traffic coming in to the VM, Outbound for traffic leaving it
   • --access Allow or Deny
   • --protocol TCP or UDP
   • --source-address-prefixes which source addresses the rule matches
   • --destination-port-ranges which ports the rule matches
   • --source-address-prefixes VirtualNetwork the service tag, instead of a list of ranges
   • --priority 300 lower than the deny's 4000, so it's processed first

3. Answer the question below.

   Does the VirtualNetwork tag include peered virtual networks? (yes or no)

   Service tag

   A name for a group of IP addresses that Azure keeps up to date, used in rules instead of typing ranges, like VirtualNetwork or Internet.

   Peering

   A direct link between two virtual networks so their VMs can talk to each other.

   Check