Configure Network Security Groups

Module 3 · Configure Network Security Groups

MS Learn: Configure Network Security Groups · learn.wwl.configure-network-security-groups Module note for Path MOC

Overview

Add the security layer: filter inbound/outbound traffic at the subnet and/or NIC boundary using Network Security Groups, and group workloads by role using Application Security Groups to keep rules readable and portable.

Learning objectives (from Microsoft Learn)

In this module, you learn how to:

• Determine when to use network security groups.
• Create network security groups.
• Implement and evaluate network security group rules.
• Describe the function of application security groups.

Units

1. Introduction
2. Implement network security groups
3. Determine NSG rules
4. Determine effective (NSG) rules
5. Create NSG rules
6. Implement application security groups (ASGs)
7. Interactive lab: implement network security groups
8. Knowledge check
9. Summary and resources

Concepts introduced

• Network Security Group — priority-ordered allow/deny rules at subnet/NIC.
• Application Security Group — NIC grouping by role used as rule source/destination.
• (Contrast) Azure Firewall — centralized, stateful, app-layer perimeter.

Key terms & commands (Azure CLI)

az network nsg create -g <rg> -n nsg-web
az network nsg rule create -g <rg> --nsg-name nsg-web -n r1     --priority 100 --source-address-prefixes Internet --destination-port-ranges 80 443     --access Allow --direction Inbound --protocol Tcp
az network vnet subnet update -g <rg> --vnet-name <vnet> -n snet-web     --network-security-group nsg-web

Hands-on

• Create an NSG, associate to a subnet; watch effective rules combine subnet+NIC.
• Build an ASG, assign VMs, and write an NSG rule using the ASG as source/destination.
• Use Network Watcher → IP Flow Verify to confirm a specific flow is allowed/denied.

Exam focus

• Priority order (lower number wins); default rules (vnet-internal allow, deny internet inbound) can be overridden, not deleted.
• Effective rules = subnet rules then NIC rules.
• NSG = filter; route table = path.
• ASG lets NSG rules reference roles/names instead of IPs.

Related

Path MOC · nsg · asg · subnet · configure-virtual-networks