Quartz 5

effective-nsg-rules

Properties2
tagsnetworking, nsg, troubleshoot
aliaseseffective security rules

2 min read

Effective NSG rules

What it is

Effective NSG rules are the combined rules that apply to one VM network interface after Azure considers the NSG on its subnet, the NSG on its NIC, default rules, priorities, and direction. They answer “which traffic-filter rules actually apply to this interface?” rather than merely showing the rules written in one NSG.

Why it exists

One NSG might allow a port while another NSG associated at a different scope blocks it. Effective rules expose that combined picture, making them a starting point for diagnosing an unexpected allow or deny.

Key ideas

  • Check the correct interface. A VM with multiple NICs can have different effective rules for each NIC. Azure shows this view only when the VM is running and an NSG is associated with its NIC or subnet.
  • Priority and direction still apply. For a new flow, lower priority numbers are evaluated first in the relevant direction. If both a subnet NSG and NIC NSG apply, the connection needs to be allowed through both levels.
  • NSGs are stateful. When a new connection is allowed, its response traffic is allowed without writing a mirror-image return rule. This does not make an unrelated new connection in the reverse direction allowed.
  • Effective rules are not the whole path. NSGs filter traffic; route tables choose next hops. DNS, an operating-system firewall, an Azure Firewall/NVA, a load balancer, and the destination listener can still prevent the connection.
  • Use the matching diagnostic. Effective security rules show applicable policy; Network Watcher IP Flow Verify tests an expected five-tuple decision; Connection Monitor measures an ongoing end-to-end path.

Northwind example

Northwind’s web VM cannot reach the private order API on TCP 443. Maya checks the web VM’s effective rules and finds that the subnet NSG allows 443 but the NIC NSG has an earlier deny rule. She fixes the NIC rule, then checks the effective route and API listener. Only after these policy and path checks does she use Connection Monitor to watch the web-to-API path over time.

Exam decision

When a VM cannot reach a service, inspect effective NSG rules and routes separately. Do not assume a subnet-level rule overrides a NIC-level rule simply because it is “closer” or “broader.”

nsg · network-watcher · route-table · connection-monitor

📘 Source: Microsoft Learn — Diagnose a VM network traffic filter problem

Graph View

Backlinks