Azure Learning

nsg

Properties2
tagsnetworking, security, nsg, firewall
aliasesNSG, network security group

2 min read

Network Security Group (NSG)

What it is

A Network Security Group (NSG) is a list of allow/deny rules (allow/deny) that filter inbound and outbound traffic at the subnet and/or NIC level for resources in a subnet. It has no routing; routing is handled separately by route tables.

Why it exists

You need cheap, per-interface/per-tier filtering of who can talk to whom inside your VNet and with the outside world. NSGs provide stateful, micro-segmented security filtering without a box — applied right at the workload.

Key ideas (the three pieces — memorize!)

  1. Security rules — each rule has: priority (lower number = higher priority), source/destination (IP/CIDR, service tag, app security group), protocol (TCP/UDP/any), port ranges, direction (inbound/outbound), and action (Allow/Deny).
  2. Association — an NSG binds to a subnet and/or one or more NICs. At a subnet you filter all its VMs; at a NIC you filter that one.
  3. Evaluation order — rules processed by priority, first match wins; default rules (allow VNet, deny internet inbound, etc.) exist and can’t be deleted, only overridden by higher-priority rules.

Flow logic (exam favorite)

subnet association  ────────┐
NIC association    ────────┼──► combine (effective rules)
                            ▼
         process rules by priority, first match decides allow/deny
  • An NSG applied at both subnet and NIC: subnet rules evaluated first, then NIC rules. Both must allow.
  • Stateful: an allowed inbound flow automatically allows the return traffic; NO need for a separate return rule.

How it fits

nsg.svg

Exam notes

  • Default rules: allow VNet-internal, deny all internet inbound, deny-all-internet-inbound on public IPs; override with higher-priority custom rules.
  • Never invent port/priority facts — use lowest-number (highest-priority) rule matches; empty NSG association = no filter applied (defaults allow everything unless explicitly restricted).
  • NSG = filter, route table = path, Azure Firewall = centralized+stateful higher-layer filtering.
  • An NSG can be reused across many subnets/NICs; it’s an agnostic object.

Home · asg · subnet · vnet · azure-firewall · network-watcher

📘 Source: Microsoft Learn — Nsg

Graph View

Backlinks