Network Security Groups and Application Security Groups

Understand Network Security Group Association and Rule Evaluation

Network Security Groups (NSGs) act as a virtual firewall that filters traffic for Azure resources using a set of security rules. Each rule uses a five-tuple system—source, source port, destination, destination port, and protocol (TCP or UDP)—to decide whether to allow or deny traffic. Because NSGs are stateful, when a rule permits traffic in one direction, the return traffic is automatically allowed without needing a separate rule.

Association Levels and Evaluation Order

You can associate an NSG at the subnet level, the network interface (NIC) level, or both, creating layers of security. For inbound traffic, Azure evaluates the subnet NSG first and then the NIC NSG; both must allow the traffic for it to reach the resource. For outbound traffic, the order is reversed: the NIC NSG is processed before the subnet NSG. If a resource has no NSG associated with its subnet or NIC, all traffic is blocked by default when the resource has a public IP.

Rule Priority and Default Rules

Every rule has a priority number ranging from 100 to 4096, where lower numbers have higher priority and are processed first. Once traffic matches a rule, Azure stops evaluating any further rules. This makes priority critical for resolving conflicts. Azure includes several default rules to ensure basic connectivity:

• AllowVNetInBound: Permits traffic within the same virtual network.
• AllowAzureLoadBalancerInBound: Allows traffic from Azure’s health probes.
• DenyAllInBound: Blocks all other traffic not explicitly allowed.

Simplifying with Service Tags and Application Security Groups

To manage complex environments, you can use Application Security Groups (ASGs) and Service Tags to reduce the number of rules. ASGs let you group virtual machines by function (for example, “WebServers”) so you apply rules to logical groups instead of individual IP addresses. Service Tags represent groups of IP addresses for specific Azure services, such as Storage.EastUS, and update dynamically as the service’s IP ranges change. These tools help you maintain security without manual updates.

Global Control with Security Admin Rules

For centralized management, Security Admin Rules from Azure Virtual Network Manager provide a higher level of control that sits above standard NSG rules. These rules are evaluated before any NSG rules and can be set to “Always Allow” or “Deny” to enforce company-wide policies. This creates a defense-in-depth strategy where central administrators set the baseline security, while individual teams manage application-specific needs through their own NSGs. Understanding this hierarchy is essential for determining the effective security rules applied to any resource.

Leverage Application Security Groups for Application-Centric Segmentation

Application Security Groups (ASGs) allow you to logically group virtual machines by application workload, enabling application-centric network segmentation. Instead of creating individual NSG rules for each VM or managing lists of IP addresses, you define ASGs that represent roles or tiers—such as web servers, business logic, or databases. This approach simplifies network security policy management and aligns it closely with your application architecture, making it easier to enforce granular access control.

Creating and Associating ASGs

You create an ASG using the Azure Portal, PowerShell, or CLI, specifying the resource group and region. After creation, you associate the network interfaces of your VMs with the appropriate ASG. A single network interface can belong to multiple ASGs, allowing flexible grouping based on workload requirements. All network interfaces in an ASG must reside in the same virtual network, ensuring consistent policy enforcement within that boundary.

Integrating ASGs into NSG Rules

NSGs act as the enforcement mechanism by filtering inbound and outbound traffic using rules that reference ASGs as the source or destination. For example, you can allow HTTP traffic from the Internet to all VMs in the “asg-web” group, or restrict database access so only VMs in the “asg-logic” group can connect to those in “asg-db”. NSG rules are processed in order of priority, and when multiple rules apply, the one with the highest priority (lowest number) takes precedence. This enables application-aware security policies that are both scalable and easy to maintain.

Key benefits of using ASGs include centralized management of security rules, simplified rule creation by referencing ASGs rather than explicit IP addresses, and enhanced segmentation that isolates workloads and minimizes the attack surface. When designing your network, plan ASGs according to your application’s tiers and access requirements. Regularly review and update your ASGs and NSG rules to align with changes in your application and network architecture.

Define and Implement Network Security Group Rules

Network Security Groups (NSGs) are essential for controlling inbound and outbound traffic to Azure resources. They act as a basic, stateful, packet-filtering firewall, allowing you to manage access based on IP address and TCP or UDP protocols. NSGs help ensure that only legitimate traffic is allowed to and from your virtual machines and services.

Key Features of NSGs

NSGs include several features that simplify management and reduce configuration errors:

• Augmented security rules simplify rule definitions, allowing complex rules without needing multiple simple rules.
• Service tags are Microsoft-created labels representing groups of IP addresses that update dynamically. For example, the tag Storage.EastUS applies to all Azure storage in the East US region.
• Application security groups allow you to group resources and create rules based on these groups, such as allowing traffic to all systems in the “Webservers” application group.

Configuring NSG Rules

To configure NSG rules, you must understand priority and default rules. NSG rules are evaluated based on their priority, with lower numbers having higher precedence. Each rule specifies a priority, action (allow or deny), direction (inbound or outbound), protocol (TCP, UDP, or any), and source and destination (IP addresses or service tags). You apply NSGs to subnets or network interfaces. When applied to a subnet, the rules affect all resources within that subnet. When applied to a network interface, the rules only affect the specific resource connected to that interface.

Best Practices

• Use service tags to simplify rule management and ensure dynamic updates as Azure service IP ranges change.
• Group resources using application security groups to streamline rule creation and management.
• Regularly review and update NSG rules to ensure they meet current security requirements and compliance standards.

By understanding and implementing NSG rules, you can effectively manage and secure traffic flow within your Azure virtual networks, ensuring robust network security and compliance.