Network Security Groups Filter Azure VM Traffic

What Network Security Groups Are

An Azure Network Security Group (NSG) is a core security component used to filter network traffic to and from Azure resources within an Azure Virtual Network (VNet). An NSG contains a list of security rules that allow or deny inbound and outbound network traffic based on several criteria: source and destination IP addresses, source and destination port ranges, and protocol (such as TCP or UDP).

How It Meets the Requirement

In this scenario, the organization needs to restrict access so that only traffic over authorized ports reaches the virtual machine hosting the accounting application. An NSG addresses this requirement by allowing administrators to define custom inbound security rules with specific priorities that permit designated traffic (e.g., HTTPS on port 443 or specific management ports) while relying on default or custom deny rules to block all other incoming traffic.

Key Advantages and Capabilities

• Granular Traffic Filtering: Allows defining multi-layer rules specifying source, destination, port ranges, and protocol (TCP, UDP, ICMP, or Any).
• Flexible Association: Can be associated directly with a subnet, a VM's network interface (NIC), or both to provide defense-in-depth security.
• Stateful Packet Inspection: NSGs are stateful; when an inbound connection is permitted, return outbound traffic for that session is automatically allowed regardless of outbound rules.
• Rule Prioritization: Evaluates rules sequentially based on a numeric priority score (100 to 4096), processing lower numbers first.
• Built-in Default Rules: Includes baseline platform rules to safely govern intra-virtual network traffic, load balancer health probes, and internet outbound connectivity.

Why This Is Optimal

Network Security Groups provide an integrated, native, and cost-effective mechanism for layer-4 network access control on Azure VMs. Unlike routing or addressing services, NSGs are specifically designed to serve as a distributed firewall boundary around subnets and virtual machine network interfaces.