Network Security Groups
Tim Warner
AUTHOR/TECH EVANGELIST, PLURALSIGHT
@TechTrainerTim [Link]
NSG concepts and implementation
Overview Multi-NIC virtual machines
Custom Vnet routing
The Network Security
Group (NSG)
Stateful, software firewall objects
- Ingress and egress traffic
About NSGs Rules contain 5-tuple hashes
- Source, destination IP; Source,
destination port; Protocol
Rules are based on priority
- Lower values/higher priority
About NSGs Can be attached to:
- Subnet
- VM NIC
NSG Traffic Logic
[Link]/nsg9
Demo Create NSG
Cover default and custom rules
Attach NSG to existing subnet
Attach to existing NIC
Managing NSGs
NSG Logging
Network Watcher
Demo
Diagnostics
Network watcher
Multi-NIC Virtual Machines
Multi-NIC VM Use Cases
Separation of data plane from management plane
traffic
Connection to dedicated backup/recovery subnet
[Link]/mnvm
Create and Attach Multiple NICs
$frontEnd = $[Link] | Where-Object {$_.Name -eq 'mySubnetFrontEnd'}
$myNic1 = New-AzureRmNetworkInterface -ResourceGroupName "myResourceGroup" `
-Location "WestUS" -Name "myNic1" -SubnetId $[Link]
$backEnd = $[Link] | Where-Object {$_.Name -eq 'mySubnetBackEnd'}
$myNic2 = New-AzureRmNetworkInterface -ResourceGroupName "myResourceGroup" `
-Location "WestUS" -Name "myNic2" -SubnetId $[Link]
$vmConfig = Add-AzureRmVMNetworkInterface -VM $vmConfig -Id $[Link] -
Primary
$vmConfig = Add-AzureRmVMNetworkInterface -VM $vmConfig -Id $[Link]
Custom Routing
System- and User-defined Routes
Enable IP forwarding on the appliance VM
[Link]/udr
Forced Tunneling
[Link]/ft1
Perhaps show an already completed
Demo configuration with a virtual appliance
Mention that we’ll show appliance setup
later in the course
[Link]
quickstart-
templates/tree/master/barracuda-waf-iis
Summary NSG security is not optional in Azure IaaS
Use subnet scope first; use NIC scope to
be more specific
Remember the shared responsibility
model
Next module: Azure Load Balancers