Introduction
Network Security Groups (NSGs) in Azure play a critical role in safeguarding network communications. This blog post aims to demystify NSGs, explore their use cases, and provide practical scenarios to help us understand their importance in Azure’s networking infrastructure.
NSGs have continued to grow in capability, with improved diagnostics, flow logging, service tag expansion, rule hit visibility, and deeper integration with Azure Monitor and Azure Firewall. These enhancements strengthen NSG-based network segmentation and make it easier to analyze and refine network security policies.
What Are Network Security Groups?
Network Security Groups are a type of Azure resource that allows us to control network traffic to and from Azure resources in an Azure Virtual Network (VNet). An NSG contains a list of security rules that filter traffic based on several parameters like protocol, source and destination IP address, port number, and direction (inbound or outbound).
NSGs are stateful, meaning return traffic is automatically allowed once a rule permits traffic in either direction. This eliminates the need to create reverse rules manually.
Key Features of NSGs
Fine-Grained Control
NSGs offer precise control over traffic, enabling us to define security policies at the subnet or individual resource level.
Directional Traffic Management
Separate rules for inbound and outbound traffic ensure granular network flow management.
Integration with Azure Resources
NSGs can be associated with VMs (through its NIC), subnets, and standalone NICs within VNets.
Default and Custom Rules
Azure provides default rules, but we can create custom rules to meet specific security requirements.
Additional Capabilities and Enhancements
To support modern workloads, NSGs also benefit from:
Rule Hit Counts
Shows how often each NSG rule is matched, helping identify unused or overly permissive rules.
Flow Logs and Traffic Analytics
NSG Flow Logs combined with Traffic Analytics provide insights such as:
- Allowed/denied packets
- Top communicating IPs
- Network anomalies
- Protocol distribution
- Subnet-to-subnet communication patterns
Extensive Service Tag Support
Service Tags simplify creating rules for Azure platform services such as:
- VirtualNetwork
- Internet
- AzureLoadBalancer
- AzureMonitor
- Storage
- SQL
- AI and Machine Learning services
Service tags help avoid managing long IP lists manually.
Complementary to Azure Firewall
NSGs enforce Layer 3/4 filtering, while Azure Firewall provides deeper capabilities such as:
- Layer 7 inspection
- FQDN filtering
- Threat intelligence
- Centralized outbound control
Together, they form a strong network security foundation.
Private Endpoint Considerations
Private Endpoints use private IPs to access Azure services. NSGs do not apply to the Private Endpoint NIC itself. Instead, NSGs evaluate traffic at the subnet level, which is important when designing PaaS isolation strategies.
Use Cases and Scenarios
Securing Virtual Machines
By applying NSGs to VMs, we can control which ports are exposed to the internet, thereby reducing the attack surface.
Example Scenario:
Imagine we have a VM hosting a web server. We can configure an NSG to allow only HTTP (port 80) and HTTPS (port 443) traffic, blocking all other inbound traffic to the VM.
Subnet Isolation
NSGs can be used to isolate subnets within a VNet, ensuring that different segments of our network have specific access policies.
Example Scenario:
In a multi-tier application, we can allow the front-end servers to be accessible from the internet, whereas database servers are accessible only from the front-end servers.
Hybrid Cloud Connectivity
NSGs help manage and secure traffic flow when integrating with on-premises networks.
Example Scenario:
For a hybrid setup with an on-premises data centre, we can use NSGs to ensure that only specific traffic from the data centre can reach the Azure resources.
Additional Practical Scenarios
Micro-Segmentation
NSGs are commonly used to limit traffic between workload tiers, creating a zero-trust segmentation model inside the VNet.
Application Security Group (ASG)-Based Segmentation
ASGs allow grouping VMs logically (e.g., WebServers, AppServers), simplifying rule management.
Note: ASGs must be in the same region and subscription.
Securing PaaS Access with Private Endpoints
To restrict traffic to services like Storage or SQL over Private Endpoints, subnet-level NSG rules help control access paths.
Where Can NSGs be Configured and Attached?
NSGs can be associated with the following Azure resources:
Subnets
Applying an NSG to a subnet affects all resources within that subnet.
Network Interfaces (NICs)
Associating an NSG with a NIC impacts the traffic to and from that particular VM or resource.
Application Gateway (indirectly)
NSGs cannot be directly applied to Azure Application Gateways. However, we can indirectly secure an Application Gateway by applying NSGs to the subnet that hosts it or the backend resources it connects to.
Multi-NIC Virtual Machines
VMs with multiple NICs can have different NSGs per NIC for layered isolation.
Best Practices and Considerations
Rule Prioritization
Understand the rule processing order. Rules are processed based on priority, with lower numbers processed first.
Default Rules
Be aware of the default rules provided by Azure and how they interact with our custom rules.
Testing
Test our NSG rules in a non-production environment to ensure they behave as expected.
Monitoring and Logging
Utilize Azure’s monitoring tools to log and review the effectiveness of our NSG rules.
Additional Best Practices
- Use Service Tags and ASGs instead of hardcoded IP addresses to reduce maintenance overhead.
- Enable NSG Flow Logs and Traffic Analytics for visibility into real traffic patterns.
- Regularly review rule hit counts to remove unused rules.
- Combine NSGs with Azure Firewall for advanced filtering and outbound control.
- Keep inbound rules minimal and prefer Private Endpoints for PaaS traffic.
Conclusion
Network Security Groups are a vital component of Azure’s security framework. By effectively utilizing NSGs, we can create a robust and secure network environment tailored to our organization’s needs. Whether we’re securing a single VM or an entire subnet, NSGs provide the tools necessary to protect our Azure resources.
With enhanced diagnostics, service tag expansion, subnet-level Private Endpoint control, and rich monitoring integrations, NSGs remain a powerful and essential part of designing secure Azure network architectures.
See also
Related Labs
- R4201 – Creating an NSG and Associating It with a Subnet
- R4206 – Creating an NSG and Associating It with a NIC