which will override the other,Azure NSG on the subnet or NSG on the VM?

Mohamed Ashraf 21

If I have NSG on the subnet and this subnet is associated with VM, and this VM also has its NSG.In this case which NSG will override the other?

prmanhas-MSFT 17,891 Reputation points Microsoft Employee

2020-07-13T10:51:00.9+00:00

@Mohamed Ashraf Any updates on the issue?

Please 'Accept as answer' if it helped, so that it can help others in the community looking for help on similar topics

Nidal Baz 1

For inbound traffic, Azure processes the rules in a network security group associated to a subnet first, if there is one, and then the rules in a network security group associated to the network interface, if there is one.

VM1: The security rules in NSG1 are processed, since it is associated to Subnet1 and VM1 is in Subnet1. Unless you've created a rule that allows port 80 inbound, the traffic is denied by the DenyAllInbound default security rule, and never evaluated by NSG2, since NSG2 is associated to the network interface. If NSG1 has a security rule that allows port 80, the traffic is then processed by NSG2. To allow port 80 to the virtual machine, both NSG1 and NSG2 must have a rule that allows port 80 from the internet.

https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

2 answers

Andreas Baumgarten 96,926 Reputation points MVP

2020-07-08T08:22:12.437+00:00

This is described here:

How traffic is evaluated

For inbound traffic, Azure processes the rules in a network security group associated to a subnet first, if there is one, and then the rules in a network security group associated to the network interface, if there is one.

For outbound traffic, Azure processes the rules in a network security group associated to a network interface first, if there is one, and then the rules in a network security group associated to the subnet, if there is one.

Maybe this is helpful.

Regards

Andreas Baumgarten

(Please don't forget to Accept as answer if the reply is helpful)
Please sign in to rate this answer.

3 people found this answer helpful.
Jessvin Thomas 1 Reputation point

2021-09-18T12:15:13.707+00:00

This is correct according to the documentation.

A better documentation link is:
https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works#inbound-traffic
https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works#outbound-traffic
https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works#outbound-traffic
Sign in to comment
Moamen Hany 1,091 Reputation points MVP

2020-08-07T22:29:37.317+00:00

The most restriction will be applied, as both will effects.

(Please don't forget to Accept as answer if the reply is helpful)
http://www.moamenhany.com
Please sign in to rate this answer.

2 people found this answer helpful.
Jessvin Thomas 1 Reputation point

2021-09-18T12:14:08.697+00:00

This is not correct according to the documentation:
https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

The documentation says:
For inbound traffic, Azure processes the rules in a network security group associated to a subnet first, if there is one, and then the rules in a network security group associated to the network interface, if there is one.

For outbound traffic, Azure processes the rules in a network security group associated to a network interface first, if there is one, and then the rules in a network security group associated to the subnet, if there is one.

Andreas Baumgarten 96,926 Reputation points MVP

2021-09-18T12:23:31.31+00:00

Hi @Jessvin Thomas ·,

The statement of MoamenHany is correct.

You are describing the order how the NSGs will be applied. But MoamenHany explained the result after the NSGs (one or more) are applied: The most restricted rules will block or allow incoming or outgoing connections.

----------

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten
Sign in to comment