How to test the NSG diagnostics for Bulk source and destination in azure

53654583 111

hi i have 3 source ips and 38 destination ips we need to test the flows from all the 3 source ips to all 38 destination ips on port 3389 , please help me how can i run it in a one go.

GitaraniSharma-MSFT 47,676 Reputation points Microsoft Employee

2024-02-21T10:30:35.0233333+00:00
Hello @53654583 ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

Could you please provide the below details?

Where are these 3 source IPs and 38 destination IPs? Are they all in Azure?

Is the port 3389 source port or destination port?

Are you trying to test NSG diagnostics or end-to-end connection between your endpoints?

The NSG diagnostics is an Azure Network Watcher tool that helps you understand which network traffic is allowed or denied in your Azure virtual network along with detailed information for debugging. For a given source-destination pair, network security group diagnostics returns all network security groups that will be traversed, the rules that will be applied in each network security group, and the final allow/deny status for the flow.

Refer: https://learn.microsoft.com/en-us/azure/network-watcher/network-watcher-network-configuration-diagnostics-overview

https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-network-security-rules?tabs=portal

Connection Monitor provides unified, end-to-end connection monitoring in Azure Network Watcher. The Connection Monitor feature supports hybrid and Azure cloud deployments. In monitors that you create by using Connection Monitor, you can add on-premises machines, Azure virtual machines (VMs), and Azure Virtual Machine Scale Sets as sources. These connection monitors can also monitor connectivity to endpoints. The endpoints can be on Azure or on any other URL or IP.

Refer: https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-overview

https://learn.microsoft.com/en-us/azure/network-watcher/connection-monitor-create-using-portal

NOTE: Connection Monitor now supports the auto-enabling of monitoring extensions for Azure and non-Azure endpoints. You no longer have to install monitoring solutions manually while you're creating a connection monitor.

Regards,

Gita
53654583 111 Reputation points

2024-02-21T12:02:56.79+00:00

I need help for checking NSG test for multiple destination ips at once, as it is very difficult to check each destination one by one we have 38 ips to check , please help if we can run that using bulk test
53654583 111 Reputation points

2024-02-22T08:23:38.4266667+00:00
Where are these 3 source IPs and 38 destination IPs? Are they all in Azure? -- both are in azure.

Is the port 3389 source port or destination port? destination port

Are you trying to test NSG diagnostics or end-to-end connection between your endpoints? only NSG is required.
GitaraniSharma-MSFT 47,676 Reputation points Microsoft Employee

2024-02-22T11:42:00.9966667+00:00

@53654583 , thank you for the details. Please allow me some time to check this internally and get back to you with an update.

1 answer

GitaraniSharma-MSFT 47,676 Reputation points Microsoft Employee

2024-03-04T13:06:35.1366667+00:00

Hello @53654583 ,

I understand that you would like to know how to test NSG diagnostics for multiple sources and destinations at once.

You need help in checking NSG for multiple destination IPs at once. You have 3 source IPs and 38 destination IPs and would like to test the flows from all the 3 source IPs to all 38 destination IPs on port 3389 at once.

I discussed this with the Azure Network Watcher Product Group team and below is their response:

One NCD (Network Configuration Diagnostic) test will run in context of a single source. However, you can specify multiple destinations to evaluate NCD w.r.t same source.

Using PowerShell, create one profile for each destination and then run the NCD test.

Refer: https://learn.microsoft.com/en-us/powershell/module/az.network/invoke-aznetworkwatchernetworkconfigurationdiagnostic?view=azps-11.3.0#example-1-invoke-network-configuration-diagnostic-session-for-vm-and-specified-network-profile

https://learn.microsoft.com/en-us/azure/network-watcher/diagnose-network-security-rules?tabs=powershell#add-a-security-rule-to-allow-traffic-from-the-bastion-subnet

Could you please try the above and let me know if you see any issues while using this with multiple profiles?

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment