question

RavikiranS-0089 avatar image
0 Votes"
RavikiranS-0089 asked RavikiranS-0089 commented

How the network security rules are processed?


I have these inbound security rules for my VM.
Priority 1005: Allows RDP connections from Azure Bastion. Bastion's public IP is 52.191.87.53
Priority 1010: Denies RDP connections from the VNet.

97794-nsg-qna.png

As per my understanding, rule 1005 should be processed (higher priority compared to 1010), and I should be able to access VM via Bastion. But, still, the RDP connection is denied.

The MS document says this:

"Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same attributes as rules with higher priorities are not processed."

This indicates that rule 1010 is processed. I am not able to understand why

97821-nsg-qna.png


azure-virtual-networkazure-bastion
nsg-qna.png (72 B)
nsg-qna.png (22.5 KiB)
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

1 Answer

AndreasBaumgarten avatar image
0 Votes"
AndreasBaumgarten answered RavikiranS-0089 commented

Hi @RavikiranS-0089 ,

Azure Bastion will not connect via public IP (52.191.87.53) to the VMs. Bastion is using a dedicated AzureBastionSubnet for communication with the Azure VMs.
https://docs.microsoft.com/en-us/azure/bastion/bastion-nsg

The Security Rule in your NSG should not configured with the 52.191.87.53 as source. Instead you could use the AzureBastionSubnet IP address range as source. This is the recommendation form Microsoft as well: https://docs.microsoft.com/en-us/azure/bastion/bastion-nsg#target-vm-subnet


(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

· 2
5 |1600 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

You are welcome :-)


Kind regards
Andreas Baumgarten

0 Votes 0 ·