Create, change, or delete a network interface

Learn how to create, change settings for, and delete a network interface. A network interface enables an Azure Virtual Machine to communicate with Internet, Azure, and on-premises resources. When creating a virtual machine using the Azure portal, the portal creates one network interface with default settings for you. You may instead choose to create network interfaces with custom settings and add one or more network interfaces to a virtual machine when you create it. You may also want to change default network interface settings for an existing network interface. This article explains how to create a network interface with custom settings, change existing settings, such as network filter (network security group) assignment, subnet assignment, DNS server settings, and IP forwarding, and delete a network interface.

If you need to add, change, or remove IP addresses for a network interface, read the Manage IP addresses article. If you need to add network interfaces to, or remove network interfaces from virtual machines, read the Add or remove network interfaces article.

Before you begin

Complete the following tasks before completing any steps in any section of this article:

  • Review the Azure limits article to learn about limits for network interfaces.
  • Log in to the Azure portal, Azure command-line interface (CLI), or Azure PowerShell with an Azure account. If you don't already have an Azure account, sign up for a free trial account.
  • If using PowerShell commands to complete tasks in this article, install and configure Azure PowerShell. Ensure you have the most recent version of the Azure PowerShell commandlets installed. To get help for PowerShell commands, with examples, type get-help <command> -full.
  • If using Azure command-line interface (CLI) commands to complete tasks in this article, install and configure the Azure CLI. Ensure you have the most recent version of the Azure CLI installed. To get help for CLI commands, type az <command> --help. Rather than installing the CLI and its pre-requisites, you can use the Azure Cloud Shell. The Azure Cloud Shell is a free Bash shell that you can run directly within the Azure portal. It has the Azure CLI preinstalled and configured to use with your account. To use the Cloud Shell, click the Cloud Shell >_ button at the top of the portal.

Create a network interface

When creating a virtual machine using the Azure portal, the portal creates a network interface with default settings for you. If you'd rather specify all your network interface settings, you can create a network interface with custom settings and attach the network interface to a virtual machine when creating the virtual machine (using PowerShell or the Azure CLI). You can also create a network interface and add it to an existing virtual machine (using PowerShell or the Azure CLI). To learn how to create a virtual machine with an existing network interface or to add to, or remove network interfaces from existing virtual machines, read the Add or remove network interfaces article. Before creating a network interface, you must have an existing virtual network in the same location and subscription you create a network interface in.

  1. Log in to the Azure portal with an account that is assigned (at a minimum) permissions for the Network Contributor role for your subscription. Read the Built-in roles for Azure role-based access control article to learn more about assigning roles and permissions to accounts.
  2. In the box that contains the text Search resources at the top of the Azure portal, type network interfaces. When network interfaces appears in the search results, click it.
  3. In the Network interfaces blade that appears, click + Add.
  4. In the Create network interface blade that appears, enter, or select values for the following settings, then click Create:

    Setting Required? Details
    Name Yes The name must be unique within the resource group you select. Over time, you'll likely have several network interfaces in your Azure subscription. Read the Naming conventions article for suggestions when creating a naming convention to make managing several network interfaces easier. The name cannot be changed after the network interface is created.
    Virtual network Yes Select the virtual network for the network interface. You can only assign a network interface to a virtual network that exists in the same subscription and location as the network interface. Once a network interface is created, you cannot change the virtual network it is assigned to. The virtual machine you add the network interface to must also exist in the same location and subscription as the network interface.
    Subnet Yes Select a subnet within the virtual network you selected. You can change the subnet the network interface is assigned to after it's created.
    Private IP address assignment Yes In this setting, you're choosing the assignment method for the IPv4 address. Choose from the following assignment methods: Dynamic: When selecting this option, Azure automatically assigns an available address from the address space of the subnet you selected. Azure may assign a different address to a network interface when the virtual machine it's in is started after having been in the stopped (deallocated) state. The address remains the same if the virtual machine is restarted without having been in the stopped (deallocated) state. Static: When selecting this option, you must manually assign an available IP address from within the address space of the subnet you selected. Static addresses do not change until you change them or the network interface is deleted. You can change the assignment method after the network interface is created. The Azure DHCP server assigns this address to the network interface within the operating system of the virtual machine.
    Network security group No Leave set to None, select an existing network security group, or create a network security group. Network security groups enable you to filter network traffic in and out of a network interface. You can apply zero or one network security group to a network interface. Zero or one network security group can also be applied to the subnet the network interface is assigned to. When a network security group is applied to a network interface and the subnet the network interface is assigned to, sometimes unexpected results occur. To troubleshoot network security groups applied to network interfaces and subnets, read the Troubleshoot network security groups article.
    Subscription Yes Select one of your Azure subscriptions. The virtual machine you attach a network interface to and the virtual network you connect it to must exist in the same subscription.
    Private IP address (IPv6) No If you select this checkbox, an IPv6 address is assigned to the network interface, in addition to the IPv4 address assigned to the network interface. See the IPv6 section of this article for important information about use of IPv6 with network interfaces. You cannot select an assignment method for the IPv6 address. If you choose to assign an IPv6 address, it is assigned with the dynamic method.
    IPv6 name (only appears when the Private IP address (IPv6) checkbox is checked) Yes, if the Private IP address (IPv6) checkbox is checked. This name is assigned to a secondary IP configuration for the network interface. Learn more about IP configurations in the View network interface settings section of this article.
    Resource group Yes Select an existing resource group or create one. A network interface can exist in the same, or different resource group, than the virtual machine you attach it to, or the virtual network you connect it to.
    Location Yes The virtual machine you attach a network interface to and the virtual network you connect it to must exist in the same location, also referred to as a region.

The portal doesn't provide the option to assign a public IP address to the network interface when you create it, though the portal does create a public IP address and assign it to a network interface when you create a virtual machine using the portal. To learn how to add a public IP address to the network interface after creating it, read the Manage IP addresses article. If you want to create a network interface with a public IP address, you must use the CLI or PowerShell to create the network interface.

Note

Azure assigns a MAC address to the network interface only after the network interface is attached to a virtual machine and the virtual machine is started the first time. You cannot specify the MAC address that Azure assigns to the network interface. The MAC address remains assigned to the network interface until the network interface is deleted or the private IP address assigned to the primary IP configuration of the primary network interface is changed. To learn more about IP addresses and IP configurations, read the Manage IP addresses article.

Commands

Tool Command
CLI az network nic create
PowerShell New-AzureRmNetworkInterface

View network interface settings

You can view and change most settings for a network interface after it's created.

  1. Log in to the Azure portal with an account that is assigned (at a minimum) permissions for the Network Contributor role for your subscription. Read the Built-in roles for Azure role-based access control article to learn more about assigning roles and permissions to accounts.
  2. In the box that contains the text Search resources at the top of the Azure portal, type network interfaces. When network interfaces appears in the search results, click it.
  3. In the Network interfaces blade that appears, click the network interface you want to view or change settings for.
  4. The following settings are listed in the blade that appears for the network interface you selected:
    • Overview: Provides information about the network interface, such as the IP addresses assigned to it, the virtual network/subnet the network interface is assigned to, and the virtual machine the network interface is attached to (if it's attached to one). The following picture shows the overview settings for a network interface named mywebserver256: Network interface overview You can move a network interface to a different resource group or subscription by clicking (change) next to the Resource group or Subscription name. If you move the network interface, you must move all resources related to the network interface with it. If the network interface is attached to a virtual machine, for example, you must also move the virtual machine, and other virtual machine-related resources. To move a network interface, read the Move resource to a new resource group or subscription article. The article lists prerequisites, and how to move resources using the Azure portal, PowerShell, and the Azure CLI.
    • IP configurations: Public and private IPv4 and IPv6 addresses assigned to IP configurations are listed here. If an IPv6 address is assigned to an IP configuration, the address is not displayed. Learn more about IP configurations and how to add and remove IP addresses in the Configure IP addresses for an Azure network interface article. IP forwarding and subnet assignment are also configured in this section. To learn more about these settings, read the Enable or disable IP forwarding and Change subnet assignment sections of this article.
    • DNS servers: You can specify which DNS server a network interface is assigned by the Azure DHCP servers. The network interface can inherit the setting from the virtual network the network interface is assigned to, or have a custom setting that overrides the setting for the virtual network it's assigned to. To modify what's displayed, complete the steps in the Change DNS servers section of this article.
    • Network security group (NSG): Displays which NSG is associated to the network interface (if any). An NSG contains inbound and outbound rules to filter network traffic for the network interface. If an NSG is associated to the network interface, the name of the associated NSG is displayed. To modify what's displayed, complete the steps in the Manage network security group associations article.
    • Properties: Displays key settings about the network interface, including its MAC address (blank if the network interface isn't attached to a virtual machine), and the subscription it exists in.
    • Effective security rules: Security rules are listed if the network interface is attached to a running virtual machine, and an NSG is associated to the network interface, the subnet it's assigned to, or both. To learn more about what's displayed, read the Troubleshoot network security groups article. To learn more about NSGs, read the Network security groups article.
    • Effective routes: Routes are listed if the network interface is attached to a running virtual machine. The routes are a combination of the Azure default routes, any user-defined routes (UDR), and any BGP routes that may exist for the subnet the network interface is assigned to. To learn more about what's displayed, read the Troubleshoot routes article. To learn more about Azure default and UDRs, read the User-defined routes article.
    • Common Azure Resource Manager settings: To learn more about common Azure Resource Manager settings, read the Activity log, Access control (IAM), Tags, Locks, and Automation script articles.

Commands

If an IPv6 address is assigned to a network interface, the PowerShell output returns the fact that the address is assigned, but it doesn't return the assigned address. Similarly, the CLI returns the fact that the address is assigned, but returns null in its output for the address.

Tool Command
CLI az network nic list to view network interfaces in the subscription; az network nic show to view settings for a network interface
PowerShell Get-AzureRmNetworkInterface to view network interfaces in the subscription or view settings for a network interface

Change DNS servers

The DNS server is assigned by the Azure DHCP server to the network interface within the virtual machine operating system. The DNS server assigned is whatever the DNS server setting is for a network interface. To learn more about name resolution settings for a network interface, see Name resolution for virtual machines. The network interface can inherit the settings from the virtual network, or use its own unique settings that override the setting for the virtual network.

  1. Log in to the Azure portal with an account that is assigned (at a minimum) permissions for the Network Contributor role for your subscription. Read the Built-in roles for Azure role-based access control article to learn more about assigning roles and permissions to accounts.
  2. In the box that contains the text Search resources at the top of the Azure portal, type network interfaces. When network interfaces appears in the search results, click it.
  3. In the Network interfaces blade that appears, click the network interface you want to view or change settings for.
  4. In the blade for the network interface you selected, click DNS servers under SETTINGS.
  5. Click either:
    • Inherit from virtual network (default): Choose this option to inherit the DNS server setting defined for the virtual network the network interface is assigned to. At the virtual network level, either a custom DNS server or the Azure-provided DNS server is defined. The Azure-provided DNS server can resolve hostnames for resources assigned to the same virtual network. FQDN must be used to resolve for resources assigned to different virtual networks.
    • Custom: You can configure your own DNS server to resolve names across multiple virtual networks. Enter the IP address of the server you want to use as a DNS server. The DNS server address you specify is assigned only to this network interface and overrides any DNS setting for the virtual network the network interface is assigned to.
  6. Click Save.

Commands

Tool Command
CLI az network nic update
PowerShell Set-AzureRmNetworkInterface

Enable or disable IP forwarding

IP forwarding enables the virtual machine a network interface is attached to:

  • Receive network traffic not destined for one of the IP addresses assigned to any of the IP configurations assigned to the network interface.
  • Send network traffic with a different source IP address than the one assigned to one of a network interface's IP configurations.

The setting must be enabled for every network interface that is attached to the virtual machine that receives traffic that the virtual machine needs to forward. A virtual machine can forward traffic whether it has multiple network interfaces or a single network interface attached to it. While IP forwarding is an Azure setting, the virtual machine must also run an application able to forward the traffic, such as firewall, WAN optimization, and load balancing applications. When a virtual machine is running network applications, the virtual machine is often referred to as a network virtual appliance. You can view a list of ready to deploy network virtual appliances in the Azure Marketplace. IP forwarding is typically used with user-defined routes. To learn more about user-defined routes, read the User-defined routes article.

  1. Log in to the Azure portal with an account that is assigned (at a minimum) permissions for the Network Contributor role for your subscription. Read the Built-in roles for Azure role-based access control article to learn more about assigning roles and permissions to accounts.
  2. In the box that contains the text Search resources at the top of the Azure portal, type network interfaces. When network interfaces appears in the search results, click it.
  3. In the Network interfaces blade that appears, click the network interface you want to enable or disable IP forwarding for.
  4. In the blade for the network interface you selected, click IP configurations in the SETTINGS section.
  5. Click Enabled or Disabled (default setting) to change the setting.
  6. Click Save.

Commands

Tool Command
CLI az network nic update
PowerShell Set-AzureRmNetworkInterface

Change subnet assignment

You can change the subnet, but not the virtual network, that a network interface is assigned to.

  1. Log in to the Azure portal with an account that is assigned (at a minimum) permissions for the Network Contributor role for your subscription. Read the Built-in roles for Azure role-based access control article to learn more about assigning roles and permissions to accounts.
  2. In the box that contains the text Search resources at the top of the Azure portal, type network interfaces. When network interfaces appears in the search results, click it.
  3. In the Network interfaces blade that appears, click the network interface you want to view or change settings for.
  4. Click IP configurations under SETTINGS in the blade for the network interface you selected. If any private IP addresses for any IP configurations listed have (Static) next to them, you must change the IP address assignment method to dynamic by completing the steps that follow. All private IP addresses must be assigned with the dynamic assignment method to change the subnet assignment for the network interface. If the addresses are assigned with the dynamic method, continue to step five. If any IPv4 addresses are assigned with the static assignment method, complete the following steps to change the assignment method to dynamic:
    • Click the IP configuration you want to change the IPv4 address assignment method for from the list of IP configurations.
    • In the blade that appears for the IP configuration, click Dynamic for the Assignment method. You cannot assign an IPv6 address with the static assignment method.
    • Click Save.
  5. Select the subnet you want to connect the network interface to from the Subnet drop-down list.
  6. Click Save. New dynamic addresses are assigned from the subnet address range for the new subnet. After assigning the network interface to a new subnet, you can assign a static IPv4 address from the new subnet address range if you choose. To learn more about adding, changing, and removing IP addresses for a network interface, read the Manage IP addresses article.

Commands

Tool Command
CLI az network nic ip-config update
PowerShell Set-AzureRmNetworkInterfaceIpConfig

Delete a network interface

You can delete a network interface as long as it's not attached to a virtual machine. If it is attached to a virtual machine, you must first place the virtual machine in the stopped (deallocated) state, then detach the network interface from the virtual machine, before you can delete the network interface. To detach a network interface from a virtual machine, complete the steps in the Detach a network interface from a virtual machine section of the Add or remove network interfaces article. Deleting a virtual machine detaches all network interfaces attached to it, but does not delete the network interfaces.

  1. Log in to the Azure portal with an account that is assigned (at a minimum) permissions for the Network Contributor role for your subscription. Read the Built-in roles for Azure role-based access control article to learn more about assigning roles and permissions to accounts.
  2. In the box that contains the text Search resources at the top of the Azure portal, type network interfaces. When network interfaces appears in the search results, click it.
  3. Right-click the network interface you want to delete and click Delete.
  4. Click Yes to confirm deletion of the network interface.

When you delete a network interface, any MAC or IP addresses assigned to it are released.

Commands

Tool Command
CLI az network nic delete
PowerShell Remove-AzureRmNetworkInterface

Next steps

To create a virtual machine with multiple network interfaces or IP addresses, read the following articles:

Commands

Task Tool
Create a VM with multiple NICs CLI, PowerShell
Create a single NIC VM with multiple IPv4 addresses CLI, PowerShell
Create a single NIC VM with a private IPv6 address (behind an Azure Load Balancer) CLI, PowerShell, Azure Resource Manager template