3. Network Security Groups

Network Security Groups (NSGs) are built-in tools for network control that allow us to control incoming and outgoing traffic on a network interface or at the subnet level. They contain sets of rules that allow or deny specific traffic to specific resources or subnets in Azure. An NSG can be associated with either a subnet (by applying security rules to all resources associated with the subnet) or a Network Interface Card (NIC), which is done by applying security rules to the Virtual Machine (VM) associated with the NIC.

We will cover the following recipes in this chapter:

• Creating a new NSG in the Azure portal
• Creating a new NSG with PowerShell
• Creating a new allow rule in an NSG
• Creating a new deny rule in an NSG
• Creating a new NSG rule with PowerShell
• Assigning an NSG to a subnet
• Assigning an NSG to a network interface
• Assigning an NSG to a subnet with PowerShell
• Creating an Application Security Group (ASG...

Technical requirements

For this chapter, the following is required:

• An Azure subscription
• Azure PowerShell

The code samples can be found at https://github.com/PacktPublishing/Azure-Networking-Cookbook-Second-Edition/tree/master/Chapter03.

Creating a new NSG in the Azure portal

As a first step to more effectively control network traffic, we are going to create a new NSG.

Getting ready

Before you start, open your browser and go to the Azure portal, at https://portal.azure.com.

How to do it...

To create a new NSG using the Azure portal, we must follow these steps:

1. In the Azure portal, select Create a resource and choose Network security group under Networking (or search for network security group in the search bar).
2. The parameters we need to define for the deployment are Subscription, Resource group, Name, and Region. An example of the required parameters is shown in Figure 3.1:
   

Figure 3.1: Creating a new NSG using the Azure portal

After the deployment has been validated and started (it takes a few moments to complete), the NSG is ready for use.

How it works...

The NSG deployment can be initiated during a VM deployment. This will associate the NSG to the NIC associated with the...

Creating a new NSG with PowerShell

Alternatively, we can create an NSG using PowerShell. The advantage of this approach is that we can add NSG rules in a single script, creating custom rules right after the NSG is created. This allows us to automate the deployment process and create our own default rules right after the NSG has been created.

Getting ready

Open the PowerShell console and make sure you are connected to your Azure subscription. Refer to Chapter 1, Azure Virtual Network, for a refresher on how to do this.

How to do it...

To deploy a new NSG, execute the following command:

New-AzNetworkSecurityGroup -Name "nsg1" -ResourceGroupName "Packt-Networking-Script" -Location "westeurope" 

How it works...

The script is using the Resource Group (RG) that was deployed in Chapter 1, Azure Virtual Network (we will use the same RG for all deployments). Otherwise, a new RG needs to be deployed prior to executing the script. The final outcome...

Creating a new allow rule in an NSG

When a new NSG is created, only the default rules are present, which allow all outbound traffic and block all inbound traffic. To change these, additional rules need to be created. First, we are going to show you how to create a new rule to allow inbound traffic.

Getting ready

Before you start, open your browser and go to the Azure portal at https://portal.azure.com. Locate the previously created NSG.

How to do it...

To create a new NSG allow rule using the Azure portal, we must follow these steps:

1. In the NSG pane, locate the Inbound security rules option under Settings.
2. Click on the Add button at the top of the page and wait for the new pane, to open:
   

   Figure 3.2: Creating a new NSG allow rule using the Azure portal

3. In the new pane, we need to provide information for the Source (location and port range), Destination (location and port range), Protocol, Action, Priority, Name, and Description fields. If you want to allow...

Creating a new deny rule in an NSG

When a new NSG is created, only the default rules are present. The default rules allow all outbound traffic and block all inbound traffic. To change this, additional rules need to be created. Now, we are going to show you how to create a new outbound rule to deny traffic.

Getting ready

Before you start, open your browser and go to the Azure portal at https://portal.azure.com. Locate the previously created NSG.

How to do it...

To create a new NSG deny rule using the Azure portal, we must follow these steps:

1. In the NSG pane, locate the Outbound security rules option under Settings.
2. Click on the Add button at the top of the page and wait for the new pane to open:
   

   Figure 3.4: Creating a new NSG deny rule using the Azure portal

3. In the new pane, we need to provide information for Source (location and port range), Destination (location and port range), Protocol, Action, Priority, Name, and Description. If you want to deny traffic...

Creating a new NSG rule with PowerShell

Alternatively, we can create an NSG rule using PowerShell. This command can be executed right after the NSG has been created, allowing us to create and configure an NSG in a single script. This way, we can standardize deployment and have rules applied each time an NSG is created.

Getting ready

Open the PowerShell console and make sure you are connected to your Azure subscription.

How to do it...

To create a new NSG rule, execute the following command:

$nsg = Get-AzNetworkSecurityGroup -Name 'nsg1' -ResourceGroupName 'Packt-Networking-Script'
$nsg | Add-AzNetworkSecurityRuleConfig -Name 'Allow_HTTPS' -Description 'Allow_HTTPS' -Access Allow -Protocol Tcp -Direction Inbound -Priority 100 -SourceAddressPrefix Internet -SourcePortRange * -DestinationAddressPrefix * -DestinationPortRange 443 | Set-AzNetworkSecurityGroup

How it works...

Using a script, creating an NSG rule is just a matter...

Assigning an NSG to a subnet

The NSG and its rules must be assigned to a resource to have any impact. Here, you are going to see how to associate an NSG with a subnet.

Getting ready

Before you start, open your browser and go to the Azure portal at https://portal.azure.com. Locate the previously created NSG.

How to do it...

To assign an NSG to a subnet, follow these steps:

1. In the NSG pane, locate the Subnets option under Settings.
2. Click on the Associate button at the top of the page and wait for the new pane to open:
   

   Figure 3.6: Assigning an NSG to a subnet

3. In the new pane, first select the virtual network that contains the subnet you want to associate the NSG with, and then select the subnet, as seen in Figure 3.7:
   

   Figure 3.7: Associating the subset with the NSG

4. After submitting the change, the subnet will appear in a list of associated subnets:
   

Figure 3.8: A list of associated subnets

How it works...

When an NSG is associated with a...

Assigning an NSG to a network interface

Now, we are going to widen our scope and show you how to associate an NSG with a network interface.

Getting ready

Before you start, open your browser and go to the Azure portal at https://portal.azure.com. Locate the previously created NSG.

How to do it...

To assign an NSG to a network interface, follow these steps:

1. In the NSG pane, locate the Network interfaces option under Settings.
2. Click on the Associate button at the top of the page and wait for the new pane to open:
   

   Figure 3.9: Assigning the NSG to a network interface

3. Select the NIC you want to associate the NSG with from the list of those available:
   

Figure 3.10: Associating with the network interface

How it works...

When an NSG is associated with an NIC, the NSG rules will apply only to a single NIC (or a VM associated with the NIC). The NIC can be associated with only one NSG directly, but a subnet associated with an NIC can have an association...

Assigning an NSG to a subnet with PowerShell

Alternatively, we can associate an NSG using Azure PowerShell. In this recipe, we are going to show you how to associate an NSG with a subnet.

Getting ready

Open the PowerShell console and make sure you are connected to your Azure subscription.

How to do it...

To associate an NSG with a subnet, execute the following command:

$vnet = Get-AzVirtualNetwork -Name 'Packt-Script' -ResourceGroupName 'Packt-Networking-Script'
$subnet = Get-AzVirtualNetworkSubnetConfig -VirtualNetwork $vnet -Name BackEnd
$nsg = Get-AzNetworkSecurityGroup -ResourceGroupName 'Packt-Networking-Script' -Name 'nsg1'
$subnet.NetworkSecurityGroup = $nsg
Set-AzVirtualNetwork -VirtualNetwork $vnet 

How it works...

To assign an NSG using PowerShell, we need to collect information on the virtual network, subnet, and NSG. When all of the information is gathered, we can perform the association using the Set-AzVirtualNetwork...

Creating an Application Security Group (ASG)

ASGs are an extension of NSGs, allowing us to create additional rules and take better control of traffic. Using only NSGs allows us to create rules that will allow or deny traffic only for a specific source, IP address, or subnet. ASGs allow us to create better filtering and create additional checks on what traffic is allowed based on ASGs. For example, with NSGs, we can create a rule that subnet A can communicate with subnet B. If we have the application structure for it and an associated ASG, we can add resources in application groups. By adding this element, we can create a rule that will allow communication between subnet A and subnet B, but only if the resources belong to the same application.

Getting ready

Before you start, open your browser and go to the Azure portal at https://portal.azure.com.

How to do it...

To create an ASG using the Azure portal, we must follow these steps:

1. In the Azure portal, select Create...

Associating an ASG with a VM

After creating an ASG, we must associate it with a VM. After this is done, we can create rules with the NSG and ASG for traffic control.

Getting ready

Before you start, open your browser and go to the Azure portal at https://portal.azure.com. Locate the previously created VM.

How to do it...

To associate an ASG with a VM, we must follow these steps:

1. In the VM pane, locate the Networking settings.
2. In the Networking settings, select the Application security groups tab, as shown in Figure 3.12:
   

   Figure 3.12: Associating an ASG with a VM

3. In the Application security groups settings, select Configure the application security groups, as shown in Figure 3.13:
   

   Figure 3.13: Configuring ASGs

4. In the new pane from the list of available ASGs, select the ASG that you want to associate the VM with:
   

   Figure 3.14: Associating an ASG with a VM

5. After clicking Save, it takes a few seconds to apply the changes, after which the VM will be associated...

Creating rules with an NSG and an ASG

As a final step, we can use NSGs and ASGs to create new rules with better control. This approach allows us to have better control of traffic, limiting incoming traffic not only to a specific subnet but also only based on whether or not the resource is part of the ASG.

Getting ready

Before you start, open your browser and go to the Azure portal at https://portal.azure.com. Locate the previously created NSG.

How to do it...

To create a rule using both an ASG and an NSG, we must follow these steps:

1. In the NSG pane, find Inbound security rules. Select Add to add a new rule.
2. For the source, select Application Security Group, and then select the ASG you want to use as the source. We also need to provide parameters for Source, Source port ranges, Destination, Destination port ranges, Protocol, Action, Priority, Name, and Description. An example is shown in Figure 3.15:
   

Figure 3.15: Adding an inbound security rule

How...