Unable to find service tag 'GatewayManager' and 'AzureCloud' for Azure network security group

Vincent Go 1

I need to add inbound and outbound rules to my Bastion NSG, the documentation states that:
"Important:

If you choose to use an NSG with your Azure Bastion resource, you must create all of the following ingress and egress traffic rules. Omitting any of the following rules in your NSG will block your Azure Bastion resource from receiving necessary updates in the future and therefore open up your resource to future security vulnerabilities."

Unfortunately, the service tag GatewayManager' and 'AzureCloud' is not available in the list of service tags, I only have Internet, Virtual Network and AzureLoadBalancer are available.

what should I do, please help ASAP. thank you.

GitaraniSharma-MSFT 47,696 Reputation points Microsoft Employee

2022-08-08T18:12:51.717+00:00

Hello @Vincent Go ,

To allow Ingress Traffic from Azure Bastion control plane: you need to enable port 443 inbound from GatewayManager service tag. It is available in the source service tag as below:

As you don't see any other service tags in the source of your NSG apart from the 3 listed, could you please check if there is any policy restricting the listing of all service tags in your NSG within your subscription?

Regards,
Gita
GitaraniSharma-MSFT 47,696 Reputation points Microsoft Employee

2022-08-11T09:42:04.627+00:00

Hello @Vincent Go , could you please provide an update on this post?
GitaraniSharma-MSFT 47,696 Reputation points Microsoft Employee

2022-09-07T12:10:47.62+00:00

Hello @Vincent Go , do you have any updates on this issue from your end?
Kelvin Yam 0 Reputation points

2023-11-28T03:24:11.22+00:00

I got the same problem when adding the Ingress Traffic. There is no "GatewayManager" can be chose. How to display the rest of the service tags?
GitaraniSharma-MSFT 47,696 Reputation points Microsoft Employee

2023-11-29T10:51:42.7966667+00:00

Hello @Kelvin Yam ,

Are you using a Classic Network Security Group?

The classic deployment model supports just those 3 service tags.

https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview#tags-supported-in-the-classic-deployment-model

If you are not using the classic deployment model and are using the Azure Resource Manager model but still unable to see the whole service tag list, I would request you to try and get the list of service tags using Azure PowerShell or Azure CLI.

Refer: https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview#use-the-service-tag-discovery-api

Azure PowerShell: https://learn.microsoft.com/en-us/powershell/module/az.network/get-aznetworkservicetag?view=azps-11.0.0

Azure CLI: https://learn.microsoft.com/en-us/cli/azure/network?view=azure-cli-latest#az-network-list-service-tags

Regards,

Gita

1 answer

msrini-MSFT 9,261 Reputation points Microsoft Employee

2022-08-07T10:05:49.893+00:00

Hi,

The Destination service tag is the one that you need to look for. Destination service tag has gateway manager tag and Azure cloud tag.

Regards,
Karthik Srinivas
Please sign in to rate this answer.

1 person found this answer helpful.
Kelvin Yam 0 Reputation points

2023-11-28T04:09:17.3733333+00:00

Thanks for your information. Unfortunately, there is no gateway manager tag and Azure cloud tag showing. It only shows you the three default tags.
Sign in to comment