NSG on every VM

Question

Hi all,

We have very big issue with performance in azure. Guy who designed our environment has installed 10 VM and created new NSG for every VM. Now we have 10 different NSG's. Is this best practice to have multiple or it is better to have one?

Problem we have is that it takes ages to open regular word or excel file and copy/paste files between VM take ages. Is there anything we can do to troubleshoot this? Please help

Answer 1

Hi @NT

We typically suggest that you setup a Network Security Group inside the shared Subnet of the Virtual Machines and set all of their base rules there. If you need additional and specialized rules for individual Virtual Machines, then you can append another Network Security Group onto the VM itself with that specialized rule. This NSG organization does not require specific setup or organization from the Resource Group, only the Subnet.

Unknowingly adding an NSG to the VM and the Subnet can cause conflict, as both of these Security Groups will collapse their rules to apply all to the Virtual Machine.

This doc on NSG setup has a nice diagram and some additional information that may help: https://learn.microsoft.com/en-us/azure/virtual-network/network-security-group-how-it-works

Answer 2

HI NT-8243,

I am not a professional on this as yet but from what i have learned is that if these VM's are in the same resource group then you only need 1 NSG unless you have reason for more than one.

Believe the rule of thumb is 1 NSG per Resource group.

Hope this helps.

Answer 3

Hi

The following article may helpful for you to get a better understanding
https://learn.microsoft.com/en-us/archive/blogs/igorpag/azure-network-security-groups-nsg-best-practices-and-lessons-learned