Why are Network Security Group (NSG) Default Rules Greyed Out?

Question

Feels weird to ask this question since it's something I should know, or something I should be able to confirm just via testing with IP Flow Verify.

When you add your own rules to an NSG, the default rules become "grey" in color. Obviously, you cannot edit default rules at anytime weather you have your own rules or not... However, I cannot find any documentation that specifies the reason they become greyed out.

When they are greyed out, are they not affective anymore?

Image Added Context: my predecessor added a block-all rule (see priority 4095). I found that this block-all rule is conflicting with a load balancer and I want to remove it (because I think it's redundant to rule with priority 65500 below) and need to make sure default rule with 65500 will still be active.

Answer 1

Hi,

I don't remember ever seeing the default rules not be gray. I just checked one of my NSGs that doesn't have any custom rules, and the default rules are grayed out, indicating they are read-only.

To answer your question, the default rules are still active, regardless of what color they appear in the portal. They are processed same as your custom rules--rules are processed in priority order so those with higher priority (lower number) will potentially override those with lower priority (higher number).

Excerpts from article linked below:

...Rules are processed in priority order, with lower numbers processed before higher numbers, because lower numbers have higher priority. Once traffic matches a rule, processing stops. As a result, any rules that exist with lower priorities (higher numbers) that have the same attributes as rules with higher priorities aren't processed. Azure default security rules are given the highest number with the lowest priority to ensure that custom rules are always processed first.

You can't remove the default rules, but you can override them by creating rules with higher priorities.

Network security groups

https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview

Please click Accept Answer and upvote if the above was helpful. If something is unclear please add a comment.

Thanks.

-TP