Create an Inbound NSG rule and propogate to all NSG

Question

Hi There
We have a requirement were we need to create an ALLOW rule in NSG and have the same rule applied to all NSG within a subscription, Is this possible at all? I have tried various methods to no avail. Just wondering if anyone else has come across a similar situation.

Thank you in advance.

Regards
Parul

Answer 1

Hi @Anonymous ,

this script is working here with the two NSGs (testNSG1 and testNSG2):

$NSGs = "testNSG1", "testNSG2"  
$Params = @{  
  'Name'                     = 'Allow_NessusScanner_IN'  
  'Protocol'                 = '*'  
  'Direction'                = 'Inbound'  
  'Priority'                 = 2970  
  'SourceAddressPrefix'      = '10.96.2.69'  
  'SourcePortRange'          = '1234'  
  'DestinationAddressPrefix' = 'VirtualNetwork'  
  'DestinationPortRange'     = '*'  
  'Access'                   = 'Allow'  
}  
foreach ($NSG in $NSGs) {  
  Get-AzNetworkSecurityGroup -Name $NSG | Add-AzNetworkSecurityRuleConfig @Params | Set-AzNetworkSecurityGroup  
}  

The result looks like this:

---

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards
Andreas Baumgarten

Answer 2

Thaks @Andreas Baumgarten will try now cheers

Answer 3

Hi @Andreas Baumgarten
Just tried your script, no errors however nothing happened, the rule did not get created at all.
Any other ideas?
Cheers
Parul

Answer 4

@Andreas Baumgarten Thanks will wait 30 Mins odd to see if it applies, will keep you posted, I appreciate your help.

Answer 5

Connect-AzAccount  
$NSGs = Get-AzNetworkSecurityGroup  
 $Params = @{  
   'Name' = 'Allow_NessusScanner_IN'  
   'Protocol' = '*'  
   'Direction' = 'Inbound'  
   'Priority' = 2970  
   'SourceAddressPrefix' = '10.96.2.69'  
   'SourcePortRange' = '*'  
   'DestinationAddressPrefix' = 'VirtualNetwork'  
   'DestinationPortRange' = '*'  
   'Access' = 'Allow'  
   }  
   foreach ($NSG in $NSGs) {  
     Get-AzNetworkSecurityGroup -Name $NSG.Name | Add-AzNetworkSecurityRuleConfig @Params | Set-AzNetworkSecurityGroup  
   }  

Thanks @Andreas Baumgarten it works now, thank you for your help and guidance.