Inbound port rules removed automatically

Question

When adding the inbound port rules in NSG of Azure vm they disappear after a couple of minutes. It shows one username that is the automation app. I have deleted the enterprise app in my subscription but still it inteferes with my work and remove required inbound port rules. Because of that unable to login to vm as well.

What is the cause of the issue

Answer 1

Hello @Doubts Clear

The NSG in azure VM is like a firewall that controls inbound and outbound traffic to and from your VM. Regarding the issue with the inbound port rules disappearing, it's possible that the NSG is being managed by an Azure Automation account or another Azure service that is automatically modifying the NSG rules. To confirm this, you can check the NSG logs to see if there are any entries related to the automation app or any other Azure service.

To check the NSG logs, you can use Azure Monitor. Here are the steps to do this:

1. Go to the Azure portal and navigate to your VM.
2. Click on "Diagnostic settings" under the "Monitoring" section**1**.
3. Click on "Add diagnostic setting" and configure the settings as follows:

• Name: Enter a name for the diagnostic setting.
• Destination: Select "Log Analytics".
• Log Analytics workspace: Select an existing workspace or create a new one.
• Logs: Select "Network security group rule counter".

1. Click on "Save" to save the diagnostic setting.

Once the diagnostic setting is saved, you can view the NSG logs in the Log Analytics workspace. To do this, go to the Log Analytics workspace and run the following query:

AzureDiagnostics
| where Category == "NetworkSecurityGroupRuleCounter"
| where ResourceId contains "<VM Resource ID>"

Replace <VM Resource ID> with the resource ID of your VM. This query will show you the NSG logs for your VM, including any modifications made to the NSG rules.

If you find that the NSG rules are being modified by an Azure service, you can try disabling the service or modifying its configuration to prevent it from modifying the NSG rules. Alternatively, you can create a custom NSG and associate it with your VM, and then configure the inbound port rules as required. This will prevent any other Azure service from modifying the NSG rules.

Reference: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log

Please accept answer and upvote if the above information is helpful for the benefit of the community.