Maybe incorrect information in unit "Determine network security group effective rules" in " Configure network security groups"

Question

In the Unit "Determine network security group effective rules" in Module "Configure network security groups" The first table describes how Azure evaluates each NSG configuration to determine the effective security rules. In the "Vm 4" row, it says under inbound rules: "Azure default rules apply to both subnet and NIC and all inbound traffic is allowed" The issue I am seeing is that it says "all inbound traffic is allowed", but if you go back one unit The unit says under "Inbound traffic rules" that only Vnet inbound traffic and load balancer inbound traffic is allowed and everything else is denied. So I think the cell referenced earlier should say "Azure default rules apply to both subnet and NIC and only Vnet and load balancer inbound traffic is allowed", please correct me if I am wrong.

Also in the same unit under "Inbound traffic effective rules" in the second bullet point "NSG inbound rules for a subnet in a VM take precedence over NSG inbound rules for a NIC in the same VM." it should say: "NSG inbound rules for a subnet in a VN take precedence over NSG inbound rules for a NIC in the same VN." also please advise :).

Thanks.

Answer 1

Hi Abd Alrifai,

Thanks for reaching out to us on Microsoft Q&A forum.

As per Unit-4, In the "Determine network security group effective rules" unit, under the "VM 4" row, it states: Azure default rules apply to both subnet and NIC, and all inbound traffic is allowed is valid as per the scenario below:

The provided screenshot explicitly indicates that for VM4, in accordance with the documentation, the Network Security Group (NSG) was not set up for subnet 3 and NIC. Consequently, the Azure default rules are enforced for both the subnet and Network Interface Card (NIC) associated with VM4, allowing unrestricted inbound and outbound traffic.

As per Unit-3 In the "Determine network security group rules" unit, under "Inbound traffic rules," it mentions that only Vnet inbound traffic and load balancer inbound traffic is allowed, and everything else is denied is valid as per the scenario.

Scenario: - In Azure, when you create a Network Security Group (NSG), three default inbound security rules are established. These rules are designed to block all incoming traffic by default, except for the traffic originating from your virtual network and Azure load balancers.

As per Unit-4, In the "Determine network security group effective rules" under section "Inbound traffic effective rules" the statement "NSG inbound rules for a subnet in a VM take precedence over NSG inbound rules for a NIC in the same VM" is valid as per the screenshot below.

If the information is helpful, please accept the answer by clicking the "Accept Answer" on the post. If you are still facing any issue, please let us know in the comments. We are glad to help you.

Thank you.