How to export the rules of Network Security group from Azure classic deployment to excel. Also, we need to migrate this deployment to ARM. How is it done.

Girish Prajwal 706

Hi Team,

I know its too late for me migrate the classic resource to ARM. We have few ACL's which were deployed in ASM. We want to migrate the network security rules configured on Classic Network security groups to ARM.

Rules to be exported to Excel from old network security group
Import the rules from excel to ARM NSG
How do we migrate from Classic to ARM for NSG's

SaiKishor-MSFT 17,236 Reputation points

2020-11-11T21:24:21.533+00:00

@Girish Prajwal We are looking into this issue currently and will update you soon. Thank you!

Accepted answer

Girish Prajwal 706 Reputation points

2020-11-18T08:50:15.833+00:00

After all my research, I was able to find the way to export Rules from classic NSG.

Pre-requisite - you need to be co-administrator to access the classic resources at Subscription level.

Export Classic NSG Rules

(Get-AzureNetworkSecurityGroup -Name "Group <ResourceGroupName> <Classic NSG Name>" -Detailed).Rules | Export-Csv -Path C:\NSG01.csv -NoTypeInformation

Hope this helps other users.

Regards,

Girish
Please sign in to rate this answer.

2 people found this answer helpful.
SaiKishor-MSFT 17,236 Reputation points

2020-11-18T09:05:40.207+00:00

@Girish Prajwal Glad you found the solution to export the NSG to excel. This will definitely help other users. Thank you for posting this!

SaiKishor-MSFT 17,236 Reputation points

2020-11-18T22:13:22.147+00:00

@Girish Prajwal Just to add to this, ACLs exported from Classic deployment cannot be directly imported to ARM NSGs as this is unsupported(https://learn.microsoft.com/en-us/azure/virtual-machines/windows/migration-classic-resource-manager-overview#unsupported-features-and-configurations). You may need to capture this data in your excel and use this to manually enter it into a new NSG in ARM.

Please let us know if you have any further questions/concerns regarding this issue. Thank you!
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

2 additional answers

SaiKishor-MSFT 17,236 Reputation points

2020-11-11T23:04:36.373+00:00

@Girish Prajwal

In general, network security groups associated with a subnet are cloned as part of the migration to the Resource Manager deployment model. The NSG in the classic deployment model is not removed during the migration. However, the management-plane operations for the NSG are blocked when the migration is in progress. Unassociated NSGs can be migrated using Move-AzureNetworkSecurityGroup.

This is the usual process. Do you still want to export/import it via excel? Please let me know. Thank you!
Please sign in to rate this answer.

1 person found this answer helpful.
Girish Prajwal 706 Reputation points

2020-11-12T05:57:00.23+00:00

Hi SaiKishor,

I see that our classic NSG is associated. However, I don't see the cloned copy of it when checked.
I would like to export the rules and then import it to the new NSG (ARM) with the methods available. If there is any method available please share the details.

Regards,
Girish

SaiKishor-MSFT 17,236 Reputation points

2020-11-12T21:16:11.723+00:00

@Girish Prajwal You could do that using a custom script, however, we do not have an existing script that we can provide you for the same. You can also try to disassociate the NSG and use Move-AzureNetworkSecurityGroup to migrate it. These are only available methods at the moment.

SaiKishor-MSFT 17,236 Reputation points

2020-11-13T17:53:05.7+00:00

@Girish Prajwal
Have you tried to use the following powershell to extract NSG to CSV?

https://blog.petersenit.co.uk/2020/03/azure-nsg-rules-to-csv.html

SaiKishor-MSFT 17,236 Reputation points

2020-11-16T19:07:19.6+00:00

@Girish Prajwal Please let me know if you have any further questions/concerns, regarding this issue. Thank you!

Girish Prajwal 706 Reputation points

2020-11-18T07:37:44.37+00:00

@SaiKishor-MSFT - I don't think the classic service is supported by the script you shared. I am unable to get the classic resources listed using the command get-azurenetworksecuritygroup - doesn't allow me to execute the command or get-azurermnetworksecuritygroup gets the classic network security group listed. Can you please check on the same.

The only option left to me is manually add the rules from classic resource to ARM.

Regards,
Girish

Girish Prajwal 706 Reputation points

2020-11-18T08:49:56.87+00:00

After all my research, I was able to find the way to export Rules from classic NSG.

Pre-requisiste - you need to be co-administrator to access the classic resources at Subscription level.

Export Classic NSG Rules
(Get-AzureNetworkSecurityGroup -Name "Group <ResourceGroupName> <Classic NSG Name>" -Detailed).Rules | Export-Csv -Path C:\NSG01.csv -NoTypeInformation

Hope this helps other users.

Regards,
Girish
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Kevin Virani 21 Reputation points

2022-10-05T19:39:16.807+00:00

You can use Effective Security Rules in NSG to download rules. Super Simple.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to export the rules of Network Security group from Azure classic deployment to excel. Also, we need to migrate this deployment to ARM. How is it done.

2 additional answers

Your answer