NSG Subnet Implementation

Question

We are running 10 virtual machines on a production subnet in a vnet. We want to now implement an NSG and associate with the subnet running those 10 virtual machines without disruption to traffic. Is there a way to analyze network traffic in order to set up the NSG prior to associating it with the subnet? Thank you!

Answer 1

@FunMum ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

To address your question,

• No
• You should attach an NSG to a Subnet and enable Flow Logs for the platform to log the traffic flows.

Wrt the Rule you shared,

• From the naming convention you shared, I believe this is an outbound rule.
• And this Allows Any to Any
• So, this should not block any traffic and in fact, allow all outbound traffic
• If your VMs only required outbound access and not any inbound access, this rule should not cause any service disruption
• However, note that if your VMs require inbound traffic, you should also have a Any-to-Any Inbound Rule.

Note:

• Traffic Analytics requires you to have already enabled Flow Logs
• See : Traffic Analytics Prerequisites
• Once done, you can use Traffic Analytics to understand the pattern
  • Usage scenarios of traffic analytics
• Post which, you can fine tune the NSG Rules to match your requirements

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

---

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.

Answer 2

You can analyze traffic using network watcher. See:

https://learn.microsoft.com/en-us/azure/network-watcher/usage-scenarios-traffic-analytics

https://learn.microsoft.com/en-us/azure/network-watcher/traffic-analytics

Search for Network Watcher in portal and enable and Use IP flow verify to understand existing traffic patterns.

Based on the traffic patterns you've observed, you can create a test NSG with rules that you think will be appropriate for your environment.

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola