Configure network security groups with tags in Windows Admin Center

Article
04/10/2024

Applies to: Azure Stack HCI, versions 23H2 and 22H2

This article describes how to configure network security groups with network security tags in Windows Admin Center.

With network security tags, you can create custom user-defined tags, attach those tags to your virtual machine (VM) network interfaces, and apply network access policies (with network security groups) based on these tags.

Simplify security with network security tags

Network security groups allow you to configure access policies based on network constructs like network prefixes and subnets. For example, if you want to restrict communication between your Web Server VMs and database VMs, you must identify corresponding network subnets and create a policy to deny communication between those subnets. However, there are some limitations with this approach:

Your security policies are tied to network constructs, which means you need to know which applications reside on specific network segments. Understanding your network infrastructure and architecture become crucial.
When building policies for applications, you might want to reuse them across different scenarios. For example, if your production web app can only be reached over port 80 from the internet, and can't be reached by other apps in production or other environments, you'd have a similar policy for any new app. However, with network segmentation, recreating policies becomes necessary due to unique network elements for each app.
If you decommission an old application and provision a new one within the same network segment, policy adjustments are required.

With the network security tags feature, you no longer need to track the network segments where your applications are hosted. This simplifies policy management and avoids the complexities associated with network constructs. Let's reconsider the example with Web Server and database VMs: Tag the corresponding VMs with "Web" and "Database" network security tags, then create a rule to restrict communication between "Web" and "Database" tags.

Create network security tag based network security groups

To create network security tag based network security groups, follow these steps:

Create one or more network security tags.
Assign a network security tag to a VM.
Create a network security group.
Create a network security rule for the network security group.
Apply the network security group to a VM, network subnet, network security tag.

Create network security tags

On the Windows Admin Center home screen, under All connections, select the cluster that you want to create the network security group on.
Under Tools, scroll down to the Networking area, and select Network security groups.
Under Network security groups, select Network Security Tags tab, and then select New.
In the Create Network Security Tag pane, enter a name for the network security tag in the Name field.
(Optional) In the Type field, enter a type for the tag. This field is useful if you want to categorize tags for easy management. For example, you can have different tags with the same type "Application", such as SQL, Web, IOT, Sensor, etc.
Select Submit.

Assign network security tag to a VM

You can assign a network security tag to a VM either when creating a new VM or afterwards when changing the properties of an existing VM.

Assign network security tag during VM creation

For step-by-step instructions on how to create a new VM, see Create a new VM.

To assign a network security tag while creating a new VM:

On the Windows Admin Center home screen, under All connections, select the server or cluster you want to create the VM on.
Under Tools, scroll down and select Virtual machines.
Under Virtual machines, select the Inventory tab, select Add, and then select New.
Under New virtual machine, enter a name for your VM.
Enter other properties for the VM.
Under Network, select the network security tag you created earlier, in Create network security tag.
Select Create.

Assign network security tag to an existing VM

You can assign a network security tag to an existing VM by changing its settings. For detailed instructions on how to change VM settings, see Change VM settings.

Under Tools, scroll down to the Networking area, and select Virtual machines.
Select the Inventory tab, select a VM, and then select Settings.
On the Settings page, select Networks.
Under Network Security Tag section, select Add Network Security Tag, select the network security tag you created earlier, in Create network security tag.
Select Save network settings.

Create a network security group

On the Windows Admin Center home screen, under All connections, select the cluster that you want to create the network security group on.
Under Tools, scroll down to the Networking area, and select Network security groups.
Under Network security groups, select the Inventory tab, and then select New.
In the Network Security Groups pane, type a name for the network security group, and then select Submit.
Under Network Security Groups, verify that the Provisioning state of the new network security group shows Succeeded.

Create a network security group rule

After you create a network security group, you're ready to create network security group rules. If you want to apply network security group rules to both inbound and outbound traffic, you need to create two rules.

On the Windows Admin Center home screen, under All connections, select the cluster that you want to create the network security group on.
Under Tools, scroll down to the Networking area, and select Network security groups.
Under Network security groups, select the Inventory tab, and then select the network security group that you created earlier, in Create a network security group.
Under Network security rule, select New.

In the Network security rule pane on the right, provide the following information:

Field	Description
Name	Name of the rule.
Priority	Priority of the rule. Acceptable values are 101 to 65000. A lower value denotes a higher priority.
Types	Type of the rule. This can be Inbound or Outbound.
Protocol	Protocol to match either an incoming or outgoing packet. Acceptable values are All, TCP and UDP.
Source	Select Network Security Tag. Note: You can either select an address prefix or a network security tag but not both.
Source Security Tag Type	(Optional) Select a type for the tag.
Source Security Tag	Select a network security tag that you created earlier, in Create network security tag.
Source Port Range	Specify the source port range to match either an incoming or outgoing packet. You can enter `*` to specify all source ports.
Destination	Select Network Security Tag. Note: You can either select an address prefix or a network security tag but not both. Source and Destination can be different.
Destination Security Tag Type	(Optional) Select a type for the tag.
Destination Security Tag	Select a network security tag that you created earlier, in Create network security tag.
Destination Port Range	Specify the destination port range to match either an incoming or outgoing packet. You can enter `*` to specify all destination ports.
Actions	If the above conditions are matched, specify either to allow or block the packet. Acceptable values are Allow and Deny.
Logging	Specify either to enable or disable logging for the rule. If logging is enabled, all traffic matched by this rule is logged on the host computers.

Select Submit.

Apply network security group

You can apply a network security group to:

Apply network security group to a network security tag

When you apply a network security group to a network security tag, the network security group rules apply to all VM network interfaces that are associated with that network security tag.

To apply a network security group to a network security tag via Windows Admin Center, follow these steps:

On the Windows Admin Center home screen, under All connections, select the cluster that you want to apply the network security group on.
Under Tools, scroll down to the Networking area, and select Network security groups.
Under Network security groups, select Network Security Tags tab.
Select the network security tag you want to edit and then select Settings.
On the Editing Network Security Tag pane for the selected tag, select the network security group you want to apply to the network security tag.
Select Submit.

Next steps

For related information, see also: