Create and configure network security groups (NSGs) and application security groups (ASGs)

Network Security Groups (NSGs) and Application Security Groups (ASGs) are two fundamental Azure features that help to enhance the security of network components within Azure environments. When studying for the AZ-104 Microsoft Azure Administrator exam, understanding how to create, configure, and manage these groups is critical for securing virtual networks and managing resources efficiently.

Network Security Groups (NSGs)

A Network Security Group (NSG) is an Azure resource that contains a list of security rules that allow or deny network traffic to resources connected to Azure Virtual Networks (VNets). NSGs can be associated with either subnets or individual virtual machine (VM) instances within the VNet.

When creating an NSG, it is important to understand default rules and how to create custom security rules. NSGs include default rules that allow for basic inbound or outbound traffic, such as VNet-to-VNet communication and internet access. Additional custom rules can be set based on the following parameters:

• Direction: Inbound or Outbound
• Priority: A numerical value between 100 and 4096. Lower numbers have higher priority.
• Source/Destination: Individual IP addresses, IP ranges, or ASGs
• Protocol: TCP, UDP, ICMP, or Any
• Port Range: Individual ports or ranges of ports
• Action: Allow or Deny

Example of Creating an NSG and Adding a Rule:

1. In the Azure portal, navigate to “Network Security Groups” and click “Add”.
2. Fill in details such as the name, subscription, resource group, and location.
3. Once created, navigate to the NSG and select “Inbound security rules” or “Outbound security rules”.
4. Click “Add” to create a custom rule. For example, an inbound rule to allow HTTP traffic might look like this:

5. Once the rule is configured, click “Add” to apply it.

Application Security Groups (ASGs)

ASGs provide a way to group together virtual machines with similar functions to simplify the creation and management of security rules. Instead of defining an NSG rule for each IP address, administrators can group VMs as an ASG and then create NSG rules that apply to the entire ASG.

To use ASGs, simply create an ASG, assign it to virtual machine NICs, and then reference the ASG when defining NSG rules.

Example of Creating an ASG:

1. In the Azure portal, go to “Application Security Groups” and click “Add”.
2. Provide a name, subscription, resource group, and location for the ASG.
3. After creating the ASG, assign it to VMs by navigating to each VM’s networking settings and adding the VM to the ASG under the “Application security groups” section.
4. Reference this ASG in the NSG rules as either the source or destination.

Combining NSGs with ASGs

With an ASG, you can conveniently reference a group of VMs in NSG rules. For example, if you have a group of VMs serving as web servers within an ASG called “WebServersASG”, you can create a rule in an NSG to allow port 80 traffic to any VM within that group:

Best Practices for Using NSGs and ASGs

• Always define the least privileged access necessary.
• Avoid overlapping NSG rules that might lead to ambiguous security stances.
• Use ASGs to logically group VMs of the same type or role for easier management.
• Assign meaningful names to NSGs and ASGs for you to identify and organize security rules.

In conclusion, managing NSGs and ASGs effectively is essential for a secure and efficient Azure infrastructure. As a potential Azure Administrator, your proficiency with these tools will demonstrate both your understanding of Azure’s networking security capabilities and your readiness to manage and secure cloud environments. Remember that NSGs are about defining fine-grained access controls, while ASGs are great for managing these policies across similar sets of VMs, reducing complexity and streamlining security administration.