0

I am having trouble understanding default inbound rules in a Network Security Group.

My way of thinking:

  • A NSG is applied at a NIC or a subnet level.
  • Thus, resources that have their inbound traffic filtered by an inbound rule must be a part of a Virtual Network.

Assuming the above is true, it should not matter if I specify Any or VirtualNetwork as a destination, as Any must be a part of a Virtual Network.

To give a concrete example, take this default rule for traffic from a Load Balancer:

Priority:      65001
Name:          AllowAzureLoadBalancerInBound
Port:          Any
Protocol:      Any
Source:        AzureLoadBalancer
Destination:   Any
Action:        Allow

Would it make any difference if it was defined with a VirtualNetwork destination?

Improve this question

1 Answer 1

Reset to default
1

In the scenario you are talking about, there is no practical difference between VirtualNetwork and Any for destination. That said the use of the VirtualNetwork tag may make your intention clearer when creating the rule.

The VirtualNetwork rule however is useful when looking at source addresses.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .