2

I'm working with Azure, and I have 2 VNETs, each in its own resource group

                                  Peering
                                     +
                                     |
                                     |
                                     |
                                     |
+------------------------------+     |      +-------------------------------------+
|     Test Resource Group      |     |      |          Prod Resource Group        |
|                              |     |      |                                     |
|   +----------------------+   |     v      |   +-----------------------------+   |
|   |       Test VNET      |   |            |   |          Prod VNET          |   |
|   |                      <--------------------+                             |   |
|   |                      |   |            |   |                             |   |
|   |                      +-------------------->                             |   |
|   |                      |   |            |   |                             |   |
|   |                      |   |            |   |                             |   |
|   +----------------------+   |            |   +-----------------------------+   |
|                              |            |                                     |
+------------------------------+            +-------------------------------------+

What I want to do is lock down the peering, such that traffic between the VNETs is restricted to a particular port on a particular VM, without affecting any of the existing firewall rules that are in place.

Would adding an NSG (Network Security Group) to the subnets allow me to do this?

0

Depending on your requirement, Network Security Groups is one of the built in way of restricting network access. They also have firewall appliances that you could use if you have a requirement for logging.

Best practice for NSG is to cast more general restrictions on your network, and more granular restrictions on the NICs of your VMs. Do some planning on how you would want to have it setup, read some best practices, and you'll be successful.

  • It looks like Azure Firewall can be attached to a VNET, but it's quite an expensive service, and likely overkill for this scenario – Cocowalla Nov 8 '18 at 16:08
  • Can you be more specific about how I can solve my problem with NSGs? DO you mean NSGs attached to invidual VMs, or attached to each subnet? (I have 1 subnet in each VNET) – Cocowalla Nov 8 '18 at 16:09
  • Add some layers depending on your requirement, largest rules being applied to your network, and more granular rules to your VMs. Updated my answer. – Nixphoe Nov 8 '18 at 16:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.