I don't think this is currently possible, but I'll give it a shot.

VNET "main" contains subnets "A" and "B".

Subnet A contains VM A1. Subnet B contains VMs B1 and B2.

By default (even with an NSG applied to the subnet) everything in both subnets can talk to each other because of the standard "AllowVnetInBound" rule.

If a DenyAll rule is set on Subnet B with a higher priority than the "AllowVnetInBound" rule, this prevents A1 talking to B1 and B2, but it also stops B1 talking to B2 due to the NSG rules actually being applied at the NIC level, i.e. a subnet level NSG is just a convenient way of bulk applying NIC level NSGs.

So, is there any way to prevent subnet A talking to subnet B without breaking all traffic between B1 and B2 OR specifying every last B1 to B2 rule in the NSG?



Specify two deny rules. One with the netmask of subnet A as the Source and the netmask of subnet B as the Destination and vice versa.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.