Networking · Lesson 17 of 24

NSGs, ASGs and user-defined routes

The firewall list on each subnet or network card, the labels that keep it readable, and how to force traffic through a firewall.

About 10 min · Interactive · 3 practice questions

Exam objective
Create and configure NSGs and application security groups · Evaluate effective security rules in NSGs · Configure user-defined routes · Troubleshoot network connectivityImplement and manage virtual networking · 15–20% of the exam · typical question: Exhibit of NSG rules: "is traffic allowed?"; "which tool shows why it is blocked"; route to force traffic via a firewall
In one sentence. A network security group is a list of allow and deny rules, like a router ACL, that you attach to a subnet or to one server's network card. Azure reads the list top to bottom by priority number, stops at the first match, and automatically lets the reply packets back. When a subnet and a NIC both have a list, traffic has to pass both.
InternetSubnet NSGchecked 1st inboundNIC NSGchecked 2nd inboundVMInbound: subnet then NIC. Outbound (dashed): NIC then subnet. Both must allow; one deny is enough to block.Inside one NSG: lowest number wins, stop at first match, replies are allowed automatically (stateful).

You, the admin: let the world reach the web servers on 443 and nothing else

  1. Network security groups › + Create, name NSG-Web, same region as the VNet.
  2. NSG-Web › Inbound security rules › + Add: Source Any (or Service tag Internet), destination port 443, protocol TCP, action Allow, priority 100, name Allow-HTTPS.
  3. Nothing else is needed: the built-in DenyAllInBound at 65500 already blocks the rest. (The built-in AllowVnetInBound at 65000 still lets other VNet traffic in; add a Deny at, say, 4000 if you want to block that too.)
  4. Attach: NSG-Web › Subnets › + Associate › VNet1 / Web. One NSG can serve many subnets and NICs.
  5. Verify from a VM: VM › Networking › Effective security rules shows the subnet and NIC lists merged.

Script: az network nsg rule create -g RG-Net --nsg-name NSG-Web -n Allow-HTTPS --priority 100 --destination-port-ranges 443 --access Allow --protocol Tcp

Rule fieldValues
Priority100 to 4096; lower number is checked first. Built-ins live at 65000+ and cannot be deleted, only out-ranked.
Source / destinationAny, an IP or CIDR, a service tag (Internet, VirtualNetwork, AzureLoadBalancer, Storage, Sql, AzureCloud: Microsoft maintains the address lists), or an application security group
Port and protocolSingle, range, list; TCP / UDP / ICMP / Any
ActionAllow or Deny

Application security groups are name tags you put on NICs (NIC › Application security groups): WebServers, DbServers. A rule can then say "from WebServers to DbServers port 1433 allow" and keeps working as servers are added or replaced. Create them under Application security groups › + Create; they must be in the same VNet as the NICs.

Routing: overriding Azure's choices

Azure already routes between your subnets, to peered VNets, to the VPN and to the internet. To change that, make a route table (Route tables › + Create), add routes, and associate it with subnets.

Route fieldMeaning
Address prefixDestination, e.g. 0.0.0.0/0 for "everything else"
Next hop typeVirtual appliance (your firewall VM's private IP; that VM's NIC needs IP forwarding enabled), Virtual network gateway, Virtual network, Internet, or None (drop)
PrecedenceLongest matching prefix wins; on a tie, your route beats BGP beats Azure's system route

Check what a server will actually do under NIC › Effective routes, or ask Network Watcher Next hop for one destination.

Trap wording. "Allow rule at 200, deny-all at 100, traffic blocked" = correct, 100 wins. "NIC allows but still blocked" = check the subnet NSG; use Effective security rules or IP flow verify. "Send all internet traffic via the firewall" = route 0.0.0.0/0 → Virtual appliance + IP forwarding on the firewall NIC.

Key points

  • An NSG is a firewall list on a subnet or a NIC: lowest priority number wins, stop at first match, replies allowed automatically.
  • Inbound passes the subnet NSG then the NIC NSG; a deny in either blocks. Use Effective security rules or IP flow verify to see the result.
  • Application security groups name servers so rules do not need IP lists.
  • A route table overrides Azure routing; 0.0.0.0/0 → Virtual appliance sends everything through a firewall, which needs IP forwarding on.

Formal terms: Stateful firewall, priority, service tag, application security group (ASG), route table, user-defined route (UDR), network virtual appliance (NVA), IP forwarding, effective routes.

Check your understanding

3 exam-style questions in the formats AZ-104 uses. Each is marked when you check it, with the reasoning.

0 of 3 checked

All scenarios and questions are original. None are taken from the exam, Microsoft's practice assessment or any question bank. PrepToExcel is not affiliated with Microsoft.