Create and configure network security groups
Scenarion
Your organization requires the network traffic in the app-vnet to be tightly controlled. You identify these requirements.
The frontend subnet has web servers that can be accessed from the internet. An application security group (ASG) is required for those servers. The ASG should be associated with any virtual machine interface that is part of the group. This will allow the web servers to be easily managed.
The backend subnet has database servers used by the frontend web servers. A network security group (NSG) is required to control this traffic. The NSG should be associated with any virtual machine interface that will be accessed by the web servers.
For testing, a virtual machine should be installed in the frontend subnet (VM1) and the backend subnet (VM2). The IT group has provided an Azure resource manager template to deploy these Ubuntu servers.
Skilling tasks
- Create a network security group.
- Create network security group rules.
- Associate a network security group to a subnet.
- Create and use application security groups in network security group rules.
Create the network infrastructure for the exercise
Note: This exercise requires the Lab 01 virtual networks and subnets to be installed. A template is provided if you need to deploy those resources.
- Use the icon (top right) to launch a Cloud Shell session. Alternately, navigate directly to https://shell.azure.com.
If prompted to select either Bash or PowerShell, select PowerShell.
Storage is not required for this task. Select your subscription. Apply your changes.
Use these commands to deploy the virtual machines required for this exercise.
Create Application Security Group
Understanding Application Security Groups in Microsoft Azure
Application Security Groups (ASGs) in Microsoft Azure provide fine-grained network traffic control, simplifying and strengthening cloud workload security.
What Are Application Security Groups?
Application Security Groups are logical groupings of Azure resources, such as virtual machines or network interfaces, that let you define security policies based on application roles instead of individual IP addresses. When used with Network Security Groups, ASGs simplify complex network security rule management and support scalability.
Purpose
ASGs are designed to simplify network security management for applications with multiple components. Grouping resources by application role enables consistent security rules across all group members and reduces the complexity of managing changing IP addresses in dynamic environments.
Key Benefits:
Simplified Rule Management: Define rules once for an ASG, applying them to all associated resources.
Scalability: Automatically apply policies to new resources added to an ASG.
Flexibility: Combine with NSGs to create layered security for multi-tier applications.
Dynamic Adaptation: Handle changing IPs in auto-scaling or redeployed environments.
Example: Instead of creating NSG rules for each web server’s IP address, assign all web servers to a "Web-ASG" and apply a single rule allowing HTTP traffic to the group.
Components of Application Security Groups
ASGs are part of Azure’s networking ecosystem. Understanding their components is essential for effective use:
ASG Resource: A standalone Azure resource created in a resource group, identified by a name and region.
Associated Resources: Network interfaces of VMs, Azure Kubernetes Service (AKS) nodes, or other compute resources assigned to an ASG.
Network Security Groups (NSGs): ASGs are referenced in NSG rules to define traffic permissions (e.g., source or destination).
Virtual Network (VNet): ASGs operate within a VNet, where resources share a common network boundary.
Rules: NSG rules use ASGs as source or destination instead of IP addresses, with attributes like protocol, port, and priority
Application security groups (ASGs) let you group together servers with similar functions. For example, all the web servers hosting your application.
In the portal, search for and select Application security groups.
Select + Create and configure the application security group.
- Select Review + create and then select Create.
Note: You are creating the application security group in the same region as the existing virtual network.
Associate the application security group to the network interface of the VM
- In the Azure portal, search for and select VM1.
- In the Networking blade, select Application security groups and then select Add application security groups.
- Select the app-frontend-asg and then select Add.
***Create and Associate the Network Security Group
Network security groups (NSGs) secure network traffic in a virtual network. Network security allows the creation of network security "Rules". Inbound and outbound are attributes of network rules; this is not available in Application security rules, and App security uses the security rules established on network security rules. However, it can be linked to the Network security rule so that it will be applied to all virtual machines that are connected to the network.
In the portal, search for and select Network security group.
Select "+ Create" and configure the network security group.
Associate the NSG with the app-vnet backend subnet.
NSGs can be associated with subnets and/or individual network interfaces attached to Azure virtual machines.
- Select Go to resource or navigate to the app-vnet-nsg resource.
In the Settings blade select Subnets.
Select + Associate
Select app-vnet (RG1) and then the Backend subnet. Select OK.
Create Network Security Group rules
An NSG use security rules to filter inbound and outbound network traffic.
In the search box at the top of the portal, enter Network security groups. Select Network security groups in the search results.
Select app-vnet-nsg from the list of network security groups.
In the Settings blade, select Inbound security rules.
Select + Add and configure an inbound security rule.
Top comments (0)