Create the network infrastructure for the exercise

As organizations migrate applications to the cloud, securing network traffic becomes a top priority. In this article, we walk through a practical scenario where an organization uses Network Security Groups (NSGs) and Application Security Groups (ASGs) to tightly control traffic within an Azure virtual network (app-vnet). This hands-on guide explains each step and the rationale behind it, helping you build a secure and manageable cloud environment.

Scenario Overview
Your organization is deploying a web-based application in Azure. The architecture includes:

• Frontend subnet: Hosts web servers accessible from the internet.
• Backend subnet: Hosts database servers accessed only by the frontend.
• Virtual machines: VM1 in the frontend subnet, VM2 in the backend subnet.

• Security goals:

• Group web servers using an ASG for simplified management

• Use an NSG to control traffic to the backend subnet

• Allow secure SSH access from frontend to backend

Step 1: Deploy the Virtual Machines

Note: This exercise requires the Lab 01 virtual networks and subnets to be installed. A template is provided if you need to deploy those resources. (kindly refer to my previous post with this link https://dev.to/isaiah_izibili_7a39b7d627/building-a-secure-network-architecture-in-azure-a-step-by-step-guide-3d8a)

1. Use the icon (top right) to launch a Cloud Shell session. Alternately, navigate directly to https://shell.azure.com.
2. If prompted to select either Bash or PowerShell, select PowerShell.
3. Storage is not required for this task Select your subscription. Apply your changes.
4. Use these commands to deploy the virtual machines required for this exercise.

Note: If the deployment fails for capacity restriction, edit the template and change the “location” value.

$RGName = "RG1"

New-AzResourceGroupDeployment -ResourceGroupName $RGName `
  -TemplateUri "https://raw.githubusercontent.com/MicrosoftLearning/Configure-secure-access-to-workloads-with-Azure-virtual-networking-services/main/Instructions/Labs/azuredeploy.json"

5. In the portal search for and select virtual machines. Verify both vm1 and vm2 are Running.

Why It Matters:
This sets up the infrastructure needed to test and validate your security configurations. Using a template ensures consistency and saves time.

Step 2: Create an Application Security Group (ASG)

Application security groups ASGs let you group VMs by function (e.g., web servers) and apply security rules to the group instead of individual IP addresses. This simplifies management and scales well.

1. In the portal, search for and select Application security groups.

2. Select + Create and configure the application security group.

**Property          Value**
Subscription            Select your subscription
Resource group          RG1
Name                    app-frontend-asg
Region                  WEST US 3

3. Select Review + create and then select Create.

Note: You are creating the application security group in the same region as the existing virtual network.

Step 3: Associate ASG with VM1

1. In the Azure portal, search for and select VM1.
2. In the Networking blade, select Application security groups and then select Add application security groups.
3. Select the app-frontend-asg and then select Add.

Step 4: Create and Associate the Network Security Group

NSGs are the backbone of Azure network security. They filter traffic using rules and can be applied to subnets or individual NICs.

1. In the portal search for and select Network security group.
2. Select + Create and configure the network security group.

Property              Value
Subscription              Select your subscription
Resource group            RG1
Name                      app-vnet-nsg
Region                    West US 3

3. Select Review + create and then select Create.

Step 5: Associate the NSG with the app-vnet backend subnet.

NSGs can be associated with subnets and/or individual network interfaces attached to Azure virtual machines.

1. Select Go to resource or navigate to the app-vnet-nsg resource.
2. In the Settings blade select Subnets.
3. Select + Associate
4. Select app-vnet (RG1) and then the Backend subnet. Select OK.

Step 6: Create Network Security Group rules

An NSG use security rules to filter inbound and outbound network traffic.

1. In the search box at the top of the portal, enter Network security groups. Select Network security groups in the search results.
2. Select app-vnet-nsg from the list of network security groups.
3. In the Settings blade, select Inbound security rules.
4. Select + Add and configure an inbound security rule.

Property                               Value
Source                                 Any
Source port ranges                     *
Destination                            Application Security group
Destination application security group     app-frontend-asg
Service                                    SSH
Action                                     Allow
Priority                                   100
Name                                       AllowSSH

Why It Matters:
This enables secure communication between web servers and database servers, while blocking all other traffic by default.

Key takeaways
Congratulations on completing the exercise. Here are the main takeaways:

1. Application security groups let you organize virtual machines and define network security policies based on your organization’s applications.
2. An Azure network security group is used to filter network traffic between Azure resources in an Azure virtual network.
3. You can associate zero, or one, network security group to each virtual network subnet and network interface in a virtual machine.
4. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, Azure resources.
5. You join virtual machines to an application security group. Then you use the application security group as a source or destination in the network security group rules.