Azure Management Tasks Part 2: How to configure the Virtual Network (VNET)

#networking #azure #microsoft #cloud

INTRODUCTION

In the previous walkthrough, we put together a basic environment, creating a resource group, a VNet, a VM, and a storage account just enough infrastructure to have something real to manage. This time we're going back into that network and giving it some actual structure: a dedicated subnet for SFTP (Secure File Transfer Protocol) traffic, plus a network security group to control exactly what's allowed in and out of it.

If you haven't built the base environment yet, it's worth going back and doing that first, everything here assumes the guided-project-vnet VNet already exists.

What You'll Need

Access to the Azure portal.
The environment from Part 1 already deployed.
A rough sense of what subnets and network security groups actually do.

Step 1: Create a new subnet on an existing virtual network (vNet).

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select the guided-project-vnet virtual network.
From the guided-project-vnet blade, under settings, select Subnets.
To add a subnet, select + Subnet.
For Subnet purpose leave it as Default.
For Name enter: ftpSubnet.
Leave the rest of the settings alone and select Add.
Select Home to return to the Azure portal home page.
Congratulations – you’ve completed the creation of a subnet. This subnet is only going to be used for SFTP traffic. To increase security, you need to configure a Network security group to restrict which ports are allowed on the subnet.

Step 2: Create a network security group.

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select Network security groups.
Select + Create.
Verify the subscription is correct.
Select the guided-project-rg resource group.
Enter ftpNSG for the network security group name.
Select Review + create.
Once the validation is complete, select Create.
Wait for the screen to refresh and display Your deployment is complete.
Select Go to resource.

Create an inbound security rule.

Under settings, select Inbound security rules.
Select + Add.
Change the Destination port ranges from 8080 to 22.
Select TCP for the protocol.
Set the name to ftpInbound.
Select Add.
Select Home to return to the Azure portal home page.

Step 3: Associate a network security group to the subnet.

From the Azure portal home page, in the search box, enter virtual networks.
Select virtual networks under services.
Select the guided-project-vnet virtual network.
Under settings, select Subnets.
Select the ftpSubnet you created.
On the Edit subnet page, under the Security section heading, update the Network security group field to ftpNSG.
Select Save.

Conclusion

What we accomplished:

Created a dedicated ftpSubnet inside the guided-project-vnet, separating SFTP traffic from the rest of the network.
Stood up a network security group, ftpNSG, to control access to that subnet.
Added an inbound rule allowing only TCP traffic on port 22 — the port SFTP actually needs
Linked the NSG to the subnet, putting those rules into effect

Why it matters:
A subnet without a security group is just an open door. By pairing the two, this subnet now only accepts the exact traffic it was designed for, and nothing else gets a free pass in.