You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
# Security admin rules in Azure Virtual Network Manager
13
13
14
-
In this article, you'll learn about security admin rules in Azure Virtual Network Manager. Security admin rules are used to define global network security rules that apply to all virtual networks within a [network group](concept-network-groups.md). You learn about what security admin rules are, how they work, and when to use them.
14
+
In this article, you learn about security admin rules in Azure Virtual Network Manager. Security admin rules are used to define global network security rules that apply to all virtual networks within a [network group](concept-network-groups.md). You learn about what security admin rules are, how they work, and when to use them.
Security admin rules are global network security rules that enforce security policies defined in the rule collection on virtual networks. These rules can be used to Allow, Always Allow, or Deny traffic across virtual networks within your targeted network groups. These network groups can only consist of virtual networks within the scope of your network manager instance; thus, security admin rules cannot apply to virtual networks not managed by a network manager.
20
+
Security admin rules are global network security rules that enforce security policies defined in the rule collection on virtual networks. These rules can be used to Allow, Always Allow, or Deny traffic across virtual networks within your targeted network groups. These network groups can only consist of virtual networks within the scope of your network manager instance; thus, security admin rules can't apply to virtual networks not managed by a network manager.
21
21
22
22
Here are some scenarios where security admin rules can be used:
23
23
@@ -81,25 +81,25 @@ Based on the industry study and suggestions from Microsoft, we recommend custome
81
81
82
82
|**Port**|**Protocol**|**Description**|
83
83
| --- | ---- | ------- |
84
-
|**20**| TCP | Unencrypted FTP Traffic |
85
-
|**21**| TCP | Unencrypted FTP Traffic |
86
-
|**22**| TCP | SSH. Potential brute force attacks |
|**873**| TCP | Rsync - unencrypted file transfer |
99
+
|**2049**| TCP/UDP | Network File System |
100
+
|**3389**| TCP | RDP - Common brute force attack port |
101
+
|**5800**| TCP | VNC Remote Frame Buffer over HTTP |
102
+
|**5900**| TCP | VNC Remote Frame Buffer over HTTP |
103
103
|**11211**| UDP | Memcached |
104
104
105
105
### Management at scale
@@ -110,9 +110,44 @@ New resources are protected along with existing resources. For example, if you a
110
110
111
111
When new security risks are identified, you can deploy them at scale by creating a security admin rule to protect against the new risk and applying it to your network groups. Once this new rule is deployed, all resources in the scope of the network groups will be protected now and in the future.
112
112
113
+
## Nonapplication of security admin rules
114
+
115
+
In most instances, security admin rules are applied to all virtual networks and subnets within the scope of a network group's applied security configuration. However, there are some services that don't apply security admin rules due to the network requirements of the service. These requirements are enforced by the service's network intent policy.
116
+
117
+
### Nonapplication of security admin rules at virtual network level
118
+
119
+
By default, security admin rules aren't applied to a virtual network containing the following services:
When a virtual network contains these services, the security admin rules skip this virtual network. If you want *Allow* rules applied to this virtual network, you create your security configuration with the `AllowRulesOnly` field set in the [securityConfiguration.properties.applyOnNetworkIntentPolicyBasedServices](/dotnet/api/microsoft.azure.management.network.models.networkintentpolicybasedservice?view=azure-dotnet) .NET class. When set, *Allow* rules in your security configuration will be applied to this virtual network. All *Deny* rules will not be applied on this virtual network. Virtual networks without these services can continue using *Allow* and *Deny* rules.
125
+
126
+
You can create a security configuration with *Allow* rules only and deploy it to your virtual networks with [Azure PowerShell](/powershell/module/az.network/new-aznetworkmanagersecurityadminconfiguration#example-1) and [Azure CLI](/cli/azure/network/manager/security-admin-config#az-network-manager-security-admin-config-create-examples).
127
+
128
+
> [!NOTE]
129
+
> When multiple Azure Virtual Network Manager instances apply different settings in the `securityConfiguration.properties.applyOnNetworkIntentPolicyBasedServices` class to the same virtual network, the setting of the network manager instance with the highest scope will be used.
130
+
> Let's say you have two virtual network managers. The first network manager is scoped to the root management group and has a security configuration with set to *AllowRulesOnly* in the `securityConfiguration.properties.applyOnNetworkIntentPolicyBasedServices` class. The second virtual network manager is scoped to a subscription under the root management group and uses the default field of *None* in it's security configuration. When both configurations apply security admin rules to the same virtual network, the *AllowRulesOnly* setting will be applied to the virtual network.
131
+
132
+
### Nonapplication of security admin rules at subnet level
133
+
134
+
Similarly, there are some services that don't apply security admin rules at the subnet level when those subnets' virtual networks are a part of a network group targeted by a security admin configuration. Those services include:
135
+
136
+
- Azure Application Gateway
137
+
- Azure Bastion
138
+
- Azure Firewall
139
+
- Azure Route Server
140
+
- Azure VPN Gateway
141
+
- Azure Virtual WAN
142
+
- Azure ExpressRoute Gateway
143
+
144
+
> [!NOTE]
145
+
> If you want to apply security admin rules on subnets containing an Azure Application Gateway, ensure each subnet only contains gateways that have been provisioned with [network isolation](../application-gateway/application-gateway-private-deployment.md) enabled. If a subnet contains an Azure Application Gateway without network isolation, security admin rules won't be applied to this subnet.
146
+
113
147
## Security admin fields
114
148
115
149
When you define a security admin rule, there are required and optional fields.
Copy file name to clipboardExpand all lines: articles/virtual-network-manager/faq.md
+10-6Lines changed: 10 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -87,17 +87,17 @@ You can view Azure Virtual Network Manager settings under **Network Manager** fo
87
87
88
88
Should a regional outage occur, all configurations applied to current resources managed persist, and you can't modify existing configurations, or create new configuration.
89
89
90
-
### Can a virtual network managed by Azure Virtual Network Manager be peered to a non-managed virtual network?
90
+
### Can a virtual network managed by Azure Virtual Network Manager be peered to a nonmanaged virtual network?
91
91
92
92
Yes, Azure Virtual Network Manager is fully compatible with pre-existing hub and spoke topology deployments using peering. This means that you won't need to delete any existing peered connections between the spokes and the hub. The migration occurs without any downtime to your network.
93
93
94
94
### Can I migrate an existing hub and spoke topology to Azure Virtual Network Manager?
95
95
96
-
Yes, migrating existing VNets to AVNM’s hub and spoke topology is very easy and requires no down time. Customers can [create a hub and spoke topology connectivity configuration](how-to-create-hub-and-spoke.md) of the desired topology. When the deployment of this configuration is deployed, virtual network manager will automatically create the necessary peerings. Any pre-existing peerings set up by users will remain intact, ensuring there's no downtime.
96
+
Yes, migrating existing VNets to AVNM’s hub and spoke topology is easy and requires no down time. Customers can [create a hub and spoke topology connectivity configuration](how-to-create-hub-and-spoke.md) of the desired topology. When the deployment of this configuration is deployed, virtual network manager will automatically create the necessary peerings. Any pre-existing peerings set up by users remain intact, ensuring there's no downtime.
97
97
98
98
### How do connected groups differ from virtual network peering regarding establishing connectivity between virtual networks?
99
99
100
-
In Azure, VNet peering and connected groups are two methods of establishing connectivity between virtual networks (VNets). While VNet peering works by creating a 1:1 mapping between each peered VNet, connected groups use a new construct that establishes connectivity without such a mapping. In a connected group, all virtual networks are connected without individual peering relationships. For example, if VNetA, VNetB, and VNetC are part of the same connected group, connectivity is enabled between each VNet without the need for individual peering relationships.
100
+
In Azure, virtual network peering and connected groups are two methods of establishing connectivity between virtual networks (VNets). While virtual network peering works by creating a 1:1 mapping between each peered virtual network, connected groups use a new construct that establishes connectivity without such a mapping. In a connected group, all virtual networks are connected without individual peering relationships. For example, if VNetA, VNetB, and VNetC are part of the same connected group, connectivity is enabled between each virtual network without the need for individual peering relationships.
101
101
102
102
### Do security admin rules apply to Azure Private Endpoints?
103
103
@@ -121,18 +121,22 @@ No, an Azure Virtual WAN hub isn't supported as the hub in a hub and spoke topol
121
121
122
122
### My Virtual Network isn't getting the configurations I'm expecting. How do I troubleshoot?
123
123
124
-
#### Have you deployed your configuration to the VNet's region?
124
+
#### Have you deployed your configuration to the virtual network's region?
125
125
126
126
Configurations in Azure Virtual Network Manager don't take effect until they're deployed. Make a deployment to the virtual networks region with the appropriate configurations.
127
127
128
128
#### Is your virtual network in scope?
129
129
130
130
A network manager is only delegated enough access to apply configurations to virtual networks within your scope. Even if a resource is in your network group but out of scope, it doesn't receive any configurations.
131
131
132
-
#### Are you applying security rules to a VNet containing Azure SQL Managed Instances?
132
+
#### Are you applying security rules to a virtual network containing Azure SQL Managed Instances?
133
133
134
134
Azure SQL Managed Instance has some network requirements. These are enforced through high priority Network Intent Policies, whose purpose conflicts with Security Admin Rules. By default, Admin rule application is skipped on VNets containing any of these Intent Policies. Since *Allow* rules pose no risk of conflict, you can opt to apply *Allow Only* rules. If you only wish to use Allow rules, you can set AllowRulesOnly on `securityConfiguration.properties.applyOnNetworkIntentPolicyBasedServices`.
135
135
136
+
#### Are you applying security rules to a virtual network or subnet that contains services blocking security configuration rules?
137
+
138
+
Certain services such as Azure SQL Managed Instance, Azure Databricks and Azure Application Gateway require specific network requirements to function propertly. By default, security admin rule application is skipped on [VNets and subnets containing any of these services](./concept-security-admins.md#nonapplication-of-security-admin-rules). Since *Allow* rules pose no risk of conflict, you can opt to apply *Allow Only* rules by setting the security configurations' `AllowRulesOnly`field on `securityConfiguration.properties.applyOnNetworkIntentPolicyBasedServices` .NET class.
139
+
136
140
## Limits
137
141
138
142
### What are the service limitations of Azure Virtual Network Manager?
@@ -165,7 +169,7 @@ Azure SQL Managed Instance has some network requirements. These are enforced thr
165
169
166
170
* Azure Virtual Network Manager policies don't support the standard policy compliance evaluation cycle. For more information, see [Evaluation triggers](../governance/policy/how-to/get-compliance-data.md#evaluation-triggers).
167
171
168
-
* The current preview of connected group has a limitation where traffic from a connected group cannot communicate with a private endpoint in this connected group if it has NSG enabled on it. However, this limitation will be removed once the feature is generally available.
172
+
* The current preview of connected group has a limitation where traffic from a connected group can't communicate with a private endpoint in this connected group if it has NSG enabled on it. However, this limitation will be removed once the feature is generally available.
169
173
## Next steps
170
174
171
175
Create an [Azure Virtual Network Manager](create-virtual-network-manager-portal.md) instance using the Azure portal.
0 commit comments