moved note up

Author: spelluru

articles/service-bus-messaging/service-bus-ip-filtering.md

@@ -20,6 +20,9 @@ By default, Service Bus namespaces are accessible from internet as long as the r
 
 This feature is helpful in scenarios in which Azure Service Bus should be only accessible from certain well-known sites. Firewall rules enable you to configure rules to accept traffic originating from specific IPv4 addresses. For example, if you use Service Bus with [Azure Express Route][express-route], you can create a **firewall rule** to allow traffic from only your on-premises infrastructure IP addresses or addresses of a corporate NAT gateway. 
 
+> [!IMPORTANT]
+> Firewalls and Virtual Networks are supported only in the **premium** tier of Service Bus.
+
 ## IP firewall rules
 The IP firewall rules are applied at the Service Bus namespace level. Therefore, the rules apply to all connections from clients using any supported protocol. Any connection attempt from an IP address that does not match an allowed IP rule on the Service Bus namespace is rejected as unauthorized. The response does not mention the IP rule. IP filter rules are applied in order, and the first rule that matches the IP address determines the accept or reject action.
 
@@ -41,8 +44,6 @@ This section shows you how to use the Azure portal to create IP firewall rules f
 ## Use Resource Manager template
 This section has a sample Azure Resource Manager template that creates a virtual network and a firewall rule.
 
-> [!IMPORTANT]
-> Firewalls and Virtual Networks are supported only in the **premium** tier of Service Bus.
 
 The following Resource Manager template enables adding a virtual network rule to an existing Service Bus namespace.