Skip to content

Commit b2a1a0a

Browse files
cynthncynthn
committed
Combining nsg articles
1 parent 246bace commit b2a1a0a

File tree

1 file changed

+145
-17
lines changed

1 file changed

+145
-17
lines changed

‎articles/virtual-machines/windows/nsg-quickstart-portal.md

Lines changed: 145 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ ms.service: virtual-machines
66
ms.subservice: networking
77
ms.topic: how-to
88
ms.workload: infrastructure-services
9-
ms.date: 08/27/2021
9+
ms.date: 02/14/2023
1010
ms.author: cynthn
1111

1212
---
@@ -17,11 +17,145 @@ ms.author: cynthn
1717
[!INCLUDE [virtual-machines-common-nsg-quickstart](../../../includes/virtual-machines-common-nsg-quickstart.md)]
1818

1919

20-
## Sign in to Azure
21-
Sign in to the Azure portal at https://portal.azure.com.
2220

23-
## Create a network security group
21+
### [CLI](#tab/cli)
2422

23+
You open a port, or create an endpoint, to a virtual machine (VM) in Azure by creating a network filter on a subnet or VM network interface. You place these filters, which control both inbound and outbound traffic, on a Network Security Group attached to the resource that receives the traffic. Let's use a common example of web traffic on port 80. This article shows you how to open a port to a VM with the Azure CLI.
24+
25+
26+
To create a Network Security Group and rules you need the latest [Azure CLI](/cli/azure/install-az-cli2) installed and logged in to an Azure account using [az login](/cli/azure/reference-index).
27+
28+
In the following examples, replace example parameter names with your own values. Example parameter names include *myResourceGroup*, *myNetworkSecurityGroup*, and *myVnet*.
29+
30+
31+
## Quickly open a port for a VM
32+
If you need to quickly open a port for a VM in a dev/test scenario, you can use the [az vm open-port](/cli/azure/vm) command. This command creates a Network Security Group, adds a rule, and applies it to a VM or subnet. The following example opens port *80* on the VM named *myVM* in the resource group named *myResourceGroup*.
33+
34+
```azurecli
35+
az vm open-port --resource-group myResourceGroup --name myVM --port 80
36+
```
37+
38+
For more control over the rules, such as defining a source IP address range, continue with the additional steps in this article.
39+
40+
41+
## Create a Network Security Group and rules
42+
Create the network security group with [az network nsg create](/cli/azure/network/nsg). The following example creates a network security group named *myNetworkSecurityGroup* in the *eastus* location:
43+
44+
```azurecli
45+
az network nsg create \
46+
--resource-group myResourceGroup \
47+
--location eastus \
48+
--name myNetworkSecurityGroup
49+
```
50+
51+
Add a rule with [az network nsg rule create](/cli/azure/network/nsg/rule) to allow HTTP traffic to your webserver (or adjust for your own scenario, such as SSH access or database connectivity). The following example creates a rule named *myNetworkSecurityGroupRule* to allow TCP traffic on port 80:
52+
53+
```azurecli
54+
az network nsg rule create \
55+
--resource-group myResourceGroup \
56+
--nsg-name myNetworkSecurityGroup \
57+
--name myNetworkSecurityGroupRule \
58+
--protocol tcp \
59+
--priority 1000 \
60+
--destination-port-range 80
61+
```
62+
63+
64+
Associate the Network Security Group with your VM's network interface (NIC) with [az network nic update](/cli/azure/network/nic). The following example associates an existing NIC named *myNic* with the Network Security Group named *myNetworkSecurityGroup*:
65+
66+
```azurecli
67+
az network nic update \
68+
--resource-group myResourceGroup \
69+
--name myNic \
70+
--network-security-group myNetworkSecurityGroup
71+
```
72+
73+
Alternatively, you can associate your Network Security Group with a virtual network subnet with [az network vnet subnet update](/cli/azure/network/vnet/subnet) rather than just to the network interface on a single VM. The following example associates an existing subnet named *mySubnet* in the *myVnet* virtual network with the Network Security Group named *myNetworkSecurityGroup*:
74+
75+
```azurecli
76+
az network vnet subnet update \
77+
--resource-group myResourceGroup \
78+
--vnet-name myVnet \
79+
--name mySubnet \
80+
--network-security-group myNetworkSecurityGroup
81+
```
82+
83+
84+
The quick commands here allow you to get up and running with traffic flowing to your VM. Network Security Groups provide many great features and granularity for controlling access to your resources. You can read more about [creating a Network Security Group and ACL rules here](tutorial-virtual-network.md#secure-network-traffic).
85+
86+
For highly available web applications, you should place your VMs behind an Azure Load Balancer. The load balancer distributes traffic to VMs, with a Network Security Group that provides traffic filtering. For more information, see [How to load balance Linux virtual machines in Azure to create a highly available application](tutorial-load-balancer.md).
87+
88+
89+
### [PowerShell](#tab/poweshell)
90+
91+
To create a Network Security Group and ACL rules you need [the latest version of Azure PowerShell installed](/powershell/azure/). You can also [perform these steps using the Azure portal](nsg-quickstart-portal.md).
92+
93+
Log in to your Azure account:
94+
95+
```powershell
96+
Connect-AzAccount
97+
```
98+
99+
In the following examples, replace parameter names with your own values. Example parameter names included *myResourceGroup*, *myNetworkSecurityGroup*, and *myVnet*.
100+
101+
Create a rule with [New-AzNetworkSecurityRuleConfig](/powershell/module/az.network/new-aznetworksecurityruleconfig). The following example creates a rule named *myNetworkSecurityGroupRule* to allow *tcp* traffic on port *80*:
102+
103+
```powershell
104+
$httprule = New-AzNetworkSecurityRuleConfig `
105+
-Name "myNetworkSecurityGroupRule" `
106+
-Description "Allow HTTP" `
107+
-Access "Allow" `
108+
-Protocol "Tcp" `
109+
-Direction "Inbound" `
110+
-Priority 100 `
111+
-SourceAddressPrefix "Internet" `
112+
-SourcePortRange * `
113+
-DestinationAddressPrefix * `
114+
-DestinationPortRange "80"
115+
```
116+
117+
Next, create your Network Security group with [New-AzNetworkSecurityGroup](/powershell/module/az.network/new-aznetworksecuritygroup) and assign the HTTP rule you just created as follows. The following example creates a Network Security Group named *myNetworkSecurityGroup*:
118+
119+
```powershell
120+
$nsg = New-AzNetworkSecurityGroup `
121+
-ResourceGroupName "myResourceGroup" `
122+
-Location "EastUS" `
123+
-Name "myNetworkSecurityGroup" `
124+
-SecurityRules $httprule
125+
```
126+
127+
Now let's assign your Network Security Group to a subnet. The following example assigns an existing virtual network named *myVnet* to the variable *$vnet* with [Get-AzVirtualNetwork](/powershell/module/az.network/get-azvirtualnetwork):
128+
129+
```powershell
130+
$vnet = Get-AzVirtualNetwork `
131+
-ResourceGroupName "myResourceGroup" `
132+
-Name "myVnet"
133+
```
134+
135+
Associate your Network Security Group with your subnet with [Set-AzVirtualNetworkSubnetConfig](/powershell/module/az.network/set-azvirtualnetworksubnetconfig). The following example associates the subnet named *mySubnet* with your Network Security Group:
136+
137+
```powershell
138+
$subnetPrefix = $vnet.Subnets|?{$_.Name -eq 'mySubnet'}
139+
140+
Set-AzVirtualNetworkSubnetConfig `
141+
-VirtualNetwork $vnet `
142+
-Name "mySubnet" `
143+
-AddressPrefix $subnetPrefix.AddressPrefix `
144+
-NetworkSecurityGroup $nsg
145+
```
146+
147+
Finally, update your virtual network with [Set-AzVirtualNetwork](/powershell/module/az.network/set-azvirtualnetwork) in order for your changes to take effect:
148+
149+
```powershell
150+
Set-AzVirtualNetwork -VirtualNetwork $vnet
151+
```
152+
153+
154+
155+
156+
### [Portal](#tab/portal)
157+
158+
1. Sign in to the Azure portal at https://portal.azure.com.
25159
1. Search for and select the resource group for the VM, choose **Add**, then search for and select **Network security group**.
26160

27161
1. Select **Create**.
@@ -36,7 +170,8 @@ Sign in to the Azure portal at https://portal.azure.com.
36170

37171
1. Select **Create** to create the network security group.
38172

39-
## Create an inbound security rule
173+
174+
Create an inbound security rule
40175

41176
1. Select your new network security group.
42177

@@ -52,7 +187,7 @@ Sign in to the Azure portal at https://portal.azure.com.
52187

53188
1. Select **Add** to create the rule.
54189

55-
## Associate your network security group with a subnet
190+
Associate your network security group with a subnet
56191

57192
Your final step is to associate your network security group with a subnet or a specific network interface. For this example, we'll associate the network security group with a subnet.
58193

@@ -64,17 +199,10 @@ Your final step is to associate your network security group with a subnet or a s
64199

65200
1. When you are done, select **OK**.
66201

67-
## Additional information
68-
69-
You can also [perform the steps in this article by using Azure PowerShell](nsg-quickstart-powershell.md).
70-
71-
The commands described in this article allow you to quickly get traffic flowing to your VM. Network security groups provide many great features and granularity for controlling access to your resources. For more information, see [Filter network traffic with a network security group](../../virtual-network/tutorial-filter-network-traffic.md).
72-
73-
For highly available web applications, consider placing your VMs behind an Azure load balancer. The load balancer distributes traffic to VMs, with a network security group that provides traffic filtering. For more information, see [Load balance Windows virtual machines in Azure to create a highly available application](tutorial-load-balancer.md).
74202

203+
---
75204
## Next steps
76-
In this article, you created a network security group, created an inbound rule that allows HTTP traffic on port 80, and then associated that rule with a subnet.
77205

78-
You can find information on creating more detailed environments in the following articles:
79-
- [Azure Resource Manager overview](../../azure-resource-manager/management/overview.md)
80-
- [Security groups](../../virtual-network/network-security-groups-overview.md)
206+
- The quick commands here allow you to get up and running with traffic flowing to your VM. Network Security Groups provide many great features and granularity for controlling access to your resources. You can read more about [creating a Network Security Group and ACL rules here](tutorial-virtual-network.md#secure-network-traffic).
207+
208+
- For highly available web applications, you should place your VMs behind an Azure Load Balancer. The load balancer distributes traffic to VMs, with a Network Security Group that provides traffic filtering. For more information, see [How to load balance virtual machines in Azure to create a highly available application](tutorial-load-balancer.md).

0 commit comments

Comments
 (0)