Remove redundant sections

Author: charwen

articles/bastion/bastion-nsg.md

@@ -6,7 +6,7 @@ author: charwen
 
 ms.service: bastion
 ms.topic: conceptual
-ms.date: 02/03/2020
+ms.date: 04/20/2020
 ms.author: charwen
 ---
 # Working with NSG access and Azure Bastion
@@ -27,9 +27,9 @@ In this diagram:
 
 This section shows you the network traffic between the user and Azure Bastion, and through to target VMs in your virtual network:
 
-### AzureBastionSubnet
+### <a name="apply"></a>AzureBastionSubnet
 
-Azure Bastion is deployed specifically to the AzureBastionSubnet.
+Azure Bastion is deployed specifically to ***AzureBastionSubnet***.
 
 * **Ingress Traffic:**
 
@@ -41,19 +41,11 @@ Azure Bastion is deployed specifically to the AzureBastionSubnet.
    * **Egress Traffic to target VMs:** Azure Bastion will reach the target VMs over private IP. The NSGs need to allow egress traffic to other target VM subnets for port 3389 and 22.
    * **Egress Traffic to other public endpoints in Azure:** Azure Bastion needs to be able to connect to various public endpoints within Azure (for example, for storing diagnostics logs and metering logs). For this reason, Azure Bastion needs outbound to 443 to **AzureCloud** service tag.
 
-* **Target VM Subnet:** This is the subnet that contains the target virtual machine that you want to RDP/SSH to.
+### Target VM Subnet
+This is the subnet that contains the target virtual machine that you want to RDP/SSH to.
 
    * **Ingress Traffic from Azure Bastion:** Azure Bastion will reach to the target VM over private IP. RDP/SSH ports (ports 3389/22 respectively) need to be opened on the target VM side over private IP. As a best practice, you can add the Azure Bastion Subnet IP address range in this rule to allow only Bastion to be able to open these ports on the target VMs in your target VM subnet.
 
-## <a name="apply"></a>Apply NSGs to AzureBastionSubnet
-
-If you create and apply an NSG to ***AzureBastionSubnet***, make sure you have added the following rules in your NSG. If you do not add these rules, the NSG creation/update will fail:
-
-* **Control plane connectivity:** Inbound on 443 from GatewayManager
-* **Diagnostics logging and others:** Outbound on 443 to AzureCloud. Regional tags within this service tag are not supported yet.
-* **Target VM:** Outbound for 3389 and 22 to VirtualNetwork
-
-An NSG rule example is available for reference in this [quickstart template](https://github.com/Azure/azure-quickstart-templates/tree/master/101-azure-bastion-nsg).
 
 ## Next steps