NSG vs ASG: Network and Application Security Groups

You create three ASGs and three NSGs in rg-saat-core, attach the NSGs to subnets, and test them with a rule evaluator. Everything stays for the VM lessons and costs nothing.

1Create the ASGs

Run this:

foreach ($a in 'asg-web','asg-app','asg-db') {
    az network asg create --resource-group rg-saat-core --name $a --tags course=saatvedha-azure lesson=12 keep=true -o none
}
az network asg list --resource-group rg-saat-core --query "[].name" -o tsv

You should see this:

asg-app
asg-db
asg-web

2Create the NSGs and their rules

Paste this whole block:

foreach ($n in 'nsg-saat-web','nsg-saat-app','nsg-saat-data') {
    az network nsg create --resource-group rg-saat-core --name $n --tags course=saatvedha-azure lesson=12 keep=true -o none
}
az network nsg rule create -g rg-saat-core --nsg-name nsg-saat-web -n allow-http-https-internet --priority 100 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes Internet --destination-asgs asg-web --destination-port-ranges 80 443 -o none
az network nsg rule create -g rg-saat-core --nsg-name nsg-saat-app -n allow-8080-web-to-app --priority 100 --direction Inbound --access Allow --protocol Tcp --source-asgs asg-web --destination-asgs asg-app --destination-port-ranges 8080 -o none
az network nsg rule create -g rg-saat-core --nsg-name nsg-saat-data -n allow-1433-app-to-db --priority 100 --direction Inbound --access Allow --protocol Tcp --source-asgs asg-app --destination-asgs asg-db --destination-port-ranges 1433 -o none
foreach ($n in 'nsg-saat-app','nsg-saat-data') {
    az network nsg rule create -g rg-saat-core --nsg-name $n -n deny-vnet-inbound --priority 4000 --direction Inbound --access Deny --protocol '*' --source-address-prefixes VirtualNetwork --destination-address-prefixes '*' --destination-port-ranges '*' -o none
}

The web tier gets no “deny the VNet” rule on purpose: in later lessons you’ll reach web VMs through Bastion, which comes from inside the VNet.

3Attach each NSG to its subnet

Run this:

az network vnet subnet update -g rg-saat-core --vnet-name vnet-saat -n snet-web --network-security-group nsg-saat-web -o none
az network vnet subnet update -g rg-saat-core --vnet-name vnet-saat -n snet-app --network-security-group nsg-saat-app -o none
az network vnet subnet update -g rg-saat-core --vnet-name vnet-saat -n snet-data --network-security-group nsg-saat-data -o none
az network vnet subnet list -g rg-saat-core --vnet-name vnet-saat --query "[].{subnet:name, nsg:networkSecurityGroup.id}" -o table

You should see something like this (shortened):

Subnet     Nsg
---------  -------------------------------------------------------------------------
snet-web   /subscriptions/.../resourceGroups/rg-saat-core/.../networkSecurityGroups/nsg-saat-web
snet-app   /subscriptions/.../resourceGroups/rg-saat-core/.../networkSecurityGroups/nsg-saat-app
snet-data  /subscriptions/.../resourceGroups/rg-saat-core/.../networkSecurityGroups/nsg-saat-data
snet-mgmt

4Read the full rule list, defaults included

Run this:

az network nsg rule list -g rg-saat-core --nsg-name nsg-saat-data --include-default --query "sort_by(@, &priority)[?direction=='Inbound'].{priority:priority, name:name, access:access, ports:destinationPortRange}" -o table

You should see something like this:

Priority    Name                           Access    Ports
----------  -----------------------------  --------  -------
100         allow-1433-app-to-db           Allow     1433
4000        deny-vnet-inbound              Deny      *
65000       AllowVnetInBound               Allow     *
65001       AllowAzureLoadBalancerInBound  Allow     *
65500       DenyAllInBound                 Deny      *

5Save a rule evaluator and test the design

This function reads an NSG’s rules and walks them the way Azure does, lowest priority first, to tell you which rule a connection would hit. It’s a simplified model (it handles ports, service tags and ASGs, not IP ranges), but it’s very good for checking a design before any VM exists.

Paste this whole block:

@'
function Test-NsgRule {
    param(
        [Parameter(Mandatory)][string]$Nsg,
        [Parameter(Mandatory)][int]$Port,
        [string]$SourceAsg,
        [string]$SourceTag = 'VirtualNetwork',
        [string]$DestAsg,
        [string]$Protocol = 'Tcp'
    )
    $rules = az network nsg rule list --resource-group rg-saat-core --nsg-name $Nsg --include-default -o json | ConvertFrom-Json
    $hasAsg = { param($list, $name) $list -and ($list | Where-Object { $_.id -like "*/$name" }) }
    foreach ($r in ($rules | Where-Object direction -eq 'Inbound' | Sort-Object priority)) {
        if ($r.protocol -ne '*' -and $r.protocol -ne $Protocol) { continue }
        $ports = @($r.destinationPortRange) + @($r.destinationPortRanges) | Where-Object { $_ }
        $portOk = $false
        foreach ($p in $ports) {
            if ($p -eq '*') { $portOk = $true }
            elseif ($p -match '^(\d+)-(\d+)$') { if ($Port -ge [int]$Matches[1] -and $Port -le [int]$Matches[2]) { $portOk = $true } }
            elseif ([int]$p -eq $Port) { $portOk = $true }
        }
        if (-not $portOk) { continue }
        if ($r.sourceApplicationSecurityGroups) { if (-not (& $hasAsg $r.sourceApplicationSecurityGroups $SourceAsg)) { continue } }
        elseif ($r.sourceAddressPrefix -ne '*' -and $r.sourceAddressPrefix -ne $SourceTag) { continue }
        if ($r.destinationApplicationSecurityGroups) { if (-not (& $hasAsg $r.destinationApplicationSecurityGroups $DestAsg)) { continue } }
        elseif ($r.destinationAddressPrefix -notin '*', 'VirtualNetwork') { continue }
        return [pscustomobject]@{ Port = $Port; From = if ($SourceAsg) { $SourceAsg } else { $SourceTag }; Rule = $r.name; Priority = $r.priority; Access = $r.access }
    }
}
'@ | Set-Content C:\azure-lab\Test-NsgRule.ps1
. C:\azure-lab\Test-NsgRule.ps1
@(
    Test-NsgRule -Nsg nsg-saat-data -Port 1433 -SourceAsg asg-app -DestAsg asg-db
    Test-NsgRule -Nsg nsg-saat-data -Port 1433 -SourceAsg asg-web -DestAsg asg-db
    Test-NsgRule -Nsg nsg-saat-data -Port 22 -SourceTag Internet -DestAsg asg-db
) | Format-Table

You should see this:

Port From     Rule                 Priority Access
---- ----     ----                 -------- ------
1433 asg-app  allow-1433-app-to-db      100 Allow
1433 asg-web  deny-vnet-inbound        4000 Deny
  22 Internet DenyAllInBound          65500 Deny

App servers reach the database; web servers can’t, because your rule 4000 catches them before the default 65000 would let them in; and nothing from the internet gets in. The leading dot in . C:\azure-lab\Test-NsgRule.ps1 loads the function into your session.

You’ll use it again in the troubleshooting phase next to Network Watcher.

✅ Checkpoint: Three NSGs are attached to snet-web, snet-app and snet-data, and Test-NsgRule gives Allow, Deny, Deny for the three tests.