Site icon Digital Thought Disruption

Understanding Azure SDN: Core Security Components and Best Practices

Paul Bryant

TL;DR: Quick Summary

Azure Software Defined Networking (SDN) delivers flexible, scalable, and secure virtual networking across Azure cloud and Azure Local (formerly Azure Stack HCI). This blog post explores Azure SDN’s core components—including Azure Firewall, Network Security Groups (NSGs), Application Security Groups (ASGs), service tags, and rule formatting—along with design and implementation best practices for each.

What is Azure SDN?

Azure SDN is Microsoft’s cloud-native virtual networking framework that abstracts and centrally manages networking resources. It enables:

Azure SDN powers both Azure Public Cloud and Azure Local through a consistent control plane enabled by tools like Azure Arc and Azure Network Manager.

Azure SDN Components and Definitions

Azure Firewall

Definition: A stateful, fully managed Layer 3–7 network security service that protects Azure VNets. Supports DNS filtering, FQDN rules, and threat intelligence.

Best Practices:

Application Security Groups (ASGs)

Definition: Dynamic groupings of NICs based on logical application identity. Lets you define network security rules by application tier instead of static IPs.

Best Practices:

Network Security Groups (NSGs)

Definition: A logical container of security rules that control inbound and outbound traffic at the subnet or NIC level. Operates at Layers 3 and 4.

Rule Format:

Best Practices:

NSG Rules and Format

Rule Format Example:

{
  "name": "AllowWeb",
  "properties": {
    "priority": 100,
    "direction": "Inbound",
    "access": "Allow",
    "protocol": "Tcp",
    "sourceAddressPrefix": "Internet",
    "sourcePortRange": "*",
    "destinationAddressPrefix": "10.0.0.4",
    "destinationPortRange": "80"
  }
}

Best Practices:

Service Tags

Definition: Named representations of groups of IP address prefixes managed by Microsoft. Common tags include Internet, AzureLoadBalancer, VirtualNetwork, and service-specific tags like Storage, Sql.

Best Practices:

Microsoft SDN Design Best Practices

NSGs

ASGs

Tags

Rules

NSG Rule Strategy Table

Rule GroupPriority RangePurposeExample Rule Names
App Access Rules100–199Web, app, DB-tier communicationAllowWeb, AllowAppDB
Infra Access Rules200–299Management ports (RDP, SSH, WinRM)AllowRDP, AllowSSH
Monitoring Rules300–399Log collectors, metrics, Azure agentsAllowLogAnalytics, AllowInsights
Outbound Rules400–499App/infra egress to Internet/AzureAllowWebOutbound, AllowAzureSQL
Deny Rules4000–4096Default deny allDenyAllInbound, DenyAllOutbound

Additional Best Practices

Common Misconfigurations to Avoid

Auditing and Compliance with Azure Policy

Azure Policy can help you enforce security best practices across NSGs and Firewall configurations. Use built-in policies such as:

Best Practice Tips:

NSGs:

ASGs:

Azure Firewall:

PowerShell and Bicep Examples

Create NSG + Rules (PowerShell)

$nsg = New-AzNetworkSecurityGroup -ResourceGroupName "RG-Net" -Location "eastus" -Name "AppNSG"
Add-AzNetworkSecurityRuleConfig -NetworkSecurityGroup $nsg -Name "AllowWeb" -Protocol "Tcp" -Direction "Inbound" -Priority 100 `
  -SourceAddressPrefix "Internet" -SourcePortRange "*" -DestinationAddressPrefix "*" -DestinationPortRange 80 -Access Allow
Set-AzNetworkSecurityGroup -NetworkSecurityGroup $nsg

Create ASG (PowerShell)

New-AzApplicationSecurityGroup -Name "asg-web-tier" -ResourceGroupName "RG-Net" -Location "eastus"

Bicep Template Example

resource nsg 'Microsoft.Network/networkSecurityGroups@2022-01-01' = {
  name: 'AppNSG'
  location: 'eastus'
  properties: {
    securityRules: [
      {
        name: 'AllowWeb'
        properties: {
          priority: 100
          direction: 'Inbound'
          access: 'Allow'
          protocol: 'Tcp'
          sourceAddressPrefix: 'Internet'
          destinationAddressPrefix: '*'
          destinationPortRange: '80'
          sourcePortRange: '*'
        }
      }
    ]
  }
}

resource asg 'Microsoft.Network/applicationSecurityGroups@2022-01-01' = {
  name: 'asg-web-tier'
  location: 'eastus'
}

Full Deployment Script Example

Below is a consolidated PowerShell script to deploy a VNet, subnet, NSG, ASG, and bind NSG to the subnet with sample rules:

# Variables
$location = "eastus"
$rg = "RG-SDN-Demo"
$vnetName = "DemoVNet"
$subnetName = "AppSubnet"
$nsgName = "AppNSG"
$asgName = "asg-web-tier"

# Create Resource Group
New-AzResourceGroup -Name $rg -Location $location

# Create VNet and Subnet
$vnet = New-AzVirtualNetwork -ResourceGroupName $rg -Location $location -Name $vnetName -AddressPrefix "10.0.0.0/16"
Add-AzVirtualNetworkSubnetConfig -Name $subnetName -AddressPrefix "10.0.1.0/24" -VirtualNetwork $vnet | Set-AzVirtualNetwork

# Create ASG
$asg = New-AzApplicationSecurityGroup -Name $asgName -ResourceGroupName $rg -Location $location

# Create NSG and Add Rule
$nsg = New-AzNetworkSecurityGroup -Name $nsgName -ResourceGroupName $rg -Location $location
Add-AzNetworkSecurityRuleConfig -Name "AllowHTTP" -NetworkSecurityGroup $nsg -Direction Inbound -Priority 100 -Access Allow -Protocol Tcp `
  -SourceAddressPrefix "Internet" -SourcePortRange "*" -DestinationAddressPrefix "*" -DestinationPortRange "80"
Set-AzNetworkSecurityGroup -NetworkSecurityGroup $nsg

# Associate NSG to Subnet
$vnet = Get-AzVirtualNetwork -Name $vnetName -ResourceGroupName $rg
$subnet = Get-AzVirtualNetworkSubnetConfig -Name $subnetName -VirtualNetwork $vnet
Set-AzVirtualNetworkSubnetConfig -Name $subnetName -VirtualNetwork $vnet -AddressPrefix $subnet.AddressPrefix -NetworkSecurityGroup $nsg
$vnet | Set-AzVirtualNetwork

Final Thoughts

Azure SDN is more than just virtual networking—it’s a scalable, programmable fabric designed for hybrid, modern applications. When implemented with Azure Firewall, NSGs, ASGs, and service tags, you gain security, flexibility, and automation not easily achieved with traditional networking models.

Designing your NSG, ASG, and tagging strategy early is key to minimizing risk and maximizing agility as your environment scales.

*The thoughts and opinions in this article are mine and hold no reflect on my employer*

Exit mobile version