NSG on every VM

Hi @NT

We typically suggest that you setup a Network Security Group inside the shared Subnet of the Virtual Machines and set all of their base rules there. If you need additional and specialized rules for individual Virtual Machines, then you can append another Network Security Group onto the VM itself with that specialized rule. This NSG organization does not require specific setup or organization from the Resource Group, only the Subnet.

Unknowingly adding an NSG to the VM and the Subnet can cause conflict, as both of these Security Groups will collapse their rules to apply all to the Virtual Machine.

This doc on NSG setup has a nice diagram and some additional information that may help: https://video2.skills-academy.com/en-us/azure/virtual-network/network-security-group-how-it-works

HI NT-8243,

I am not a professional on this as yet but from what i have learned is that if these VM's are in the same resource group then you only need 1 NSG unless you have reason for more than one.

Believe the rule of thumb is 1 NSG per Resource group.

Hope this helps.

Hi

The following article may helpful for you to get a better understanding
https://video2.skills-academy.com/en-us/archive/blogs/igorpag/azure-network-security-groups-nsg-best-practices-and-lessons-learned