Question

You manage an NSG named NSG1 that is associated with both a subnet and the NIC of a VM in that subnet. The subnet-level NSG has an inbound rule allowing TCP 443 from the internet at priority 200. The NIC-level NSG has an inbound rule denying TCP 443 from the internet at priority 300. A user reports that HTTPS traffic to the VM is being blocked. Using the effective security rules feature in Network Watcher, what is the reason HTTPS traffic is denied?

Accepted Answer

Inbound traffic must be allowed at both the subnet NSG and the NIC NSG; the NIC NSG deny rule blocks the traffic despite the subnet allow rule.

Answer

The subnet NSG rule at priority 200 takes precedence over the NIC NSG rule, so traffic should be allowed and the block is caused by a routing issue.

Answer

When two NSGs are associated, only the NIC NSG is evaluated, so the subnet NSG rule is ignored entirely.

Answer

The lower numeric priority (200) always wins across both NSGs, so the allow rule overrides the deny rule.