MS Guidance on NSGs on NICs vs on Subnets

kellybush Normally you will get the typical consultancy answer which is: It depends.
Joke aside. What I normally try to find is common rules the systems need. If several systems in a subnet need the same ruleset I would put the NSG on the subnet. If it is just one special system and the the rules should not apply to every other system in the same subnet the NSG goes to the NIC.
Just be careful when you want to use it on both levels, NIC and subnet (one on each NIC and a 2nd NSG on the subnet). The rules tend to accumulate on the NSG attached to the subnet because of the various requirements of the systems within the subnet. Can get a little bit messy when you have a lot of different rules for many different systems. After all a NSG is not a firewall.
I hope that helps
Cheers

Rolf

#MCT #LearnWithRolf #TheCloud42