Forum Discussion

Redsman13's avatar
Redsman13
Copper Contributor
Jul 07, 2023

Network Security Group - Outbound Security Rules for VNET isolation

Are there any Microsoft documented recommendations for mandatory NSG Outbound Security Rules for Azure Virtual Desktop?

 

Key requirment is to ensure there is VNET to VNET isolation.

 

Thanks in advance.

  • kjones10's avatar
    kjones10
    Brass Contributor
    Jul 07, 2023
    NSGs will come baked in with default Outbound rules. Any custom rules is entirely up to the customer. If you do not want session hosts to talk to other session hosts, deploy them on separate vNETs and, ideally, separate host pools.
    • Redsman13's avatar
      Redsman13
      Copper Contributor
      Jul 07, 2023
      Hi kjones.

      So we currently have environments on seperate VNETs., host pools, etc, however the default nsg outbound security rules allows traffic outbound to any other VNET. More than likely we just need a deny rule that takes precendence over the default VNET to VNET allow.

      Thanks
      • kjones10's avatar
        kjones10
        Brass Contributor
        Jul 07, 2023
        Redsman13, thanks for the clarification! By default, vNETs cannot talk to each other unless they are peered. As long as you do not peer them together, resources on separate vNETs cannot talk to each other unless they are resources with public endpoints (ex. Storage Accounts, Azure SQL Database, etc.)

Resources