How do Azure network security groups and GCP firewall rules compare with AWS security groups?
Show the answer
Say this first
All three are stateful. Azure NSGs allow and deny, use priorities 100 to 4096 (lower wins), and attach to a subnet, a NIC or both, so traffic must pass both. GCP firewall rules belong to the whole VPC, use priorities 0 to 65535, allow or deny, and target instances by network tag or service account, with an implied deny for ingress and allow for egress. AWS security groups are allow-only and per interface.
Go deeper
Azure NSG
- Custom rules use priority 100 to 4096. Default rules sit at 65000 and up: allow VNet to VNet, allow Azure Load Balancer probes inbound, allow internet outbound, then deny all.
- Service tags such as
VirtualNetwork,Internet,AzureLoadBalancerandStoragestand in for address lists Microsoft maintains. - Application security groups (ASGs) group NICs by role, so a rule says "web ASG to app ASG on 8080", close to AWS security group referencing.
- With NSGs on both subnet and NIC: inbound is checked at the subnet first, then the NIC; outbound at the NIC first, then the subnet. Both must allow.
- Watch out:
VirtualNetworkincludes peered VNets and on-prem ranges learned through a gateway, so the default allow is wider than people think.
GCP VPC firewall rules
- Defined on the VPC, applied in every region. Direction is ingress or egress.
- Priority 0 to 65535, default 1000. Implied rules at the lowest priority deny all ingress and allow all egress.
- Targets: all instances, instances with a network tag, or instances running as a service account. Service accounts are stronger because changing them needs IAM permission, while tags are editable by anyone who can edit the VM.
- Hierarchical and network firewall policies add organization-wide rules above the VPC rules.
AWS
Allow-only, per ENI, all rules evaluated, other security groups as sources. Network ACLs are the place for explicit deny.
They will ask next
An Azure VM gets health probes from 168.63.129.16. Why must you allow it?
That address is Azure's platform address used for load balancer health probes, DNS and DHCP. The default NSG rule
AllowAzureLoadBalancerInBoundcovers the probes. If you write a deny-all rule at a higher priority, the load balancer marks the VM down.How do you troubleshoot which NSG rule is blocking traffic?
Network Watcher's IP flow verify tells you allow or deny and the rule name for a given 5-tuple. Effective security rules on the NIC show the merged subnet and NIC rules.
Traps
- Saying GCP firewall rules are per subnet. They are per VPC with targets.
- Forgetting that an Azure NSG on the subnet and another on the NIC must both allow.