Azure / Azure/azure-powershell

Remove-AzNetworkSecurityRuleConfig ignores delete locks

Open
#8,365 7 comments 0 reactions 2 assignees Claimed by @anharazi View on GitHub
act-quality-productivity-squad bug Network - Virtual Network Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

Remove-AzNetworkSecurityRuleConfig ignores existing delete locks. This is because a PUT request is made to _management.azure.com_, which also means a read-only lock will hinder removing a security rule.

The rules are "just" part of the properties property on the NSG object, so in essence we are not deleting anything. But 99% of Azure users would not understand that before it is too late (someone deleted an important rule by accident).

Trying to delete a rule from the Azure portal will result in a failure due to the existence of a delete lock.

Ie. there is an inconsistency between how the (delete) lock works in the Azure portal and when using PowerShell.
I would assume that the management API does not check for any delete locks on PUT requests as this would be entirely context based, in current example it would then have to check if the payload removes a security rule.
I guess that the Azure portal does this for us and denies the request to delete the rule.

This is problematic. The lock may have been set at a level a given user does not have access to change, but they can still delete the "resource" because it is not an actual deletion wrt the API.

Also note that in the debug output, once a

```
Body:
{
"status": "Succeeded"
}
```

is received it makes two identical calls to
`https://management.azure.com/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01?api-version=2018-10-01`

Not sure why, but I guess that is an irrelevant detail wrt. this issue.

### Script/Steps for Reproduction

Prereqs is that there is a delete lock either on the subscription, resource group level or directly on the network security group itself. First 3 lines below must be edited to match this setup.

```powershell
$NetworkSecurityRuleName = "Port_8080"
$NetworkSecurityGroupName = "nsgsfv01"
$ResourceGroupName = "rg-sfv"

Write-Host "Verify that there is a delete lock on the NSG"
Get-AzResourceLock -ResourceGroupName $ResourceGroupName -ResourceName $NetworkSecurityGroupName -ResourceType 'Microsoft.Network/networkSecurityGroups'

$NetworkSecurityGroup = Get-AzNetworkSecurityGroup -Name $NetworkSecurityGroupName -ResourceGroupName $ResourceGroupName
# remote the rule from the NSG rule config
$NetworkSecurityRuleConfig = Remove-AzNetworkSecurityRuleConfig -Name $NetworkSecurityRuleName -NetworkSecurityGroup $NetworkSecurityGroup -ErrorAction Stop
$DebugPreference = 'Continue'
$NetworkSecurityRuleConfig | Set-AzNetworkSecurityGroup | Out-Null
$DebugPreference = 'SilentlyContinue'
```

### Module Version

```powershell

Directory: E:\OneDrive\Dokumenter\WindowsPowerShell\Modules

ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 5.4.2 InvokeBuild {Invoke-Build, Build-Checkpoint, Build-Parallel}

Directory: C:\Program Files\WindowsPowerShell\Modules

ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 1.1.0 Az.Accounts {Disable-AzDataCollection, Disable-AzContextAutosave, Enab...
Script 1.0.0 Az.Accounts {Disable-AzDataCollection, Disable-AzContextAutosave, Enab...
Script 1.0.0 Az.Aks {Get-AzAks, New-AzAks, Remove-AzAks, Import-AzAksCredentia...
Script 1.0.0 Az.AnalysisServices {Resume-AzAnalysisServicesServer, Suspend-AzAnalysisServic...
Script 1.0.0 Az.ApiManagement {Add-AzApiManagementRegion, Get-AzApiManagementSsoToken, N...
Script 1.0.0 Az.ApplicationInsights {Get-AzApplicationInsights, New-AzApplicationInsights, Rem...
Script 1.0.0 Az.Automation {Get-AzAutomationHybridWorkerGroup, Remove-AzAutomationHyb...
Script 1.0.0 Az.Batch {Remove-AzBatchAccount, Get-AzBatchAccount, Get-AzBatchAcc...
Script 1.0.0 Az.Billing {Get-AzBillingInvoice, Get-AzBillingPeriod, Get-AzEnrollme...
Script 1.0.0 Az.Cdn {Get-AzCdnProfile, Get-AzCdnProfileSsoUrl, New-AzCdnProfil...
Script 1.0.0 Az.CognitiveServices {Get-AzCognitiveServicesAccount, Get-AzCognitiveServicesAc...
Script 1.1.0 Az.Compute {Remove-AzAvailabilitySet, Get-AzAvailabilitySet, New-AzAv...
Script 1.0.0 Az.Compute {Remove-AzAvailabilitySet, Get-AzAvailabilitySet, New-AzAv...
Script 1.0.0 Az.ContainerInstance {New-AzContainerGroup, Get-AzContainerGroup, Remove-AzCont...
Script 1.0.0 Az.ContainerRegistry {New-AzContainerRegistry, Get-AzContainerRegistry, Update-...
Script 1.0.0 Az.DataFactory {Set-AzDataFactoryV2, Update-AzDataFactoryV2, Get-AzDataFa...
Script 1.0.0 Az.DataLakeAnalytics {Get-AzDataLakeAnalyticsDataSource, New-AzDataLakeAnalytic...
Script 1.0.1 Az.DataLakeStore {Get-AzDataLakeStoreTrustedIdProvider, Remove-AzDataLakeSt...
Script 1.0.0 Az.DataLakeStore {Get-AzDataLakeStoreTrustedIdProvider, Remove-AzDataLakeSt...
Script 1.0.0 Az.DevTestLabs {Get-AzDtlAllowedVMSizesPolicy, Get-AzDtlAutoShutdownPolic...
Script 1.0.0 Az.Dns {Get-AzDnsRecordSet, New-AzDnsRecordConfig, Remove-AzDnsRe...
Script 1.1.0 Az.EventGrid {New-AzEventGridTopic, Get-AzEventGridTopic, Set-AzEventGr...
Script 1.0.0 Az.EventGrid {New-AzEventGridTopic, Get-AzEventGridTopic, Set-AzEventGr...
Script 1.0.0 Az.EventHub {New-AzEventHubNamespace, Get-AzEventHubNamespace, Set-AzE...
Script 1.0.0 Az.HDInsight {Get-AzHDInsightJob, New-AzHDInsightSqoopJobDefinition, Wa...
Script 1.0.1 Az.IotHub {Add-AzIotHubKey, Get-AzIotHubEventHubConsumerGroup, Get-A...
Script 1.0.0 Az.IotHub {Add-AzIotHubKey, Get-AzIotHubEventHubConsumerGroup, Get-A...
Script 1.0.0 Az.KeyVault {Add-AzKeyVaultCertificate, Update-AzKeyVaultCertificate, ...
Script 1.1.0 Az.LogicApp {Get-AzIntegrationAccountAgreement, Get-AzIntegrationAccou...
Script 1.0.0 Az.LogicApp {Get-AzIntegrationAccountAgreement, Get-AzIntegrationAccou...
Script 1.0.0 Az.MachineLearning {Move-AzMlCommitmentAssociation, Get-AzMlCommitmentAssocia...
Script 1.0.0 Az.MarketplaceOrdering {Get-AzMarketplaceTerms, Set-AzMarketplaceTerms}
Script 1.0.0 Az.Media {Sync-AzMediaServiceStorageKeys, Set-AzMediaServiceKey, Ge...
Script 1.0.0 Az.Monitor {Get-AzMetricDefinition, Get-AzMetric, Remove-AzLogProfile...
Script 1.0.0 Az.Network {Add-AzApplicationGatewayAuthenticationCertificate, Get-Az...
Script 1.0.0 Az.NotificationHubs {Get-AzNotificationHub, Get-AzNotificationHubAuthorization...
Script 1.0.0 Az.OperationalInsights {New-AzOperationalInsightsAzureActivityLogDataSource, New-...
Script 1.0.0 Az.PolicyInsights {Get-AzPolicyEvent, Get-AzPolicyState, Get-AzPolicyStateSu...
Script 1.0.0 Az.PowerBIEmbedded {Remove-AzPowerBIWorkspaceCollection, Get-AzPowerBIWorkspa...
Script 1.0.0 Az.RecoveryServices {Get-AzRecoveryServicesBackupProperty, Get-AzRecoveryServi...
Script 1.0.0 Az.RedisCache {Remove-AzRedisCachePatchSchedule, New-AzRedisCacheSchedul...
Script 1.0.0 Az.Relay {New-AzRelayNamespace, Get-AzRelayNamespace, Set-AzRelayNa...
Script 0.7.1 Az.ResourceGraph Search-AzGraph
Script 1.1.0 Az.Resources {Get-AzProviderOperation, Remove-AzRoleAssignment, Get-AzR...
Script 1.0.0 Az.Resources {Get-AzProviderOperation, Remove-AzRoleAssignment, Get-AzR...
Script 1.0.0 Az.ServiceBus {New-AzServiceBusNamespace, Get-AzServiceBusNamespace, Set...
Script 1.0.0 Az.ServiceFabric {Add-AzServiceFabricApplicationCertificate, Add-AzServiceF...
Script 1.0.1 Az.SignalR {New-AzSignalR, Get-AzSignalR, Get-AzSignalRKey, New-AzSig...
Script 1.0.0 Az.SignalR {New-AzSignalR, Get-AzSignalR, Get-AzSignalRKey, New-AzSig...
Script 1.0.1 Az.Sql {Get-AzSqlDatabaseTransparentDataEncryption, Get-AzSqlData...
Script 1.0.0 Az.Sql {Get-AzSqlDatabaseTransparentDataEncryption, Get-AzSqlData...
Script 1.0.1 Az.Storage {Get-AzStorageAccount, Get-AzStorageAccountKey, New-AzStor...
Script 1.0.0 Az.Storage {Get-AzStorageAccount, Get-AzStorageAccountKey, New-AzStor...
Script 1.0.0 Az.StreamAnalytics {Get-AzStreamAnalyticsFunction, Get-AzStreamAnalyticsDefau...
Script 1.0.0 Az.TrafficManager {Add-AzTrafficManagerCustomHeaderToEndpoint, Remove-AzTraf...
Script 1.0.1 Az.Websites {Get-AzAppServicePlan, Set-AzAppServicePlan, New-AzAppServ...
Script 1.0.0 Az.Websites {Get-AzAppServicePlan, Set-AzAppServicePlan, New-AzAppServ...
Script 1.0.1 Microsoft.PowerShell.Operation.V... {Get-OperationValidation, Invoke-OperationValidation}
Binary 1.0.0.1 PackageManagement {Find-Package, Get-Package, Get-PackageProvider, Get-Packa...
Script 3.4.0 Pester {Describe, Context, It, Should...}
Script 0.2.0 Polaris {Get-Polaris, Clear-Polaris, New-PolarisRoute, Remove-Pola...
Script 1.0.0.1 PowerShellGet {Install-Module, Find-Module, Save-Module, Update-Module...}
Script 0.7.1 PSHTML {nav, New-PSHTMLChartPieDataSet, small, Get-PSHTMLConfigur...
Script 1.2 PSReadline {Get-PSReadlineKeyHandler, Set-PSReadlineKeyHandler, Remov...
Script 0.0.46 PSSharedGoods {Add-WinADUserGroups, Get-WinADForestControllers, Get-WinA...
Script 0.83 PSWriteColor {Write-Color, Write-ColorDev}
Script 0.0.0.2 ReportHTMLHelpers {Get-HostUptime, Test-AzureRMAccountTokenExpiry, Connect-A...

Directory: C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules

ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Manifest 1.0.0.0 AppBackgroundTask {Disable-AppBackgroundTaskDiagnosticLog, Enable-AppBackgro...
Manifest 2.0.0.0 Appx {Add-AppxPackage, Get-AppxPackage, Get-AppxPackageManifest...
Manifest 1.0.0.0 BitLocker {Unlock-BitLocker, Suspend-BitLocker, Resume-BitLocker, Re...
Manifest 2.0.0.0 BitsTransfer {Add-BitsFile, Complete-BitsTransfer, Get-BitsTransfer, Re...
Manifest 1.0.0.0 CimCmdlets {Get-CimAssociatedInstance, Get-CimClass, Get-CimInstance,...
Manifest 1.0 Defender {Get-MpPreference, Set-MpPreference, Add-MpPreference, Rem...
Manifest 1.0.0.0 DeliveryOptimization {Get-DeliveryOptimizationStatus, Get-DeliveryOptimizationP...
Manifest 1.0.0.0 DirectAccessClientComponents {Disable-DAManualEntryPointSelection, Enable-DAManualEntry...
Script 3.0 Dism {Add-AppxProvisionedPackage, Add-WindowsDriver, Add-Window...
Manifest 1.0.0.0 DnsClient {Resolve-DnsName, Clear-DnsClientCache, Get-DnsClient, Get...
Manifest 1.0.0.0 EventTracingManagement {Start-EtwTraceSession, New-EtwTraceSession, Get-EtwTraceS...
Manifest 2.0.0.0 International {Get-WinDefaultInputMethodOverride, Set-WinDefaultInputMet...
Manifest 1.0.0.0 iSCSI {Get-IscsiTargetPortal, New-IscsiTargetPortal, Remove-Iscs...
Script 1.0.0.0 ISE {New-IseSnippet, Import-IseSnippet, Get-IseSnippet}
Manifest 1.0.0.0 Kds {Add-KdsRootKey, Get-KdsRootKey, Test-KdsRootKey, Set-KdsC...
Manifest 1.0.1.0 Microsoft.PowerShell.Archive {Compress-Archive, Expand-Archive}
Manifest 3.0.0.0 Microsoft.PowerShell.Diagnostics {Get-WinEvent, Get-Counter, Import-Counter, Export-Counter...
Manifest 3.0.0.0 Microsoft.PowerShell.Host {Start-Transcript, Stop-Transcript}
Manifest 1.0.0.0 Microsoft.PowerShell.LocalAccounts {Add-LocalGroupMember, Disable-LocalUser, Enable-LocalUser...
Manifest 3.1.0.0 Microsoft.PowerShell.Management {Add-Content, Clear-Content, Clear-ItemProperty, Join-Path...
Script 1.0 Microsoft.PowerShell.ODataUtils Export-ODataEndpointProxy
Manifest 3.0.0.0 Microsoft.PowerShell.Security {Get-Acl, Set-Acl, Get-PfxCertificate, Get-Credential...}
Manifest 3.1.0.0 Microsoft.PowerShell.Utility {Format-List, Format-Custom, Format-Table, Format-Wide...}
Manifest 3.0.0.0 Microsoft.WSMan.Management {Disable-WSManCredSSP, Enable-WSManCredSSP, Get-WSManCredS...
Manifest 1.0 MMAgent {Disable-MMAgent, Enable-MMAgent, Set-MMAgent, Get-MMAgent...
Manifest 1.0.0.0 MsDtc {New-DtcDiagnosticTransaction, Complete-DtcDiagnosticTrans...
Manifest 2.0.0.0 NetAdapter {Disable-NetAdapter, Disable-NetAdapterBinding, Disable-Ne...
Manifest 1.0.0.0 NetConnection {Get-NetConnectionProfile, Set-NetConnectionProfile}
Manifest 1.0.0.0 NetDiagnostics Get-NetView
Manifest 1.0.0.0 NetEventPacketCapture {New-NetEventSession, Remove-NetEventSession, Get-NetEvent...
Manifest 2.0.0.0 NetLbfo {Add-NetLbfoTeamMember, Add-NetLbfoTeamNic, Get-NetLbfoTea...
Manifest 1.0.0.0 NetNat {Get-NetNat, Get-NetNatExternalAddress, Get-NetNatStaticMa...
Manifest 2.0.0.0 NetQos {Get-NetQosPolicy, Set-NetQosPolicy, Remove-NetQosPolicy, ...
Manifest 2.0.0.0 NetSecurity {Get-DAPolicyChange, New-NetIPsecAuthProposal, New-NetIPse...
Manifest 1.0.0.0 NetSwitchTeam {New-NetSwitchTeam, Remove-NetSwitchTeam, Get-NetSwitchTea...
Manifest 1.0.0.0 NetTCPIP {Get-NetIPAddress, Get-NetIPInterface, Get-NetIPv4Protocol...
Manifest 1.0.0.0 NetworkConnectivityStatus {Get-DAConnectionStatus, Get-NCSIPolicyConfiguration, Rese...
Manifest 1.0.0.0 NetworkSwitchManager {Disable-NetworkSwitchEthernetPort, Enable-NetworkSwitchEt...
Manifest 1.0.0.0 NetworkTransition {Add-NetIPHttpsCertBinding, Disable-NetDnsTransitionConfig...
Manifest 1.0.0.0 PcsvDevice {Get-PcsvDevice, Start-PcsvDevice, Stop-PcsvDevice, Restar...
Binary 1.0.0.0 PersistentMemory {Get-PmemDisk, Get-PmemPhysicalDevice, Get-PmemUnusedRegio...
Manifest 1.0.0.0 PKI {Add-CertificateEnrollmentPolicyServer, Export-Certificate...
Manifest 1.0.0.0 PnpDevice {Get-PnpDevice, Get-PnpDeviceProperty, Enable-PnpDevice, D...
Manifest 1.1 PrintManagement {Add-Printer, Add-PrinterDriver, Add-PrinterPort, Get-Prin...
Binary 1.0.11 ProcessMitigations {Get-ProcessMitigation, Set-ProcessMitigation, ConvertTo-P...
Script 3.0 Provisioning {Install-ProvisioningPackage, Export-ProvisioningPackage, ...
Manifest 1.1 PSDesiredStateConfiguration {Set-DscLocalConfigurationManager, Start-DscConfiguration,...
Script 1.0.0.0 PSDiagnostics {Disable-PSTrace, Disable-PSWSManCombinedTrace, Disable-WS...
Binary 1.1.0.0 PSScheduledJob {New-JobTrigger, Add-JobTrigger, Remove-JobTrigger, Get-Jo...
Manifest 2.0.0.0 PSWorkflow {New-PSWorkflowExecutionOption, New-PSWorkflowSession, nwsn}
Manifest 1.0.0.0 PSWorkflowUtility Invoke-AsWorkflow
Manifest 1.0.0.0 ScheduledTasks {Get-ScheduledTask, Set-ScheduledTask, Register-ScheduledT...
Manifest 2.0.0.0 SecureBoot {Confirm-SecureBootUEFI, Set-SecureBootUEFI, Get-SecureBoo...
Manifest 2.0.0.0 SmbShare {Get-SmbShare, Remove-SmbShare, Set-SmbShare, Block-SmbSha...
Manifest 2.0.0.0 SmbWitness {Get-SmbWitnessClient, Move-SmbWitnessClient, gsmbw, msmbw...
Manifest 1.0.0.0 StartLayout {Export-StartLayout, Import-StartLayout, Export-StartLayou...
Manifest 2.0.0.0 Storage {Add-InitiatorIdToMaskingSet, Add-PartitionAccessPath, Add...
Manifest 2.0.0.0 TLS {New-TlsSessionTicketKey, Enable-TlsSessionTicketKey, Disa...
Manifest 1.0.0.0 TroubleshootingPack {Get-TroubleshootingPack, Invoke-TroubleshootingPack}
Manifest 2.0.0.0 TrustedPlatformModule {Get-Tpm, Initialize-Tpm, Clear-Tpm, Unblock-Tpm...}
Manifest 2.0.0.0 VpnClient {Add-VpnConnection, Set-VpnConnection, Remove-VpnConnectio...
Manifest 1.0.0.0 Wdac {Get-OdbcDriver, Set-OdbcDriver, Get-OdbcDsn, Add-OdbcDsn...}
Manifest 1.0.0.0 WindowsDeveloperLicense {Get-WindowsDeveloperLicense, Unregister-WindowsDeveloperL...
Script 1.0 WindowsErrorReporting {Enable-WindowsErrorReporting, Disable-WindowsErrorReporti...
Manifest 1.0.0.0 WindowsSearch {Get-WindowsSearchSetting, Set-WindowsSearchSetting}
Manifest 1.0.0.0 WindowsUpdate Get-WindowsUpdateLog
Manifest 1.0.0.2 WindowsUpdateProvider {Get-WUAVersion, Get-WULastInstallationDate, Get-WULastSca...

Directory: C:\Program Files (x86)\Microsoft SQL Server\140\Tools\PowerShell\Modules

ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Manifest 14.0 SQLPS {Backup-SqlDatabase, Save-SqlMigrationReport, Add-SqlAvail...

```

### Environment Data

```powershell

Name Value
---- -----
PSVersion 5.1.17134.407
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.17134.407
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

```

### Debug Output

```

Transcript started, output file is C:\Users\spael\AppData\Local\Temp\transscript\131925472698603486
Verify that there is a delete lock on the NSG

Name : delete
ResourceId : /subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Authorization/locks/delete
ResourceName : delete
ResourceType : Microsoft.Authorization/locks
ResourceGroupName : rg-sfv
SubscriptionId : b9334351-cec8-405d-8358-51846fa2a3ab
Properties : @{level=CanNotDelete; notes=}
LockId : /subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Authorization/locks/delete

Name : nsglock
ResourceId : /subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/providers/Microsoft.Authorization/locks/nsglock
ResourceName : nsgsfv01
ResourceType : Microsoft.Network/networkSecurityGroups
ExtensionResourceName : nsglock
ExtensionResourceType : Microsoft.Authorization/locks
ResourceGroupName : rg-sfv
SubscriptionId : b9334351-cec8-405d-8358-51846fa2a3ab
Properties : @{level=CanNotDelete; notes=}
LockId : /subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/providers/Microsoft.Authorization/locks/nsglock

DEBUG: 1:27:57 PM - SetAzureNetworkSecurityGroupCommand begin processing with ParameterSet '__AllParameterSets'.
DEBUG: 1:27:57 PM - using account id 'asp@venzo.com'...
DEBUG: [Common.Authentication]: Authenticating using Account: 'asp@venzo.com', environment: 'AzureCloud', tenant: 'b9a44c5c-ec32-467d-8c4b-534b3f2ea9db'
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01?api-version=2018-10-01

Headers:
x-ms-client-request-id : 7c2c6923-85c7-4b04-aaaf-00973a231997
accept-language : en-US

Body:
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Pragma : no-cache
x-ms-request-id : 5bed2026-94a8-42a9-b992-042e911d6e6a
x-ms-correlation-request-id : bbf025eb-949b-4414-88e5-33b70153a8c2
Strict-Transport-Security : max-age=31536000; includeSubDomains
Cache-Control : no-cache
ETag : W/"cedd19a4-7fd1-4c08-b9d9-cae7d5602269"
Server : Microsoft-HTTPAPI/2.0,Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-reads: 11980
x-ms-routing-request-id : CANADAEAST:20190121T122756Z:bbf025eb-949b-4414-88e5-33b70153a8c2
X-Content-Type-Options : nosniff
Date : Mon, 21 Jan 2019 12:27:56 GMT

Body:
{
"name": "nsgsfv01",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"type": "Microsoft.Network/networkSecurityGroups",
"location": "northeurope",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "b2328498-3d7d-4374-bb98-c7c58c01ed69",
"securityRules": [
{
"name": "AllowSubnetInbound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/securityRules/AllowSubnetInbound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"properties": {
"provisioningState": "Succeeded",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "10.2.0.0/24",
"destinationAddressPrefix": "10.2.0.0/24",
"access": "Allow",
"priority": 110,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowSubnetOutbound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/securityRules/AllowSubnetOutbound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"properties": {
"provisioningState": "Succeeded",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "10.2.0.0/24",
"destinationAddressPrefix": "10.2.0.0/24",
"access": "Allow",
"priority": 110,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "Port_8080",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/securityRules/Port_8080",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"properties": {
"provisioningState": "Succeeded",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "8080",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 120,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
],
"defaultSecurityRules": [
{
"name": "AllowVnetInBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowVnetInBound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Allow inbound traffic from all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"destinationAddressPrefix": "VirtualNetwork",
"access": "Allow",
"priority": 65000,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowAzureLoadBalancerInBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowAzureLoadBalancerInBound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Allow inbound traffic from azure load balancer",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "AzureLoadBalancer",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 65001,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "DenyAllInBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/DenyAllInBound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Deny all inbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 65500,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowVnetOutBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowVnetOutBound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Allow outbound traffic from all VMs to all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"destinationAddressPrefix": "VirtualNetwork",
"access": "Allow",
"priority": 65000,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowInternetOutBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowInternetOutBound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Allow outbound traffic from all VMs to Internet",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "Internet",
"access": "Allow",
"priority": 65001,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "DenyAllOutBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/DenyAllOutBound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Deny all outbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 65500,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
],
"subnets": [
{
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/virtualNetworks/vnet-sfv/subnets/default"
}
]
}
}
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
PUT

Absolute Uri:
https://management.azure.com/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01?api-version=2018-10-01

Headers:
x-ms-client-request-id : 297d9a52-6e2a-4afa-bab1-3fb3c3fbf228
accept-language : en-US

Body:
{
"properties": {
"securityRules": [
{
"properties": {
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "10.2.0.0/24",
"sourceAddressPrefixes": [],
"destinationAddressPrefix": "10.2.0.0/24",
"destinationAddressPrefixes": [],
"sourcePortRanges": [],
"destinationPortRanges": [],
"access": "Allow",
"priority": 110,
"direction": "Inbound",
"provisioningState": "Succeeded"
},
"name": "AllowSubnetInbound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/securityRules/AllowSubnetInbound"
},
{
"properties": {
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "10.2.0.0/24",
"sourceAddressPrefixes": [],
"destinationAddressPrefix": "10.2.0.0/24",
"destinationAddressPrefixes": [],
"sourcePortRanges": [],
"destinationPortRanges": [],
"access": "Allow",
"priority": 110,
"direction": "Outbound",
"provisioningState": "Succeeded"
},
"name": "AllowSubnetOutbound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/securityRules/AllowSubnetOutbound"
}
],
"defaultSecurityRules": [
{
"properties": {
"description": "Allow inbound traffic from all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"sourceAddressPrefixes": [],
"destinationAddressPrefix": "VirtualNetwork",
"destinationAddressPrefixes": [],
"sourcePortRanges": [],
"destinationPortRanges": [],
"access": "Allow",
"priority": 65000,
"direction": "Inbound",
"provisioningState": "Succeeded"
},
"name": "AllowVnetInBound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowVnetInBound"
},
{
"properties": {
"description": "Allow inbound traffic from azure load balancer",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "AzureLoadBalancer",
"sourceAddressPrefixes": [],
"destinationAddressPrefix": "*",
"destinationAddressPrefixes": [],
"sourcePortRanges": [],
"destinationPortRanges": [],
"access": "Allow",
"priority": 65001,
"direction": "Inbound",
"provisioningState": "Succeeded"
},
"name": "AllowAzureLoadBalancerInBound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowAzureLoadBalancerInBound"
},
{
"properties": {
"description": "Deny all inbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"sourceAddressPrefixes": [],
"destinationAddressPrefix": "*",
"destinationAddressPrefixes": [],
"sourcePortRanges": [],
"destinationPortRanges": [],
"access": "Deny",
"priority": 65500,
"direction": "Inbound",
"provisioningState": "Succeeded"
},
"name": "DenyAllInBound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/DenyAllInBound"
},
{
"properties": {
"description": "Allow outbound traffic from all VMs to all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"sourceAddressPrefixes": [],
"destinationAddressPrefix": "VirtualNetwork",
"destinationAddressPrefixes": [],
"sourcePortRanges": [],
"destinationPortRanges": [],
"access": "Allow",
"priority": 65000,
"direction": "Outbound",
"provisioningState": "Succeeded"
},
"name": "AllowVnetOutBound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowVnetOutBound"
},
{
"properties": {
"description": "Allow outbound traffic from all VMs to Internet",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"sourceAddressPrefixes": [],
"destinationAddressPrefix": "Internet",
"destinationAddressPrefixes": [],
"sourcePortRanges": [],
"destinationPortRanges": [],
"access": "Allow",
"priority": 65001,
"direction": "Outbound",
"provisioningState": "Succeeded"
},
"name": "AllowInternetOutBound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowInternetOutBound"
},
{
"properties": {
"description": "Deny all outbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"sourceAddressPrefixes": [],
"destinationAddressPrefix": "*",
"destinationAddressPrefixes": [],
"sourcePortRanges": [],
"destinationPortRanges": [],
"access": "Deny",
"priority": 65500,
"direction": "Outbound",
"provisioningState": "Succeeded"
},
"name": "DenyAllOutBound",
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/DenyAllOutBound"
}
],
"resourceGuid": "b2328498-3d7d-4374-bb98-c7c58c01ed69",
"provisioningState": "Succeeded"
},
"etag": "W/\"cedd19a4-7fd1-4c08-b9d9-cae7d5602269\"",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01",
"location": "northeurope"
}
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Pragma : no-cache
Retry-After : 3
x-ms-request-id : ca4cf590-8486-4918-8059-e56d2a0e9ad2
Azure-AsyncOperation : https://management.azure.com/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/providers/Microsoft.Network/locations/northeurope/operations/ca4cf590-8486-4918-8059-e56d2a0e9ad2?api-version=2018-10-01
x-ms-correlation-request-id : 6e656bd5-f8dc-4779-9b5f-2e2f088fff79
Strict-Transport-Security : max-age=31536000; includeSubDomains
Cache-Control : no-cache
Server : Microsoft-HTTPAPI/2.0,Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-writes: 1196
x-ms-routing-request-id : CANADAEAST:20190121T122757Z:6e656bd5-f8dc-4779-9b5f-2e2f088fff79
X-Content-Type-Options : nosniff
Date : Mon, 21 Jan 2019 12:27:57 GMT

Body:
{
"name": "nsgsfv01",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01",
"etag": "W/\"2c902a2a-b991-47d9-b80a-9eed06c3b4b9\"",
"type": "Microsoft.Network/networkSecurityGroups",
"location": "northeurope",
"properties": {
"provisioningState": "Updating",
"resourceGuid": "b2328498-3d7d-4374-bb98-c7c58c01ed69",
"securityRules": [
{
"name": "AllowSubnetInbound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/securityRules/AllowSubnetInbound",
"etag": "W/\"2c902a2a-b991-47d9-b80a-9eed06c3b4b9\"",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"properties": {
"provisioningState": "Updating",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "10.2.0.0/24",
"destinationAddressPrefix": "10.2.0.0/24",
"access": "Allow",
"priority": 110,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowSubnetOutbound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/securityRules/AllowSubnetOutbound",
"etag": "W/\"2c902a2a-b991-47d9-b80a-9eed06c3b4b9\"",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"properties": {
"provisioningState": "Updating",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "10.2.0.0/24",
"destinationAddressPrefix": "10.2.0.0/24",
"access": "Allow",
"priority": 110,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
],
"defaultSecurityRules": [
{
"name": "AllowVnetInBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowVnetInBound",
"etag": "W/\"2c902a2a-b991-47d9-b80a-9eed06c3b4b9\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Allow inbound traffic from all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"destinationAddressPrefix": "VirtualNetwork",
"access": "Allow",
"priority": 65000,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowAzureLoadBalancerInBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowAzureLoadBalancerInBound",
"etag": "W/\"2c902a2a-b991-47d9-b80a-9eed06c3b4b9\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Allow inbound traffic from azure load balancer",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "AzureLoadBalancer",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 65001,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "DenyAllInBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/DenyAllInBound",
"etag": "W/\"2c902a2a-b991-47d9-b80a-9eed06c3b4b9\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Deny all inbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 65500,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowVnetOutBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowVnetOutBound",
"etag": "W/\"2c902a2a-b991-47d9-b80a-9eed06c3b4b9\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Allow outbound traffic from all VMs to all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"destinationAddressPrefix": "VirtualNetwork",
"access": "Allow",
"priority": 65000,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowInternetOutBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowInternetOutBound",
"etag": "W/\"2c902a2a-b991-47d9-b80a-9eed06c3b4b9\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Allow outbound traffic from all VMs to Internet",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "Internet",
"access": "Allow",
"priority": 65001,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "DenyAllOutBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/DenyAllOutBound",
"etag": "W/\"2c902a2a-b991-47d9-b80a-9eed06c3b4b9\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Updating",
"description": "Deny all outbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 65500,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
],
"subnets": [
{
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/virtualNetworks/vnet-sfv/subnets/default"
}
]
}
}
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/providers/Microsoft.Network/locations/northeurope/operations/ca4cf590-8486-4918-8059-e56d2a0e9ad2?api-version=2018-10-01

Headers:

Body:
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Pragma : no-cache
x-ms-request-id : 8dc0cdda-e166-4771-b14a-0af66360f77e
x-ms-correlation-request-id : 325121f7-36e2-46bc-a25c-f403883818ba
Strict-Transport-Security : max-age=31536000; includeSubDomains
Cache-Control : no-cache
Server : Microsoft-HTTPAPI/2.0,Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-reads: 11979
x-ms-routing-request-id : CANADAEAST:20190121T122801Z:325121f7-36e2-46bc-a25c-f403883818ba
X-Content-Type-Options : nosniff
Date : Mon, 21 Jan 2019 12:28:00 GMT

Body:
{
"status": "Succeeded"
}
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01?api-version=2018-10-01

Headers:

Body:
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Pragma : no-cache
x-ms-request-id : a1e97d59-79e2-45fc-b84f-999ce8a1002d
x-ms-correlation-request-id : dc2fb332-18fb-4ae6-843b-d0fdca317770
Strict-Transport-Security : max-age=31536000; includeSubDomains
Cache-Control : no-cache
ETag : W/"93d00b2a-9c69-4e1c-9e72-549b448ab800"
Server : Microsoft-HTTPAPI/2.0,Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-reads: 11978
x-ms-routing-request-id : CANADAEAST:20190121T122801Z:dc2fb332-18fb-4ae6-843b-d0fdca317770
X-Content-Type-Options : nosniff
Date : Mon, 21 Jan 2019 12:28:01 GMT

Body:
{
"name": "nsgsfv01",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups",
"location": "northeurope",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "b2328498-3d7d-4374-bb98-c7c58c01ed69",
"securityRules": [
{
"name": "AllowSubnetInbound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/securityRules/AllowSubnetInbound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"properties": {
"provisioningState": "Succeeded",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "10.2.0.0/24",
"destinationAddressPrefix": "10.2.0.0/24",
"access": "Allow",
"priority": 110,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowSubnetOutbound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/securityRules/AllowSubnetOutbound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"properties": {
"provisioningState": "Succeeded",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "10.2.0.0/24",
"destinationAddressPrefix": "10.2.0.0/24",
"access": "Allow",
"priority": 110,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
],
"defaultSecurityRules": [
{
"name": "AllowVnetInBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowVnetInBound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Allow inbound traffic from all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"destinationAddressPrefix": "VirtualNetwork",
"access": "Allow",
"priority": 65000,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowAzureLoadBalancerInBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowAzureLoadBalancerInBound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Allow inbound traffic from azure load balancer",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "AzureLoadBalancer",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 65001,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "DenyAllInBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/DenyAllInBound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Deny all inbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 65500,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowVnetOutBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowVnetOutBound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Allow outbound traffic from all VMs to all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"destinationAddressPrefix": "VirtualNetwork",
"access": "Allow",
"priority": 65000,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowInternetOutBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowInternetOutBound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Allow outbound traffic from all VMs to Internet",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "Internet",
"access": "Allow",
"priority": 65001,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "DenyAllOutBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/DenyAllOutBound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Deny all outbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 65500,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
],
"subnets": [
{
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/virtualNetworks/vnet-sfv/subnets/default"
}
]
}
}
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01?api-version=2018-10-01

Headers:
x-ms-client-request-id : 3ff02cdf-d9df-4335-ae9c-79bc6da5113c
accept-language : en-US

Body:
DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Pragma : no-cache
x-ms-request-id : be679b72-3def-4d55-9b52-16acef22807a
x-ms-correlation-request-id : b603399c-0516-44b1-a5f8-84602fd1a098
Strict-Transport-Security : max-age=31536000; includeSubDomains
Cache-Control : no-cache
ETag : W/"93d00b2a-9c69-4e1c-9e72-549b448ab800"
Server : Microsoft-HTTPAPI/2.0,Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-reads: 11977
x-ms-routing-request-id : CANADAEAST:20190121T122801Z:b603399c-0516-44b1-a5f8-84602fd1a098
X-Content-Type-Options : nosniff
Date : Mon, 21 Jan 2019 12:28:01 GMT

Body:
{
"name": "nsgsfv01",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups",
"location": "northeurope",
"properties": {
"provisioningState": "Succeeded",
"resourceGuid": "b2328498-3d7d-4374-bb98-c7c58c01ed69",
"securityRules": [
{
"name": "AllowSubnetInbound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/securityRules/AllowSubnetInbound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"properties": {
"provisioningState": "Succeeded",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "10.2.0.0/24",
"destinationAddressPrefix": "10.2.0.0/24",
"access": "Allow",
"priority": 110,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowSubnetOutbound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/securityRules/AllowSubnetOutbound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/securityRules",
"properties": {
"provisioningState": "Succeeded",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "10.2.0.0/24",
"destinationAddressPrefix": "10.2.0.0/24",
"access": "Allow",
"priority": 110,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
],
"defaultSecurityRules": [
{
"name": "AllowVnetInBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowVnetInBound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Allow inbound traffic from all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"destinationAddressPrefix": "VirtualNetwork",
"access": "Allow",
"priority": 65000,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowAzureLoadBalancerInBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowAzureLoadBalancerInBound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Allow inbound traffic from azure load balancer",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "AzureLoadBalancer",
"destinationAddressPrefix": "*",
"access": "Allow",
"priority": 65001,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "DenyAllInBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/DenyAllInBound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Deny all inbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 65500,
"direction": "Inbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowVnetOutBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowVnetOutBound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Allow outbound traffic from all VMs to all VMs in VNET",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "VirtualNetwork",
"destinationAddressPrefix": "VirtualNetwork",
"access": "Allow",
"priority": 65000,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "AllowInternetOutBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/AllowInternetOutBound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Allow outbound traffic from all VMs to Internet",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "Internet",
"access": "Allow",
"priority": 65001,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
},
{
"name": "DenyAllOutBound",
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/networkSecurityGroups/nsgsfv01/defaultSecurityRules/DenyAllOutBound",
"etag": "W/\"93d00b2a-9c69-4e1c-9e72-549b448ab800\"",
"type": "Microsoft.Network/networkSecurityGroups/defaultSecurityRules",
"properties": {
"provisioningState": "Succeeded",
"description": "Deny all outbound traffic",
"protocol": "*",
"sourcePortRange": "*",
"destinationPortRange": "*",
"sourceAddressPrefix": "*",
"destinationAddressPrefix": "*",
"access": "Deny",
"priority": 65500,
"direction": "Outbound",
"sourcePortRanges": [],
"destinationPortRanges": [],
"sourceAddressPrefixes": [],
"destinationAddressPrefixes": []
}
}
],
"subnets": [
{
"id": "/subscriptions/b9334351-cec8-405d-8358-51846fa2a3ab/resourceGroups/rg-sfv/providers/Microsoft.Network/virtualNetworks/vnet-sfv/subnets/default"
}
]
}
}
DEBUG: AzureQoSEvent: CommandName - Set-AzNetworkSecurityGroup; IsSuccess - True; Duration - 00:00:06.0590686; Exception - ;
DEBUG: Finish sending metric.
DEBUG: 1:28:03 PM - SetAzureNetworkSecurityGroupCommand end processing.
DEBUG: 1:28:03 PM - SetAzureNetworkSecurityGroupCommand end processing.
**********************
Windows PowerShell transcript end
End time: 20190121132803
**********************

```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.