Understanding Default Network Security Group Rules for Horizon Edge and Unified Access Gateway Deployed in Microsoft Azure

Using Horizon Cloud to create a Horizon Edge and Unified Access Gateway in your Microsoft Azure subscription creates several default network security groups. These security groups are visible when you log in to the Microsoft Azure portal and must remain as supplied.

As part of deploying the Horizon Edge and Unified Access Gateway in Microsoft Azure, an automated deployment process creates a set of network security groups (NSGs) and associates each NSG with specific individual network interfaces (NICs) on each of our controlled Horizon Edge and Unified Access Gateway virtual machines (VMs). Such Edge and UAG-related VMs are the edge gateway's VMs and the VMs that are deployed when the edge is configured with Unified Access Gateway.

Overall Introduction

In Horizon Cloud, the edge deployer associates the appropriate deployer-created NSG with the appropriate NIC, according to the design and architecture for the edge. These NSGs are used at a NIC level to ensure that each NIC on a particular managed appliance can receive the traffic that managed appliance is supposed to receive for standard service and edge operations over the NIC's attached subnet, and to block all traffic that appliance is not supposed to receive. Each NSG contains a set of security rules that define the allowed traffic to and from each NIC.

The deployer-created NSGs described here are separate from the ones used for the base VMs, farms, and VDI desktops that are provisioned by the edge when you create them using the Horizon Universal Console.

Note: The deployer-created NSG rules described here are configuration requirements of the service. Do not delete or edit any of the Horizon Cloud NSGs that are automatically created and associated with the edge VMs' NICs.

The NSGs created by Horizon Cloud and the rules inside of them are specific to the particular NICs and VMs to which they are attached, and are expressly for the purposes of those NICs and VMs. Any change to those NSGs or rules, or any attempt to use them for any other purpose — even on the same subnets to which those NICs are attached — will most likely result in disrupting the required network traffic to and from the NICs to which they are attached. That disruption in turn could result in disrupting all edge operations. The lifecycle of these NSGs is managed by Horizon Cloud, and there are specific reasons for each one.

Because these deployer-created NSGs are configuration requirements of the service, attempts to change them or move them are considered an unsupported use of Horizon Cloud and a misuse of the service offerings.

However, you can create your own NSGs containing your own organization's rules within resource groups outside of the edge's resource groups that are auto-created and managed by Horizon Cloud for the edge's VMs. The rules in your own NSGs must not conflict with the Horizon Cloud service's requirements for the management and operations of the edge's VMs. Such NSGs should be attached to the management, tenant, and DMZ subnets used by the edge. Creating your own NSGs within the resource groups managed by Horizon Cloud will cause failure during deletion actions on the Horizon Cloud managed resource groups if your NSGs in those resource groups are associated with a resource that resides in a different resource group.

As described in the Microsoft Azure documentation, the purpose of a network security group (NSG) is to filter network traffic to and from resources in your Microsoft Azure environment using security rules. Each rule has a set of properties such as source, destination, port, protocol, and so on that determine the traffic allowed for the resources to which the NSG is associated. The NSGs that Horizon Cloud automatically creates and associates with the controlled edge VMs' NICs contain particular rules which Horizon Cloud has determined are needed for the service's management of the edge, for proper running of ongoing edge operations, and for managing the edge's lifecycle. Generally speaking, each rule defined in these NSGs is intended to provide for the edge operations' port traffic that is part and parcel of the service's fulfillment of the standard business purposes of a Horizon Cloud subscription, such as the VDI use cases of delivering virtual desktops to end users. For related information, see Port and Protocol Requirements for Deploying Horizon 8 Edge.

The sections below list the NSG rules that Horizon Cloud defines in those deployer-created NSGs.

General Facts About Deployer-created NSG

This list applies to all of the deployer-created NSGs that the deployer associates with specific NICs on the edge-related VMs.

These automatically created NSGs are for the security of the controlled software appliances. When new software is added to your subscription and additional rules are required, those new rules are added to these NSGs.
For Unified Access Gateway in the Microsoft Azure portal, the NSGs have names that contain the pattern hcs-UUID, where UUID is the edge's identifier, except for the NSGs that are for an external gateway configuration that is deployed into its own VNet. In that case, the gateway's relevant NSGs have names that contain the pattern hcs-ID, where ID is the deployment ID for that external gateway.

Note: For the scenario where the external gateway configuration is deployed into a separate subscription using the option to deploy into an existing resource group that you pre-created in that subscription, the NSG on the gateway connector's VM's management NIC is named in a pattern based on the resource group's name instead of the hcs-UUID pattern. As an example, if you named that resource group hcsgateways, then in that resource group, Horizon Cloud creates an NSG named hcsgateways-mgmt-nsg, and associates that NSG with the gateway connector VM's management NIC.

For Horizon Edge Gateway, the NSG has the naming pattern aks-agentpool-ID-nsg, where ID is a random number added by Microsoft Azure and the NSG is part of the resource group with the naming pattern hcs-UUID-edge-aks-node, where UUID is the edge identifier.

You can locate these identifiers by navigating to the edge's details from the administrative console's Capacity page.

Note: When you choose to have the edge's external Unified Access Gateway use a custom resource group, the name of the gateway connector VM's deployer-created NSG contains the name of that custom resource group instead of the pattern hcs-ID. As an example, if you specify using a custom resource group named ourhcspodgateway for your edge's external gateway, the NSG that the deployer creates and associates with the gateway VM's NIC are named ourhcspodgateway-mgmt-nsg.
The NSGs are located in the same resource group as the VMs and NICs to which they are associated. As an example, the NSGs associated with the NICs on the external Unified Access Gateway VMs are located in the resource group named hcs-UUID-uag when the external gateway is deployed in the edge's VNet and using a deployer-created resource group.
Horizon Cloud might add new rules or modify these rules as appropriate for ensuring maintainability of the service.
During an edge update, the NSGs and rules will be retained. They will not be deleted.
The Horizon Cloud rules start at priority 1000, and the priorities go up in increments that are 100 typically. The Horizon Cloud rules end with a rule at priority 3000.
The AllowAzureInBound rules for source IP address 168.63.129.16 provide for the NSGs accepting incoming communication from the Microsoft Azure platform, as described in the Microsoft Azure documentation topic What is IP address 168.63.129.16. All of the edge-related VMs are VMs in Microsoft Azure. As described in that Microsoft Azure documentation topic, their IP address 168.63.129.16 facilitates various VM management tasks that the Microsoft Azure cloud platform does for all VMs in their cloud. As an example, this IP address facilitates having the VM Agent that is within the VM to communicate with the Microsoft Azure platform to signal that the VM is in a Ready state.
Microsoft Azure creates some default rules automatically in each NSG when it is created. In every NSG that is created, Microsoft Azure creates some inbound and outbound rules at priority 65000 and higher. Such Microsoft Azure default rules are not described in this documentation topic, because they are created by Microsoft Azure automatically. For details on those default rules, see the Microsoft Azure documentation topic Default security rules.
Each rule defined in these NSGs is intended to provide for the edge operations' port traffic that is part and parcel of the service's fulfillment of the standard business purposes of a Horizon Cloud subscription, such as the VDI use cases of delivering virtual desktops to end users. For related information, see Port and Protocol Requirements for Deploying Horizon 8 Edge.
When you edit your edge to specify additional tenant subnets for use with farms and VDI desktop assignments, the rules in the tenant-subnet-related NSGs on the edge gateway VMs' and Unified Access Gateway VMs' NICs are updated to include those additional tenant subnets.

Edge Gateway AKS Deployer-created NSGs

The Edge Gateway AKS has a virtual machine (VM) scale set in which each virtual machine instance will have one NIC connected to the management subnet. Microsoft Azure automatically creates a specific NSG and associates it with all of the NICs that are associated to the VM scale set instances.

For the Edge Gateway VM type, we are currently not creating any NSGs.

In your Microsoft Azure environment, the Edge AKS NSG resides in the edge's AKS node resource group, which is named in the pattern hcs-UUID-edge-aks-node.

The NSG is named in the pattern aks-agentpool-ID-nsg, where ID is a random number that is assigned by Microsoft Azure.

As stated earlier, Microsoft Azure creates the rules shown in the following tables by default, as described in the Microsoft Azure documentation topic Default security rules.

Deployer-created NSG Rules on the Edge Gateway AKS VM Scale Set Instance's Management NIC - Inbound security rules

Priority	Name	Port	Protocol	Source	Destination	Action
65000	AllowVnetInBound	Any	Any	VirtualNetwork	VirtualNetwork	Allow
65001	AllowAzureLoadBalancerInBound	Any	Any	AzureLoadBalancer	Any	Allow
65500	DenyAllInbound	Any	Any	Any	Any	Deny

Deployer-created NSG Rules on the Edge Gateway AKS VM Scale Set Instance's Management NIC - Outbound security rules

Priority	Name	Port	Protocol	Source	Destination	Action
65000	AllowVnetOutBound	Any	Any	VirtualNetwork	VirtualNetwork	Allow
65001	AllowInternetOutBound	Any	Any	Any	Internet	Allow
65500	DenyAllOutbound	Any	Any	Any	Any	Deny

External Unified Access Gateway VMs' Deployer-created NSGs

Each of the VMs for the external Unified Access Gateway configuration has three (3) NICs, one connected to the management subnet, one connected to the tenant subnet, and one connected to the DMZ subnet. The deployer creates a specific NSG for each of those three NICs, and associates each NSG with its appropriate NIC.

The management NIC has an NSG named in the pattern hcs-ID-uag-management-nsg.
The tenant NIC has an NSG named in the pattern hcs-ID-uag-tenant-nsg.
The DMZ NIC has an NSG named in the pattern hcs-ID-uag-dmz-nsg.

In your Microsoft Azure environment, these NSGs are named in the pattern hcs-ID-uag where ID is the edge's ID as displayed on the edge's details page in the console, unless the external gateway is deployed in its own VNet separate from the edge's VNet. In the case of an external gateway deployed in its own VNet, the ID is the Deployment ID value shown on the edge's details page.

Deployer-created NSG Rules on the External Unified Access Gateway VMs Management NIC

Direction	Priority	Name	Ports	Protocol	Source	Destination	Action	Purpose
Inbound	1000	AllowHttpsInBound	9443	TCP	Management subnet	Any	Allow	For the service to configure the gateway's administration settings using its management interface. As described in the Unified Access Gateway product documentation, its management interface is at port 9443/TCP.
Inbound	1100	AllowAzureInBound	Any	Any	168.63.129.16	Any	Allow	For the VM to accept incoming communication from the Microsoft Azure platform, as described in the preceding General Facts section and in the Microsoft Azure documentation topic What is IP address 168.63.129.16.
Inbound	1200	AllowSshInBound	22	Any	Management subnet	Any	Allow	To perform emergency access to the VM if needed for troubleshooting. Permission will be requested from you prior to any emergency access.
Inbound	3000	DenyAllInBound	Any	Any	Any	Any	Deny	Added by the deployer to limit this NIC's inbound traffic to the items in the previous rows.
Outbound	3000	DenyAllOutBound	Any	Any	Any	Any	Deny	Added by the deployer to deny outbound traffic from this NIC.

Deployer-created NSG Rules on the External Unified Access Gateway VMs Tenant NIC

Direction	Priority	Name	Ports	Protocol	Source	Destination	Action	Purpose
Inbound	1000	AllowAzureInBound	Any	Any	168.63.129.16	Any	Allow	For the VM to accept incoming communication from the Microsoft Azure platform, as described in the preceding General Facts section and in the Microsoft Azure documentation topic What is IP address 168.63.129.16.
Inbound	1400	AllowPcoipUdpInBound	Any	UDP	Tenant subnet	Any	Allow	This rule supports the standard configuration used for Unified Access Gateway working with the Horizon Agent. The Horizon Agents in the desktop and farm VMs send PCoIP data back to the Unified Access Gateway instances using UDP.
Inbound	3000	DenyAllInBound	Any	Any	Any	Any	Deny	Added by the deployer to limit this NIC's inbound traffic to the items in the previous rows.
Outbound	1000	AllowHttpsOutBound	443 8443	TCP	Any	Tenant subnet	Allow	This rule supports the Unified Access Gateway instances communicating with the edge gateway VMs for the purpose of new client connection requests to the edge gateways.
Outbound	1100	AllowBlastOutBound	22443	Any	Any	Tenant subnet	Allow	This rule supports the use case of a Horizon Client Blast Extreme session to the Horizon Agent in a desktop or farm VM.
Outbound	1200	AllowPcoipOutBound	4172	Any	Any	Tenant subnet	Allow	This rule supports the use case of a Horizon Client PCoIP session to the Horizon Agent in a desktop VM.
Outbound	1300	AllowUsbOutBound	32111	TCP	Any	Tenant subnet	Allow	This rule supports the use case of USB redirection traffic. USB redirection is an agent option in the desktop or farm VMs. That traffic uses port 32111 for an end-user client session to the Horizon Agent in a desktop or farm VM.
Outbound	1400	AllowMmrOutBound	9427	TCP	Any	Tenant subnet	Allow	This rule supports the use cases of multimedia redirection (MMR) and client driver redirection (CDR) traffic. These redirections are agent options in the desktop or farm VMs. That traffic uses port 9427, for an end-user client session to the Horizon Agent in a desktop or farm VM.
Outbound	1500	AllowAllOutBound	Any	Any	Any	Tenant subnet	Allow	When running in a VM that supports multiple user sessions, the Horizon Agent chooses different ports to use for the sessions' PCoIP traffic. Because these ports cannot be determined ahead of time, a NSG rule naming specific ports to allow that traffic cannot be defined ahead of time. Therefore, similar to the rule at priority 1200, this rule supports the use case of multiple Horizon Client PCoIP sessions with such VMs.
Outbound	3000	DenyAllOutBound	Any	Any	Any	Any	Deny	Added by the deployer to limit this NIC's outbound traffic to the items in the previous rows.

Deployer-created NSG Rules on the External Unified Access Gateway VMs DMZ NIC

Direction	Priority	Name	Ports	Protocol	Source	Destination	Action	Purpose
Inbound	1000	AllowHttpsInBound	80 443	TCP	Internet	Any	Allow	This rule provides for the external end users' inbound traffic from the Horizon Clients and the Horizon Web Client to request the login authentication request to the edge gateway. By default, the Horizon Client and Horizon Web Client use port 443 for this request. To support easy redirection as a convenience for a user who might type HTTP in their client instead of HTTPS, that traffic arrives at port 80 and is automatically redirected to port 443.
Inbound	1100	AllowBlastInBound	443 8443	Any	Internet	Any	Allow	This rule supports the Unified Access Gateway instances receiving the Blast traffic from the external end users' Horizon Clients.
Inbound	1200	AllowPcoipInBound	4172	Any	Internet	Any	Allow	This rule supports the Unified Access Gateway instances receiving PCoIP traffic from the external end users' Horizon Clients.
Inbound	1300	AllowAzureInBound	Any	Any	168.63.129.16	Any	Allow	For the VM to accept incoming communication from the Microsoft Azure platform, as described in the preceding General Facts section and in the Microsoft Azure documentation topic What is IP address 168.63.129.16.
Inbound	3000	DenyAllInBound	Any	Any	Any	Any	Deny	Added by the deployer to limit this NIC's inbound traffic to the items in the previous rows.

Internal Unified Access Gateway VMs' Deployer-created NSGs

Each of the VMs for the internal Unified Access Gateway configuration has two (2) NICs, one connected to the management subnet and one connected to the tenant subnet. The deployer creates a specific NSG for each of those two NICs, and associates each NSG with its appropriate NIC.

The management NIC has an NSG named in the pattern hcs-podUUID-uag-management-nsg.
The tenant NIC has an NSG named in the pattern hcs-podUUID-uag-tenant-nsg.

In your Microsoft Azure environment, these NSGs reside in the edge's resource group named in the pattern hcs-podUUID-uag-internal.

Deployer-created NSG Rules on the Internal Unified Access Gateway VMs Management NIC

Direction	Priority	Name	Ports	Protocol	Source	Destination	Action	Purpose
Inbound	1000	AllowHttpsInBound	9443	TCP	Management subnet	Any	Allow	For the service to configure the gateway's administration settings using its management interface. As described in the Unified Access Gateway product documentation, its management interface is at port 9443/TCP.
Inbound	1100	AllowAzureInBound	Any	Any	168.63.129.16	Any	Allow	For the VM to accept incoming communication from the Microsoft Azure platform, as described in the preceding General Facts section and in the Microsoft Azure documentation topic What is IP address 168.63.129.16.
Inbound	1200	AllowSshInBound	22	Any	Management subnet	Any	Any	To perform emergency access to the VM if needed for troubleshooting. Permission will be requested from you prior to any emergency access.
Inbound	3000	DenyAllInBound	Any	Any	Any	Any	Deny	Added by the deployer to limit this NIC's inbound traffic to the items in the previous rows.
Outbound	3000	DenyAllOutBound	Any	Any	Any	Any	Deny	Added by the deployer to deny outbound traffic from this NIC.

Deployer-created NSG Rules on the Internal Unified Access Gateway VMs Tenant NIC

Direction	Priority	Name	Ports	Protocol	Source	Destination	Action	Purpose
Inbound	1000	AllowAzureInBound	Any	Any	168.63.129.16	Any	Allow	For the VM to accept incoming communication from the Microsoft Azure platform, as described in the preceding General Facts section and in the Microsoft Azure documentation topic What is IP address 168.63.129.16.
Inbound	1100	AllowHttpsInBound	80 443	TCP	VirtualNetwork	Any	Allow	This rule provides for the internal end users' inbound traffic from the Horizon Clients and the Horizon Web Client to request the login authentication request to the edge gateway. By default, the Horizon Client and Horizon Web Client use port 443 for this request. To support easy redirection as a convenience for a user who might type HTTP in their client instead of HTTPS, that traffic arrives at port 80 and is automatically redirected to port 443.
Inbound	1200	AllowBlastInBound	443 8443	Any	VirtualNetwork	Any	Allow	This rule supports the Unified Access Gateway instances receiving the Blast traffic from the internal end users' Horizon Clients.
Inbound	1300	AllowPcoipInBound	4172	Any	VirtualNetwork	Any	Allow	This rule supports the Unified Access Gateway instances receiving PCoIP traffic from the internal end users' Horizon Clients.
Inbound	1400	AllowPcoipUdpInBound	Any	UDP	Tenant subnet	Any	Allow	This rule supports the standard configuration used for Unified Access Gateway working with the Horizon Agent. The Horizon Agents in the desktop and farm VMs send PCoIP data back to the Unified Access Gateway instances using UDP.
Inbound	3000	DenyAllInBound	Any	Any	Any	Any	Deny	Added by the deployer to limit this NIC's inbound traffic to the items in the previous rows.
Outbound	1000	AllowHttpsOutBound	443 8443	TCP	Any	Tenant subnet	Allow	This rule supports the Unified Access Gateway instances communicating with the edge gateway VMs for the purpose of new client connection requests to the edge.
Outbound	1100	AllowBlastOutBound	22443	Any	Any	Tenant subnet	Allow	This rule supports the use case of a Horizon Client Blast Extreme session to the Horizon Agent in a desktop or farm VM.
Outbound	1200	AllowPcoipOutBound	4172	Any	Any	Tenant subnet	Allow	This rule supports the use case of a Horizon Client PCoIP session to the Horizon Agent in a desktop VM.
Outbound	1300	AllowUsbOutBound	32111	TCP	Any	Tenant subnet	Allow	This rule supports the use case of USB redirection traffic. USB redirection is an agent option in the desktop or farm VMs. That traffic uses port 32111 for an end-user client session to the Horizon Agent in a desktop or farm VM.
Outbound	1400	AllowMmrOutBound	9427	TCP	Any	Tenant subnet	Allow	This rule supports the use cases of multimedia redirection (MMR) and client driver redirection (CDR) traffic. These redirections are agent options in the desktop or farm VMs. That traffic uses port 9427, for an end-user client session to the Horizon Agent in a desktop or farm VM.
Outbound	1500	AllowAllOutBound	Any	Any	Any	Tenant subnet	Allow	When running in a VM that supports multiple user sessions, the Horizon Agent chooses different ports to use for the sessions' PCoIP traffic. Because these ports cannot be determined ahead of time, a NSG rule naming specific ports to allow that traffic cannot be defined ahead of time. Therefore, similar to the rule at priority 1200, this rule supports the use case of multiple Horizon Client PCoIP sessions with such VMs.
Outbound	3000	DenyAllOutBound	Any	Any	Any	Any	Deny	Added by the deployer to limit this NIC's outbound traffic to the items in the previous rows.

Was this page helpful?