Using an NSG to control the types of network traffic that can access a VM's NICs is a Microsoft Azure best practice. By default, the first time running the Horizon Universal Console's Import Virtual Machine from Marketplace wizard for a specific Horizon Cloud pod creates an NSG in the same resource group as the VM and attaches the NIC of the resulting VM to that NSG. In the next run of the wizard, depending on whether you selected to have a public IP address created in that initial run, the system attaches the subsequent VM to that same NSG or creates a second NSG. The rules in these NSGs determine the traffic allowed to the wizard-created imported VMs.
As described in the Microsoft Azure documentation, in Microsoft Azure, a network security group (NSG) governs the network traffic to the resources connected to Azure Virtual Networks (VNet). An NSG defines the security rules that allow or deny that network traffic. For more detailed information about how NSGs filter network traffic, see the Microsoft Azure documentation topic Filter network traffic with network security groups. Microsoft Azure creates some default rules automatically in each NSG when it is created. In every NSG that is created, Microsoft Azure creates some inbound and outbound rules at priority 65000 and higher. Such Microsoft Azure default rules are not described in this documentation topic, because they are created by Microsoft Azure automatically when anybody or any system creates an NSG in Microsoft Azure. Those rules are not created by Horizon Cloud. For details on those default rules, see the Microsoft Azure documentation topic Default security rules.
When the system's Import Virtual Machine from Marketplace workflow runs, the system creates these NSGs in the same resource group where the imported VM is created. To see the naming pattern used for the pod's resource group in which the wizard creates the VMs, see First-Gen Tenants - Resource Groups Created For a Pod Deployed In Microsoft Azure.
With Enable Public IP Address
For VMs created with the wizard's Enable Public IP Address toggle switched on, the system attaches those VMs to the NSG named HCS-Imported-VM-NSG. In addition to the default rules created by Microsoft Azure in all NSGs, this NSG has an inbound rule that allows inbound traffic using the RDP port. Because the purpose of the Enable Public IP Address option is to give you the ability to log in to the VM over the public Internet, so that you can customize the VM, this inbound rule provides that ability for you to log in to the VM over the Internet using RDP.
| Priority | Name | Port | Protocol | Source | Destination | Action |
|---|---|---|---|---|---|---|
| 300 | AllowRDP | 3389 | TCP | Any | Any | Allow |
Without Enable Public IP Address
For VMs created with the wizard's Enable Public IP Address toggle switched off, the system attaches those VMs to the NSG named HCS-Imported-VM-NSG-Basic. This NSG only contains the default rules created by Microsoft Azure when an NSG is created. Such Microsoft Azure default rules are not described in this documentation topic, because they are created by Microsoft Azure automatically. For details on those default rules, see the Microsoft Azure documentation topic Default security rules.
Was this page helpful?