Network Segmentation in Azure — NSGs, ASGs & Hub-Spoke
Security & Identity
Network segmentation is the foundation of defence-in-depth in Azure. A flat network where every VM can reach every other VM is not just a security risk — it is an incident waiting to happen. This is the segmentation model I implement for enterprise workloads.
Key Patterns & Steps
- Hub-spoke topology: shared services (firewall, DNS, bastion, monitoring) in a hub VNet; workloads in separate spoke VNets connected via peering
- NSGs on every subnet, not just on VMs — subnet-level NSGs are your primary east-west traffic control
- Application Security Groups (ASGs): group VMs by role (web tier, app tier, db tier) and write NSG rules against ASGs rather than individual IPs
- Azure Firewall in the hub: all traffic between spokes and to the internet flows through the firewall — inspect and log everything
- Service endpoints and Private Endpoints: connect Azure PaaS services (Storage, SQL) over the VNet backbone, not the public internet
- Deny all inbound by default: NSG baseline is deny-all; explicitly allow only what is needed, documented, and reviewed
Lessons Learned
Every flat network I inherited had at least one forgotten rule allowing port 22 or 3389 from the internet. Zero-trust network design starts with denying everything and explicitly allowing only what is needed.
Technologies
← Back to Architecture Notes