LEARN. PRACTICE. GROW.Concept and mechanism
In an NSG, lower numbers mean higher priority and the first matching rule decides within that group. Do not combine priorities from different NSGs into one list. When subnet and NIC filters apply, both need to permit the new connection unless explicitly configured higher-level mechanisms apply. NSGs are stateful, so an existing connection may not reflect a change in the same way as a new attempt. Use the concrete flow, including source, destination, protocol, and ports, to analyze effective rules without opening access indiscriminately.
Guided application
Peering does not create automatic transit between spokes. A UDR to an NVA also does not itself enable forwarding on the appliance NIC or operating system; check return routing and symmetry where required. For private endpoints, confirm the client resolves the name through the correct DNS architecture, including on-premises clients. Bastion supports VM administration through private addresses with supported configuration. In a Load Balancer, distinguish TCP availability from the HTTP health endpoint’s response: a probe receiving 500 needs diagnosis before weakening criteria.
The NIC permits HTTPS, but the subnet denies the new connection. Adding another NIC Allow does not correct the subnet block.
Common pitfalls
Comparing priorities globally; assuming transitive peering; fixing IAM when DNS is the problem; ignoring the return path.
Related topics: Observability and operational recovery · Identities and effective access
Locate the failure layer before changing controls or topology.
Reference: NSG evaluation · AZ-104; skills measured 2026-04-17