address spaces (local networks). It also includes virtual network address spaces. AzureLoadBalancer This default tag denotes the load balancer for the Azure infrastructure. This (ARM) translates to an IP address for an Azure datacenter where the health probes originate. This is needed only if the virtual machine or set of virtual machines associated with the Network Security Group is participating in a load balanced set. Note this is not the actual load balancer IP address. Internet (ARM) This default tag denotes the IP address space that is outside the virtual network and reachable by public Internet. This range includes the public IP space that is owned by Azure. If you use this tag for outbound restrictions, you potentially will not be able to access an Azure PaaS service unless you have a higher priority rule that grants access to that service. Mandatory: Network Security Groups must be assigned to a subnet or network adapter for any of the rules to affect traffic. Recommended: For CSP scenarios, consider using network security groups to protect subnets from improperly configured CSP routing tables. Design Guidance When you are designing Network Security Groups, consider the following: Capability Consideration Capability Decision Points Compliance Network Security Groups can present design challenges from a PCI or other compliance perspective because of the lack of detailed logging capabilities in the service. Priority numbering When designing Network Security Group rules for inbound or outbound scenarios, be sure to leave a blank priority number space between rules. Note that the priority values are independent for inbound and outbound rules.
address spaces (local networks). It also includes virtual network address spaces. AzureLoadBalancer (ARM) This default tag denotes the load balancer for the Azure infrastructure. This translates to an IP address for an Azure datacenter where the health probes originate. This is needed only if the virtual machine or set of virtual machines associated with the Network Security Group is participating in a load balanced set. Note this is not the actual load balancer IP address. Internet (ARM) This default tag denotes the IP address space that is outside the virtual network and reachable by public Internet. This range includes the public IP space that is owned by Azure. If you use this tag for outbound restrictions, you potentially will not be able to access an Azure PaaS service unless you have a higher priority rule that grants access to that service. Mandatory: Network Security Groups must be assigned to a subnet or network adapter for any of the rules to affect traffic. Recommended: For CSP scenarios, consider using network security groups to protect subnets from improperly configured CSP routing tables. Design Guidance When you are designing Network Security Groups, consider the following: Capability Consideration Capability Decision Points Compliance Network Security Groups can present design challenges from a PCI or other compliance perspective because of the lack of detailed logging capabilities in the service. Priority numbering When designing Network Security Group rules for inbound or outbound scenarios, be sure to leave a blank priority number space between rules. Note that the priority values are independent for inbound and outbound rules.