Configure a network security group for Azure Managed Lustre file systems

Network security groups can be configured to filter inbound and outbound network traffic to and from Azure resources in an Azure virtual network. A network security group can contain security rules that filter network traffic by IP address, port, and protocol. When a network security group is associated with a subnet, security rules are applied to resources deployed in that subnet.

This article describes how to configure network security group rules to secure access to an Azure Managed Lustre file system cluster as part of a Zero Trust strategy.

Prerequisites

• An Azure subscription. If you don't have an Azure subscription, create a free account before you begin.
• A virtual network with a subnet configured to allow Azure Managed Lustre file system support. To learn more, see Networking prerequisites.
• An Azure Managed Lustre file system deployed in your Azure subscription. To learn more, see Create an Azure Managed Lustre file system.

Create and configure a network security group

You can use an Azure network security group to filter network traffic between Azure resources in an Azure virtual network. A network security group contains security rules that allow or deny inbound network traffic to, or outbound network traffic from, several types of Azure resources. For each rule, you can specify source and destination, port, and protocol.

To create a network security group in the Azure portal, follow these steps:

1. In the search box at the top of the portal, enter Network security group. Select Network security groups in the search results.

2. Select + Create.

3. In the Create network security group page, under the Basics tab, enter or select the following values:

   Setting	Action
   Project details
   Subscription	Select your Azure subscription.
   Resource group	Select an existing resource group, or create a new one by selecting Create new. This example uses the sample-rg resource group.
   Instance details
   Network security group name	Enter a name for the network security group you're creating.
   Region	Select the region you want.

   

4. Select Review + create.

5. After you see the Validation passed message, select Create.

Associate the network security group to a subnet

Once the network security group is created, you can associate it to the unique subnet in your virtual network where the Azure Managed Lustre file system exists. To associate the network security group to a subnet using the Azure portal, follow these steps:

1. In the search box at the top of the portal, enter Network security group and select Network security groups in the search results.

2. Select the name of your network security group, then select Subnets.

3. To associate a network security group to the subnet, select + Associate, then select your virtual network and the subnet that you want to associate the network security group to. Select OK.

Configure network security group rules

It's important to follow the minimum provided guidelines when you configure your network security group. Proper network security group configuration enables Azure Managed Lustre to operate essential services like the Lustre protocol, engineering and diagnostic support, Azure Blob storage, and security monitoring. Disabling any of these essential services may lead to a degraded product and support experience.

To configure network security group rules for Azure Managed Lustre file system support, add inbound and outbound security rules to the network security group associated with the Azure Managed Lustre subnet. The following sections describe how to create and configure the inbound and outbound security rules that allow Azure Managed Lustre file system support.

Create inbound security rules

You can create inbound security rules in the Azure portal. The following example shows how to create and configure a new inbound security rule:

1. In the Azure portal, open the network security group resource you created in the previous step.
2. Select Inbound security rules under Settings.
3. Select + Add.
4. In the Add inbound security rule pane, configure the settings for the rule and select Add.

Add the following inbound rules to the network security group. A description of all Azure service tags can be found at Azure Service Tags Overview.

The inbound security rules in the Azure portal should look similar to the following screenshot. The screenshot is provided as an example; consult the table for the complete list of rules. You should adjust the subnet IP address/CIDR range and other settings based on your deployment:

Create outbound security rules

You can create outbound security rules in the Azure portal. The following example shows how to create and configure a new outbound security rule:

1. In the Azure portal, open the network security group resource you created in an earlier step.
2. Select Outbound security rules under Settings.
3. Select + Add.
4. In the Add outbound security rule pane, configure the settings for the rule and select Add.

Add the following outbound rules and network service tags to the network security group. A description of all Azure service tags can be found at Azure Service Tags Overview.

The outbound security rules in the Azure portal should look similar to the following screenshot. The screenshot is provided as an example; consult the table for the complete list of rules. You should adjust the subnet IP address/CIDR range and other settings based on your deployment:

Next steps

To learn more about Azure Managed Lustre, see the following articles:

• What is Azure Managed Lustre?
• Create an Azure Managed Lustre file system

To learn more about Azure network security groups, see the following articles:

• Overview of network security groups
• How network security groups filter network traffic