Azure NSG Effective Rules Lie: az network nic list-effective-nsg When a VM Is Dark

Azure · Techclick CLI troubleshooting lab

NSG on the subnet allows 443. The VM still does not answer. App team changed nothing.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Azure for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

A NIC NSG, a subnet NSG, and an Application Security Group all stack. list-effective-nsg is the only merged view.

Why this ticket shows up

People screenshot the subnet NSG and miss the NIC NSG deny. Effective rules settle the argument.

Symptoms operators actually see

• Subnet NSG allow, traffic dies

• NIC NSG leftover deny

• ASG membership wrong

• Flow logs show deny

CLI first — copy this block

Run these on the Azure device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

az network nic list-effective-nsg --ids <nic-id> -o table
az network watcher show-next-hop --vm vm1 --source-ip 10.0.1.4 --dest-ip 10.0.2.10
az network watcher test-ip-flow --direction inbound --local 10.0.1.4 --remote 203.0.113.10 --port 443 --protocol TCP --vm vm1
az network nsg rule list -g rg1 --nsg-name nic-nsg -o table

How to read that output

If effective rules deny 443 inbound, the subnet screenshot is irrelevant. next-hop tells you if you also have a route problem.

Triage order

1. Dump effective NSG on the NIC

2. Run test-ip-flow

3. Remove or fix the deny

4. Check next-hop if flow is allow but still dark

5. Retest from the client

Classic traps

What you see	Real cause	Fix
Open 443 on the subnet again	NIC NSG still denies	Fix effective
Disable all NSGs	You lose the model	Fix one rule
Blame the VM service	Flow is deny	Never reached the guest

Proof the ticket is closed

• Effective rule allows the 5-tuple

• test-ip-flow Allow

• Client connects

Say this in an interview

I do not debate Azure NSGs from a screenshot. Effective rules on the NIC win.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/