[[["容易理解","easyToUnderstand","thumb-up"],["確實解決了我的問題","solvedMyProblem","thumb-up"],["其他","otherUp","thumb-up"]],[["難以理解","hardToUnderstand","thumb-down"],["資訊或程式碼範例有誤","incorrectInformationOrSampleCode","thumb-down"],["缺少我需要的資訊/範例","missingTheInformationSamplesINeed","thumb-down"],["翻譯問題","translationIssue","thumb-down"],["其他","otherDown","thumb-down"]],["上次更新時間：2025-07-31 (世界標準時間)。"],[],[],null,["# Network security groups\n=======================\n\nThis page describes and lists the\n[Azure network security groups (NSGs)](https://docs.microsoft.com/azure/virtual-network/network-security-groups-overview)\nrequired by GKE on Azure.\n\nThis page is for Networking specialists who want to install, configure, and\nsupport network equipment. To learn more about common roles and example tasks\nthat we reference in Google Cloud content, see\n[Common GKE user roles and tasks](/kubernetes-engine/enterprise/docs/concepts/roles-tasks).\n\nManaged NSGs\n------------\n\nGKE on Azure manages the NSGs attached to the virtual network\ninterface card (NIC) of each virtual machine (VM) instance. To further control\nnetwork traffic, you can add additional NSGs to your subnets.\n\nGKE on Azure manages required NSG rules automatically. It adds missing\nNSG rules and removes rules that are no longer necessary. GKE on Azure\nalso modifies rules based on your Kubernetes Service configuration. For example,\nwhen you add a Kubernetes Service of type `LoadBalancer`, GKE on Azure\nadds the corresponding NSG rules.\n\nRule priorities\n---------------\n\nAzure NSG rule priorities have a range between 100 and 4096. The lower the\npriority number, the higher the priority.\n\nBy design, GKE on Azure manages only NSG rules with a priority of 500\nor higher. Therefore, if you need to implement a specific rule or create\nadditional rules, you can use NSGs with a priority between 100 and 499.\n\nAzure processes rules in order, starting with the lowest priority number and\nproceeding upward. When you create a new rule, always choose rule priorities in\nthe 100 to 499 range to avoid conflict with existing Anthos NSG rules.\n\nApplication security groups\n---------------------------\n\nGKE on Azure creates two\n[application security groups (ASGs)](https://docs.microsoft.com/azure/virtual-network/application-security-groups)\nthat apply to the virtual NICs of control planes and worker nodes.\nGKE on Azure updates ASGs automatically---for\nexample, when you add a new node pool to a cluster. You can use these ASGs\nwhen creating NSG rules.\n\nThe Azure Resource Manager (ARM) IDs of the NSG and control plane ASG\ncan be obtained from the output of\n[`gcloud container azure clusters describe`](/sdk/gcloud/reference/container/azure/clusters/describe).\n\nFor example, to allow SSH connections to the control plane VMs, run the\n`az network nsg rule create` command to create an NSG that references\nthe control plane ASG: \n\n NSG_NAME=$(basename $(gcloud container azure clusters describe \\\n \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n --format 'value(managedResources.networkSecurityGroupId)'))\n\n ASG_CP_NAME=$(basename $(gcloud container azure clusters describe \\\n \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e --location=\u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e \\\n --format 'value(managedResources.controlPlaneApplicationSecurityGroupId)'))\n\n az network nsg rule create \\\n --name AllowSshToControlPlane \\\n --nsg-name \"${NSG_NAME}\" \\\n --priority 100 \\\n --resource-group \"\u003cvar translate=\"no\"\u003eCLUSTER_RESOURCE_GROUP\u003c/var\u003e\" \\\n --access Allow \\\n --protocol Tcp \\\n --destination-port-ranges 22 \\\n --destination-asgs \"${ASG_CP_NAME}\"\n\nReplace the following:\n\n- \u003cvar translate=\"no\"\u003eCLUSTER_NAME\u003c/var\u003e: the name of your cluster\n- \u003cvar translate=\"no\"\u003eGOOGLE_CLOUD_LOCATION\u003c/var\u003e: the Google Cloud location that manages your cluster\n- \u003cvar translate=\"no\"\u003eCLUSTER_RESOURCE_GROUP\u003c/var\u003e: the name of the Azure resource group that holds your cluster\n\nFor more information about creating a new rule, follow the procedure described in\n[Azure NSG rule creation](https://docs.microsoft.com/cli/azure/network/nsg/rule?view=azure-cli-latest#az_network_nsg_rule_create).\n\nDefault NSG rules\n-----------------\n\nWhen you set up GKE on Azure, it creates the following NSG rules in\nyour Azure virtual network."]]
