Implementing virtual network segmentation

Let's assume for a minute that you work for a global financial organization that is looking to perform a lift-and-shift migration of key systems into virtual networks in Azure. Part of the requirements that they have is to ensure that only required network connections can reach these key systems even if the connection originates from within the same network. How do you implement this level of control? There are two Azure network security capabilities that we can use to achieve this – Network Security Group (NSG) and Application Security Group (ASG).

Implementing NSGs

An NSG is a simple packet filter that we can use to filter network traffic to and from Azure resources in a virtual network. The terminology that I used here is intentional. An NSG is a packet filter, not a firewall! It does not have the capabilities that the Azure firewall or a Network Virtual Appliance (NVA) has because the use cases are different. With NSGs...