Hello, if i had to block all the Outbound in my NSG at first. To install the MABS and MARS for the AzureVMs in the Vnet which is using this NSG, What rules should i add?

Hi @ li_shouheng , please take a look here: Networking and access support There you will find a NSG related solution using the Azure Backup tag. When backing up files and folders from Azure VMs using the MARS Agent, you also need to configure the Azure virtual network to allow access. If you use Network Security Groups (NSG), use the AzureBackup service tag to allow outbound access to Azure Backup. In addition to the Azure Backup tag, you also need to allow connectivity for authentication and data transfer by creating similar NSG rules for Microsoft Entra ID ( AzureActiveDirectory ) and Azure Storage ( Storage ). To create a rule for the Azure Backup tag, follow these steps: In All Services , go to Network security groups and select the network security group. Select Outbound security rules under Settings . Select Add . Provide all required details for creating a new rule as described in security rule settings . Ensure the options are set as below: Destination is set to Service Tag . Destination service tag is set to AzureBackup . Select Add to save the newly created outbound security rule. (If the reply was helpful please don't forget to upvote and/or accept as answer , thank you) Regards Andreas Baumgarten

What rules in NSG is necessary to install the MARS and MABS

Accepted answer

Andreas Baumgarten 115.9K Reputation points MVP

2024-12-30T11:15:09.7733333+00:00
Hi @li_shouheng ,

please take a look here: Networking and access support

There you will find a NSG related solution using the Azure Backup tag.

When backing up files and folders from Azure VMs using the MARS Agent, you also need to configure the Azure virtual network to allow access. If you use Network Security Groups (NSG), use the AzureBackup service tag to allow outbound access to Azure Backup. In addition to the Azure Backup tag, you also need to allow connectivity for authentication and data transfer by creating similar NSG rules for Microsoft Entra ID (AzureActiveDirectory) and Azure Storage (Storage). To create a rule for the Azure Backup tag, follow these steps:

In All Services, go to Network security groups and select the network security group.

Select Outbound security rules under Settings.

Select Add.

Provide all required details for creating a new rule as described in security rule settings. Ensure the options are set as below:

Destination is set to Service Tag.

Destination service tag is set to AzureBackup.

Select Add to save the newly created outbound security rule.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten
Please sign in to rate this answer.
li_shouheng 140 Reputation points

2024-12-31T05:54:07.1933333+00:00

@Andreas Baumgarten

Thanks for your answer，one more thing i want to ask is that are these rules enough if i want to save the passphrase to the KeyVault when im installing the MARS？(my network has block all the outbound in the NSG. And both the KV and RrecoveryServicesVault are using the private end point)

I ask this because that i met the problem as https://zcusa.951200.xyz/en-us/answers/questions/2139087/got-a-problem-when-the-mars-saving-the-passpharse

can you give me some advice?

Andreas Baumgarten 115.9K Reputation points MVP

2024-12-31T07:10:27.3333333+00:00

Hi @li_shouheng ,

maybe this information is helpful: Access Azure Key Vault behind a firewall

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

li_shouheng 140 Reputation points

2024-12-31T07:22:08.66+00:00

@Andreas Baumgarten

sorry i dont think this document is the same as my situation,from this document, i think the most like what im doing is the "Key Vault operations".Because im installing the MARS, so i dont think is about the"Key Vault management"and"Authentication", and i already made a private for the KeyVault.

so could you tell me what mostly made this error? and what can i try to do?

My networks are as follows:

the test pepkv is the private endpoint for the KeyVault and the testpep-rsg is the private endpoint for the RecoveryServicesVault.

and this is my nsg outbound settings

Andreas Baumgarten 115.9K Reputation points MVP

2024-12-31T07:48:31.7+00:00

Hi @li_shouheng ,

I can't see any KeyVault related outbound rule in your NSG rule set.

Basically you need to ensure:

KeyVault inbound needs to be allowed

KeyVault outbound needs to be allowed

KeyVault permissions to set/read credentials

What happens if you allow all communications in NSG just for testing! This is just to verify it works in general without any blocked communication by NSG.

And one friendly reminder: It would be helpful to see screenshots in English language. It's easier to understand the details.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

li_shouheng 140 Reputation points

2024-12-31T08:17:50.0066667+00:00

@Andreas Baumgarten

That is a good idea to do allow all communications in NSG for testing

i deleted the "DenyAnyCustomAnyOutBound" and even added a"AllowAnyCustomAnyInbound" , but the result is that the same error code comes out again. so i think what made this error is not the NSG settings

But i made a new KeyVault, which dosent use a private but allow the public access, this new KeyVault can be used with the NSG setting(no matter if i allow all communications or not)

so what should i do to use the KeyVault with the private endpoint and the NSG

Andreas Baumgarten 115.9K Reputation points MVP

2024-12-31T08:34:24.7366667+00:00

Hi @li_shouheng ,

please take a look here: Access a key vault in a private network through shared private endpoints

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

li_shouheng 140 Reputation points

2024-12-31T08:48:04.7833333+00:00

Hi @Andreas Baumgarten

sorry i had not try this way until now. But must i use this shared private endpoints? why cant i use the common rivate endpoint? would you like to tell me the reason that caused this error? thanks very much!

Andreas Baumgarten 115.9K Reputation points MVP

2024-12-31T10:22:18.04+00:00

Hi @li_shouheng ,

the explanation is in the linked article: Access a key vault in a private network through shared private endpoints

Private endpoints of secured resources created through Azure Web PubSub APIs are called shared private link resources. You "share" access to a resource, such as an instance of Azure Key Vault, that is integrated with Azure Private Link. These private endpoints are created inside the Web PubSub execution environment and aren't directly visible to you.

(If the reply was helpful please don't forget to upvote and/or accept as answer, thank you)

Regards

Andreas Baumgarten

Ashok Gandhi Kotnana 1,855 Reputation points Microsoft Vendor

2025-01-03T07:37:50.3966667+00:00

Hi @li_shouheng ,

Please let us know if the answer provided by @Andreas Baumgarten was helpful.
Thankyou
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

What rules in NSG is necessary to install the MARS and MABS

0 additional answers

Your answer