Policy:Subnets should have a Network Security Group

[bagelsandcoffee]

Hello ,

This policy Subnets should have a Network Security Group is deployed when VWAN is selected along with other parameter on
Deploy Enterprise-Scale with Azure VWAN. I was testing the policies and looks like the policy denies creation of a VNET completely
I am wondering if the creation is completely denied how would a NSG be attached and how new vents will be created I understand there is audit option but the deployment creates assignment with "deny".

Thankx

[jtracey93]

Hi @bagelsandcoffee,

This policy is assigned to the identity and landing zones management groups, as detailed here.

The policy only looks at each subnet and checks there is an NSG assigned. If not, the deny action will take effect. It does not block the creation of a VNET.

Hope that helps, let me know if you need anything else or have more questions

[bagelsandcoffee]

Thankx @jtracey93 for the reply .I will test it out again and let you know

[bagelsandcoffee]

Thankx for resources was very helpful.I redeployed the solution .Same Problem.Since while creating a VNet there is no option create a NSG i cant create one and hence the error.
@jtracey93

[jtracey93]

Ah okay, you are using the portal. This now makes sense, and in-fact is already logged as a bug here #972

The VNET portal team are aware and are working on it. However for now you can create a blank VNET via a Bicep file for example or PowerShell and then you can use the portal expeirence from there.

You could also create a template spec for a blank VNET with no subnets, to get around this also today. Then you can use the portal as normal to create new NSG and subnets once the blank VNET is created.

VNET Portal Engineering are working on this though, for an updated portal experience for VNETs that is due soon (no ETA to share im afraid, but we have seen an early preview 👍)

[bagelsandcoffee]

Sweet .Thankx for reply makes sense