You are here: Installation > Microsoft Azure VM installations > Configuring Azure security groups

Configuring Azure Network Security Groups

Access to Azure instances is restricted by the Azure firewall. This may be configured by associating a subnet or instance with a Network Security Group which specifies the permitted inbound and outbound traffic from the group.

A minimal security group that permits access to a public cloud style Pexip Infinity deployment would look similar to this:

Inbound security rules

Priority Name Source Destination Service Action
105 HTTP Any Any TCP/80 Allow
110 HTTPS Any Any TCP/443 Allow
115 H.323 CS Any Any TCP/1720 Allow
120 SIP TCP Any Any TCP/5060 Allow
125 SIP TLS Any Any TCP/5061 Allow
130 TCP call signaling Any Any TCP/33000-39999 Allow
135 TCP call media Any Any TCP/40000-49999 Allow
140 H.323 LS Any Any UDP/1719 Allow
145 SIP UDP * Any Any UDP/5060 Allow
150 UDP call signaling Any Any UDP/33000-39999 Allow
155 UDP call media Any Any UDP/40000-49999 Allow
160 Management traffic CIDR block: <management station IP address/subnet> Any Any/Any Allow
* only required if you intend to enable SIP over UDP

Where Any implies any source/destination and <management station IP address/subnet> should be restricted to a single IP address or subnet for management access only.

Outbound security rules

The default network security group rules suffice. These permit outbound traffic to the same Virtual Network, or to the Internet.

A single security group can be applied to the Management Node and all Conferencing Nodes. However, if you want to apply further restrictions to your Management Node (for example, to exclude the TCP/UDP signaling and media ports), then you can configure additional security groups and use them as appropriate for each Azure instance.

Remember that the Management Node and all Conferencing Nodes must be able to communicate with each other. If your instances only have private addresses, ensure that the necessary external systems such as NTP and DNS servers are routable from those nodes.

For further information on the ports and protocols specified here, see Pexip Infinity port usage and firewall guidance.

Azure Resource Manager (ARM) templates for deploying a security group

Pexip provides two ARM templates — one with, and one without, SIP UDP access enabled — which may be used to deploy a security group containing the above rules. These templates may be used from PowerShell or the Azure CLI. Alternatively, you may use the Azure Portal to deploy a security group using the relevant template.

The details of each template are as follows. You should pick the one most suitable for your needs.

Name SIP UDP access Template URL Resources created
security-group Disabled

https://pexipas.blob.core.windows.net/templates/20160330/security-group.json

(launch in Azure Portal)

Network security group
security-group-with-sip-udp Enabled

https://pexipas.blob.core.windows.net/templates/20160330/security-group-with-sip-udp.json

(launch in Azure Portal)

Network security group

Both templates contain the following parameters:

Name Description
managementNetwork Network from which to permit management traffic (CIDR notation e.g. 1.2.3.4/28).
securityGroupName Name of the security group to create.