Cloning NSGs
Recently, we were cloning a few virtual machines from test to production in Azure. One of the pain points while doing this with just NSGs (and without Network Manager) is cloning specific firewall rules to apply to your brand new NSG.
PowerShell
Performing this manually is a very annoying task. Through the magic of github and a few modifications, we came up with the following which worked great!
You’ll need to already have the Az PowerShell module loaded, and make sure you are on the right subscription ID before continuing. This should be taken care of for you the Azure shell. Also make sure you’ve run the script to pass the function into your shell session.
You can find the github gist here.
You can run the script as follows:
Copy-AzNSGRules -SourceResourceGroupName "Source-ResourceGroup" -SourceNSGName "Source-nsg" -TargetResourceGroupName "Target-ResourceGroup" -TargetNSGName "NewNSGName"
Prerequisites
Prior to running you’ll need to make sure you are connected to Azure and the PowerShell module is installed:
Install-Module -Name Az -AllowClobber -Scope CurrentUser
Connect-AzAccount
#Set-AzContext -SubscriptionId {subscription_id} If needed
#You can test you are on the right subscription with: Get-AzVM
Code
# Copy-AzNSGRules
Function Copy-AzNSGRules
{
<#
.SYNOPSIS
Copies Azure NSG security rules from one NSG to another
.DESCRIPTION
Copies all the Azure Network Security Group security rules
from one Network Security Group to another Network Security Group.
It can also create new Network Security Group if the target Network Security
doesn't exist.
.PARAMETER SourceResourceGroupName
Specify the source Resource Group Name
.PARAMETER SourceNSGName
Specify the source Network Security Group Name
.PARAMETER TargetNSGName
Specify the target Network Security Group Name
.PARAMETER SourceNSG
Specify the source Network Security Group
.PARAMETER TargetNSG
Specify the target Network Security Group
.PARAMETER TargetResourceGroupName
Specify the target Resource Group Name to create new Network Security Group
.PARAMETER TargetLocation
Specify the location to create new Network Security Group
.INPUTS
None
.OUTPUTS
System.String. Information
.EXAMPLE
. .\Copy-AzNSGRules.ps1
PS C:\> Copy-AzNSGRules -SourceResourceGroupName 'rg1' -SourceNSGName 'nsg1' -TargetResourceGroupName
Copy-AzNSGRules -SourceResourceGroupName <string> -SourceNSGName <string> -TargetResourceGroupName <string> -TargetNSGName <string> [<CommonParameters>]
Copy-AzNSGRules -SourceResourceGroupName <string> -SourceNSGName <string> -TargetResourceGroupName <string> -TargetNSGName <string> -TargetLocation <string> [<CommonParameters>]
Copy-AzNSGRules -SourceNSG <psobject> -TargetResourceGroupName <string> -TargetNSGName <string> -TargetLocation <string> [<CommonParameters>]
Copy-AzNSGRules -SourceNSG <psobject> -TargetNSG <psobject> [<CommonParameters>]
#>
# Default Parameterset Name is 'Name'
[CmdLetBinding(DefaultParameterSetName = 'Name')]
param
(
# Source Resource Group Name
[Parameter(Mandatory = $true, ParameterSetName = 'Name')]
[Parameter(Mandatory = $true, ParameterSetName = 'CreateNew')]
[string] $SourceResourceGroupName,
# Source NSG Name
[Parameter(Mandatory = $true, ParameterSetName = 'Name')]
[Parameter(Mandatory = $true, ParameterSetName = 'CreateNew')]
[string] $SourceNSGName,
# Source NSG Object
[Parameter(Mandatory = $true, ParameterSetName = 'NSG')]
[Parameter(Mandatory = $true, ParameterSetName = 'NewNSG')]
[psobject] $SourceNSG,
# Target Resource Group Name
[Parameter(Mandatory = $true, ParameterSetName = 'Name')]
[Parameter(Mandatory = $true, ParameterSetName = 'CreateNew')]
[Parameter(Mandatory = $true, ParameterSetName = 'NewNSG')]
[string] $TargetResourceGroupName,
# Target NSG Name
[Parameter(Mandatory = $true, ParameterSetName = 'Name')]
[Parameter(Mandatory = $true, ParameterSetName = 'CreateNew')]
[Parameter(Mandatory = $true, ParameterSetName = 'NewNSG')]
[string] $TargetNSGName,
# Target NSG Object
[Parameter(Mandatory = $true, ParameterSetName = 'NSG')]
[psobject] $TargetNSG,
# Target location, NSG to be created
[Parameter(Mandatory = $true, ParameterSetName = 'CreateNew')]
[Parameter(Mandatory = $true, ParameterSetName = 'NewNSG')]
[string] $TargetLocation
)
# Check for source NSG, value by name
if ($PSCmdlet.ParameterSetName -eq 'Name' -or $PSCmdlet.ParameterSetName -eq 'CreateNew')
{
try
{
Write-Host "Info: Checking for source NSG '$SourceNSGName'..." -ForegroundColor Green
$SourceNSG = Get-AzNetworkSecurityGroup -ResourceGroupName $SourceResourceGroupName -Name $SourceNSGName -ErrorAction Stop
Write-Host ("Info: Source NSG '{0}' is found and it has {1} following security rules...`n{2}" -f $SourceNSGName, $SourceNSG.SecurityRules.Count, ($SourceNSG.SecurityRules.Name -join ', ') ) -ForegroundColor Green
}
catch
{
Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red
return
}
}
# Check for source NSG, value by NSG object
if ($PSCmdlet.ParameterSetName -eq 'NSG' -or $PSCmdlet.ParameterSetName -eq 'NewNSG')
{
Write-Host ("Info: Source NSG '{0}' has {1} following security rules...`n{2}" -f $SourceNSG.Name, $SourceNSG.SecurityRules.Count, ($SourceNSG.SecurityRules.Name -join ', ') ) -ForegroundColor Green
}
if ($SourceNSG.SecurityRules.Count -le 0)
{
# When source NSG doesn't have any security rules
Write-Host ("Error: No security rules found on source NSG {0}" -f $SourceNSG.Name ) -ForegroundColor Red
return
}
# Check for target NSG, value by name
if ($PSCmdlet.ParameterSetName -eq 'Name')
{
try
{
Write-Host "Info: Checking for target NSG '$TargetNSGName'..." -ForegroundColor Green
$TargetNSG = Get-AzNetworkSecurityGroup -ResourceGroupName $TargetResourceGroupName -Name $TargetNSGName -ErrorAction Stop
Write-Host "Info: Target NSG '$TargetNSGName' is found and ready to copy security rules from source NSG." -ForegroundColor Green
}
catch
{
Write-Host "Error: Since there is no NSG with the name '$TargetNSGName' in '$TargetResourceGroupName', please specify '-TargetLocation' parameter to create a new NSG and copy the security rules." -ForegroundColor Red
return
}
}
# When target NSG doesn't exist, value by name and NSG object
if ($PSCmdlet.ParameterSetName -eq 'CreateNew' -or $PSCmdlet.ParameterSetName -eq 'NewNSG')
{
# Check for target NSG, if it doesn't exist then create new else continue
if ($null -eq ($TargetNSG = Get-AzNetworkSecurityGroup -ResourceGroupName $TargetResourceGroupName -Name $TargetNSGName -ErrorAction SilentlyContinue))
{
Write-Host "Info: Target NSG '$TargetNSGName' doesn't exist in '$TargetResourceGroupName' and will be creating new NSG..."
# Create Resource Group if it doesn't exist
try
{
Write-Host "Info: Checking for Resource Group '$TargetResourceGroupName'..."
$null = Get-AzResourceGroup -Name $TargetResourceGroupName -Location $TargetLocation -ErrorAction Stop
Write-Host "Info: Found an existing Resource Group '$TargetResourceGroupName', and skiping the Resource Group creation."
}
catch
{
Write-Host "Info: Resource Group '$TargetResourceGroupName' doesn't exist and will be creating new Resource Group."
$null = New-AzResourceGroup -Name $TargetResourceGroupName -Location $TargetLocation
Write-Host "Info: Resource Group '$TargetResourceGroupName' has been created in $TargetLocation location."
}
$TargetNSG = New-AzNetworkSecurityGroup -ResourceGroupName $TargetResourceGroupName -Name $TargetNSGName -Location $TargetLocation
Write-Host ("Info: New NSG '{0}' has been created in resource group '{1}' in '{2}' location." -f $TargetNSGName, $TargetResourceGroupName, $TargetLocation ) -ForegroundColor Green
}
else
{
Write-Host ("Warning: The NSG '{0}' is already existed, passing '-TagetLocation' parameter value and skiping the NSG creation." -f $TargetNSGName) -ForegroundColor Yellow
}
}
# For all scenarios incluing when NSG objects are provided
try
{
Write-Host ("Info: Copying security rules from the source nsg '{0}' to target nsg '{1}'..." -f $SourceNSG.Name, $TargetNSG.Name) -ForegroundColor Green
# Add source NSG security rules to target NSG
$TargetNSG.SecurityRules = $SourceNSG.SecurityRules
# Update target NSG
$null = Set-AzNetworkSecurityGroup -NetworkSecurityGroup $TargetNSG -ErrorAction Stop # $null used to supress the output
# Success information
Write-Host ("Info: Following {0} security rule(s) is/are copied from source NSG '{1}\{2}' to target NSG '{3}\{4}'" -f $SourceNSG.SecurityRules.Count, $SourceNSG.ResourceGroupName, $SourceNSG.Name, $TargetNSG.ResourceGroupName, $TargetNSG.Name) -ForegroundColor Green
Write-Host ($SourceNSG.SecurityRules.Name -join ', ') -ForegroundColor Green
}
catch
{
Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red
}
}
Shameless Plug: Looking for Azure automation to move your test VMs? Add us to your inbound, and reach out!