Skip to content

Cloning Azure Network Security Groups with PowerShell

Cloning NSGs

Recently, we were cloning a few virtual machines from test to production in Azure. One of the pain points while doing this with just NSGs (and without Network Manager) is cloning specific firewall rules to apply to your brand new NSG.

PowerShell

Performing this manually is a very annoying task. Through the magic of github and a few modifications, we came up with the following which worked great!

You’ll need to already have the Az PowerShell module loaded, and make sure you are on the right subscription ID before continuing. This should be taken care of for you the Azure shell. Also make sure you’ve run the script to pass the function into your shell session.

You can find the github gist here.

You can run the script as follows:

Copy-AzNSGRules -SourceResourceGroupName "Source-ResourceGroup" -SourceNSGName "Source-nsg" -TargetResourceGroupName "Target-ResourceGroup" -TargetNSGName "NewNSGName"

Prerequisites

Prior to running you’ll need to make sure you are connected to Azure and the PowerShell module is installed:

Install-Module -Name Az -AllowClobber -Scope CurrentUser
Connect-AzAccount
#Set-AzContext -SubscriptionId {subscription_id} If needed
#You can test you are on the right subscription with: Get-AzVM

Code

# Copy-AzNSGRules

Function Copy-AzNSGRules
{
    <#
    .SYNOPSIS
    Copies Azure NSG security rules from one NSG to another
    .DESCRIPTION
    Copies all the Azure Network Security Group security rules 
    from one Network Security Group to another Network Security Group.
    It can also create new Network Security Group if the target Network Security 
    doesn't exist.
    .PARAMETER SourceResourceGroupName
    Specify the source Resource Group Name
    .PARAMETER SourceNSGName
    Specify the source Network Security Group Name
    .PARAMETER TargetNSGName
    Specify the target Network Security Group Name
    .PARAMETER SourceNSG
    Specify the source Network Security Group
    .PARAMETER TargetNSG
    Specify the target Network Security Group
    .PARAMETER TargetResourceGroupName
    Specify the target Resource Group Name to create new Network Security Group
    .PARAMETER TargetLocation
    Specify the location to create new Network Security Group
    .INPUTS
    None
    .OUTPUTS
    System.String. Information
    .EXAMPLE
     . .\Copy-AzNSGRules.ps1
    PS C:\> Copy-AzNSGRules -SourceResourceGroupName 'rg1' -SourceNSGName 'nsg1' -TargetResourceGroupName 
 
    Copy-AzNSGRules -SourceResourceGroupName <string> -SourceNSGName <string> -TargetResourceGroupName <string> -TargetNSGName <string> [<CommonParameters>]
    Copy-AzNSGRules -SourceResourceGroupName <string> -SourceNSGName <string> -TargetResourceGroupName <string> -TargetNSGName <string> -TargetLocation <string> [<CommonParameters>]
    Copy-AzNSGRules -SourceNSG <psobject> -TargetResourceGroupName <string> -TargetNSGName <string> -TargetLocation <string> [<CommonParameters>]
    Copy-AzNSGRules -SourceNSG <psobject> -TargetNSG <psobject> [<CommonParameters>]
    #>

    # Default Parameterset Name is 'Name'
    [CmdLetBinding(DefaultParameterSetName = 'Name')]
    param
    (
        # Source Resource Group Name
        [Parameter(Mandatory = $true, ParameterSetName = 'Name')]
        [Parameter(Mandatory = $true, ParameterSetName = 'CreateNew')]
        [string] $SourceResourceGroupName,
        
        # Source NSG Name
        [Parameter(Mandatory = $true, ParameterSetName = 'Name')]
        [Parameter(Mandatory = $true, ParameterSetName = 'CreateNew')]
        [string] $SourceNSGName,

        # Source NSG Object
        [Parameter(Mandatory = $true, ParameterSetName = 'NSG')]
        [Parameter(Mandatory = $true, ParameterSetName = 'NewNSG')]
        [psobject] $SourceNSG,
        
        # Target Resource Group Name
        [Parameter(Mandatory = $true, ParameterSetName = 'Name')]
        [Parameter(Mandatory = $true, ParameterSetName = 'CreateNew')]
        [Parameter(Mandatory = $true, ParameterSetName = 'NewNSG')]
        [string] $TargetResourceGroupName,

        # Target NSG Name
        [Parameter(Mandatory = $true, ParameterSetName = 'Name')]
        [Parameter(Mandatory = $true, ParameterSetName = 'CreateNew')]
        [Parameter(Mandatory = $true, ParameterSetName = 'NewNSG')]
        [string] $TargetNSGName,

        # Target NSG Object
        [Parameter(Mandatory = $true, ParameterSetName = 'NSG')]
        [psobject] $TargetNSG,

        # Target location, NSG to be created 
        [Parameter(Mandatory = $true, ParameterSetName = 'CreateNew')]
        [Parameter(Mandatory = $true, ParameterSetName = 'NewNSG')]
        [string] $TargetLocation

    )

    # Check for source NSG, value by name
    if ($PSCmdlet.ParameterSetName -eq 'Name' -or $PSCmdlet.ParameterSetName -eq 'CreateNew')
    {
        try 
        { 
            Write-Host "Info: Checking for source NSG '$SourceNSGName'..." -ForegroundColor Green
            $SourceNSG = Get-AzNetworkSecurityGroup -ResourceGroupName $SourceResourceGroupName -Name $SourceNSGName -ErrorAction Stop 
            Write-Host ("Info: Source NSG '{0}' is found and it has {1} following security rules...`n{2}" -f $SourceNSGName, $SourceNSG.SecurityRules.Count, ($SourceNSG.SecurityRules.Name -join ', ') ) -ForegroundColor Green

        }
        catch 
        { 
            Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red 
            return 
        }
    }

    # Check for source NSG, value by NSG object
    if ($PSCmdlet.ParameterSetName -eq 'NSG' -or $PSCmdlet.ParameterSetName -eq 'NewNSG')
    {
        Write-Host ("Info: Source NSG '{0}' has {1} following security rules...`n{2}" -f $SourceNSG.Name, $SourceNSG.SecurityRules.Count, ($SourceNSG.SecurityRules.Name -join ', ') ) -ForegroundColor Green
    }

    if ($SourceNSG.SecurityRules.Count -le 0)
    {
        # When source NSG doesn't have any security rules
        Write-Host ("Error: No security rules found on source NSG {0}" -f $SourceNSG.Name ) -ForegroundColor Red
        return
    }

    # Check for target NSG, value by name
    if ($PSCmdlet.ParameterSetName -eq 'Name')
    {
        try 
        { 
            Write-Host "Info: Checking for target NSG '$TargetNSGName'..." -ForegroundColor Green
            $TargetNSG = Get-AzNetworkSecurityGroup -ResourceGroupName $TargetResourceGroupName -Name $TargetNSGName -ErrorAction Stop 
            Write-Host "Info: Target NSG '$TargetNSGName' is found and ready to copy security rules from source NSG." -ForegroundColor Green
        }
        catch
        { 
            Write-Host "Error: Since there is no NSG with the name '$TargetNSGName' in '$TargetResourceGroupName', please specify '-TargetLocation' parameter to create a new NSG and copy the security rules." -ForegroundColor Red 
            return
        }
    }

    # When target NSG doesn't exist, value by name and NSG object
    if ($PSCmdlet.ParameterSetName -eq 'CreateNew' -or $PSCmdlet.ParameterSetName -eq 'NewNSG')
    {
        # Check for target NSG, if it doesn't exist then create new else continue
        if ($null -eq ($TargetNSG = Get-AzNetworkSecurityGroup -ResourceGroupName $TargetResourceGroupName -Name $TargetNSGName -ErrorAction SilentlyContinue))
        { 
            Write-Host "Info: Target NSG '$TargetNSGName' doesn't exist in '$TargetResourceGroupName' and will be creating new NSG..."
            # Create Resource Group if it doesn't exist 
            try 
            { 
                Write-Host "Info: Checking for Resource Group '$TargetResourceGroupName'..."
                $null = Get-AzResourceGroup -Name $TargetResourceGroupName -Location $TargetLocation -ErrorAction Stop 
                Write-Host "Info: Found an existing Resource Group '$TargetResourceGroupName', and skiping the Resource Group creation."
            }
            catch 
            { 
                Write-Host "Info: Resource Group '$TargetResourceGroupName' doesn't exist and will be creating new Resource Group."
                $null = New-AzResourceGroup -Name $TargetResourceGroupName -Location $TargetLocation 
                Write-Host "Info: Resource Group '$TargetResourceGroupName' has been created in $TargetLocation location."
            }
            $TargetNSG = New-AzNetworkSecurityGroup -ResourceGroupName $TargetResourceGroupName -Name $TargetNSGName -Location $TargetLocation
            Write-Host ("Info: New NSG '{0}' has been created in resource group '{1}' in '{2}' location." -f $TargetNSGName, $TargetResourceGroupName, $TargetLocation ) -ForegroundColor Green
        }
        else 
        {
            Write-Host ("Warning: The NSG '{0}' is already existed, passing '-TagetLocation' parameter value and skiping the NSG creation." -f $TargetNSGName) -ForegroundColor Yellow
        }
    }

    # For all scenarios incluing when NSG objects are provided
    try
    {
        Write-Host ("Info: Copying security rules from the source nsg '{0}' to target nsg '{1}'..." -f $SourceNSG.Name, $TargetNSG.Name) -ForegroundColor Green
        # Add source NSG security rules to target NSG
        $TargetNSG.SecurityRules = $SourceNSG.SecurityRules

        # Update target NSG
        $null = Set-AzNetworkSecurityGroup -NetworkSecurityGroup $TargetNSG -ErrorAction Stop  # $null used to supress the output

        # Success information
        Write-Host ("Info: Following {0} security rule(s) is/are copied from source NSG '{1}\{2}' to target NSG '{3}\{4}'" -f $SourceNSG.SecurityRules.Count, $SourceNSG.ResourceGroupName, $SourceNSG.Name, $TargetNSG.ResourceGroupName, $TargetNSG.Name) -ForegroundColor Green
        Write-Host ($SourceNSG.SecurityRules.Name -join ', ') -ForegroundColor Green
    }
    catch
    {
        Write-Host "Error: $($_.Exception.Message)" -ForegroundColor Red 
    }
}



Shameless Plug: Looking for Azure automation to move your test VMs? Add us to your inbound, and reach out!

1 thought on “Cloning Azure Network Security Groups with PowerShell”

Leave a Reply

Your email address will not be published. Required fields are marked *