Azure Management Tasks Part 2: How to configure the Virtual Network (VNET)

INTRODUCTION

In the previous walkthrough, we put together a basic environment, creating a resource group, a VNet, a VM, and a storage account just enough infrastructure to have something real to manage. This time we’re going back into that network and giving it some actual structure: a dedicated subnet for SFTP (Secure File Transfer Protocol) traffic, plus a network security group to control exactly what’s allowed in and out of it.

If you haven’t built the base environment yet, it’s worth going back and doing that first, everything here assumes the guided-project-vnet VNet already exists.

What You’ll Need

• Access to the Azure portal.
• The environment from Part 1 already deployed.
• A rough sense of what subnets and network security groups actually do.

Step 1: Create a new subnet on an existing virtual network (vNet).

Step 2: Create a network security group.

Create an inbound security rule.

Step 3: Associate a network security group to the subnet.

• From the Azure portal home page, in the search box, enter virtual networks.
• Select virtual networks under services.
• Select the guided-project-vnet virtual network.
• Under settings, select Subnets.
• Select the ftpSubnet you created.
• On the Edit subnet page, under the Security section heading, update the Network security group field to ftpNSG.
• Select Save.

Conclusion

What we accomplished:

• Created a dedicated ftpSubnet inside the guided-project-vnet, separating SFTP traffic from the rest of the network.

• Stood up a network security group, ftpNSG, to control access to that subnet.

• Added an inbound rule allowing only TCP traffic on port 22 — the port SFTP actually needs

• Linked the NSG to the subnet, putting those rules into effect

Why it matters:
A subnet without a security group is just an open door. By pairing the two, this subnet now only accepts the exact traffic it was designed for, and nothing else gets a free pass in.