Network Security Groups

Related Resources

Virtual Networks

Public IP Addresses

Syslog Collector

Virtual Machines

In Azure

nsg-maxconf-test

nsg-maxconf-prod

nsg-pexip-syslogs-prod :::

Overview

Network Security Groups enforce ingress policy for conferencing, signaling, and supporting infrastructure traffic. Test and production Pexip nodes use mirrored NSG rule sets. The syslog collector has its own NSG because it accepts only syslog traffic and restricted admin access.

NSG Inventory

NSG	Resource Group	Rule Count
nsg-maxconf-test	rg-application-test	11
nsg-maxconf-prod	rg-application	11
nsg-pexip-syslogs-prod	rg-pexip-syslogs-prod	Managed by IaC

Inbound Rule Profile

Representative allowed inbound ports include:

• 80/tcp, 443/tcp for web/API endpoints
• 1720/tcp, 1719/udp for H.323 signaling
• 5060/tcp, 5060/udp, 5061/tcp for SIP/SIPS signaling
• 33000-39999/tcp+udp for signaling ranges
• 40000-49999/tcp+udp for media ranges

For the syslog collector, representative inbound rules are:

• 514/tcp from the MaxConf/Pexip subnet CIDRs for syslog ingestion
• 22/tcp from approved admin source CIDRs only

Operational Notes

• Changes to NSG rules can immediately impact active video sessions.
• Any production NSG change should be coordinated through CAB and verified in test first.