Skip to content

Commit 767f0ca

Browse files
Update NSG and routing information for private endpoints
Clarified the role of network policies and NSG for private endpoints, including routing behavior and enforcement details.
1 parent ed909b6 commit 767f0ca

1 file changed

Lines changed: 2 additions & 2 deletions

File tree

articles/redis/private-link.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -306,9 +306,9 @@ If you delete all private endpoints on your Azure Managed Redis cache, networkin
306306

307307
### Are network security groups (NSG) enabled for private endpoints?
308308

309-
No, they're disabled for private endpoints. While subnets containing the private endpoint can have NSG associated with it, the rules aren't effective on traffic processed by the private endpoint. You must have [network policies enforcement disabled](/azure/private-link/disable-private-endpoint-network-policy) to deploy private endpoints in a subnet. NSG is still enforced on other workloads hosted on the same subnet. Routes on any client subnet use a /32 prefix, changing the default routing behavior requires a similar UDR.
309+
Network policies are disabled for private endpoints. To enforce Network Security Group (NSG) and User-Defined Route (UDR) rules on private endpoint traffic, network policies must be enabled on the subnet. When network policies are disabled (required to deploy private endpoints), NSG and UDR rules do not apply to traffic processed by the private endpoint. For more information, please visit:https://learn.microsoft.com/en-us/azure/private-link/disable-private-endpoint-network-policy?tabs=network-policy-portal. NSG and UDR rules continue to apply normally to other workloads in the same subnet.
310310

311-
Control the traffic by using NSG rules for outbound traffic on source clients. Deploy individual routes with /32 prefix to override private endpoint routes. NSG Flow logs and monitoring information for outbound connections are still supported and can be used.
311+
Traffic from client subnets to private endpoints uses a /32 prefix. To override this default routing behavior, create a corresponding UDR with a /32 route.
312312

313313
### My private endpoint instance isn't in my VNet, so how is it associated with my VNet?
314314

0 commit comments

Comments
 (0)