title: Is using NSG on AKS advanced networking subnet supported and what are the ports needed to be open between nodes and master?
body: <p>What port for TCP/UDP communication needs to be open between the nodes and the master of azure kubernetes services, when the nodes are in a subnet that uses advanced networking?</p>
  
  <p>For security reasons we have to use a Network Security Group on every subnet that is connected to the onpremises network via VPN in azure. This NSG has to deny every implicit traffic between machines even in the same subnet to hinder attackes from traversing between systems. 
  So it is the same for the azure kubernetes services with advanced networking, that uses a subnet which is connected via vnet peering.</p>
  
  <p>We couldn't find an answer if it is a supported scenario to have a NSG on the subnet of the aks advanced network and what ports are needed to make it work.</p>
  
  <p>We tried our default NSG which denies inter traffic between host, but this hinders us from connecting to the services and from nodes to come up without errors.</p>