title: Adding NSG rules to enable high availability on Azure PostgreSQL Flexible Server
body: <p>I am trying to enable ZoneRedundant High Availability on our Azure PostgreSQL Flexible server.</p>
  <p>The Azure documentation mentions the following important step:</p>
  <blockquote>
  <p>High availability Features of Azure Database for PostgreSQL - Flexible Server require ability to send\receive traffic to destination ports 5432, 6432 within Azure virtual network subnet where Azure Database for PostgreSQL - Flexible Server is deployed , as well as to Azure storage for log archival. If you create Network Security Groups (NSG) to deny traffic flow to or from your Azure Database for PostgreSQL - Flexible Server within the subnet where its deployed, please make sure to allow traffic to destination ports 5432 and 6432 within the subnet, and also to Azure storage by using service tag Azure Storage as a destination.</p>
  </blockquote>
  <p>I'm finding it hard to get my head around this from the way it is written and can't find many details about it elsewhere.</p>
  <p>From what I understand, the first requirement is to add an inbound NSG rule as follows:</p>
  <pre><code>Source IP: [CIDR of the database subnet]
  Source Port Range: *
  Destination IP addresses: [CIDR of the database subnet]
  Destination Port Ranges: 5432,6432
  Action: Allow
  Priority: [Any number before the default inbound DENY rules]
  </code></pre>
  <p>Have I read this correctly? We are effectively allowing traffic between the instance and the replication instance within the subnet, so the source IP and the destination IP should both be the database subnet CIDR.</p>
  <p>I know that NSGs are stateful. So am I right in saying I don't need any Outbound rule for this case?</p>
  <p>The second requirement to allow traffic 'to Azure storage by using service tag Azure storage as a destination' is confusing me. From the way this is written I don't know if it should be an inbound or an outbound rule. My first guess was outbound as logs would be moving FROM the database to Azure storage. Is that correct?</p>