Articles → MICROSOFT AZURE → IP Flow Verify Tool Of The Network Watcher In Azure

IP Flow Verify Tool Of The Network Watcher In Azure

In this article, we will discuss the IP flow verify tool of the network watcher in azure.

Purpose

The IP flow verify tool checks if the traffic is allowed to-and-fro between 2 virtual machines.

Check The Communication Between The Virtual Machines

Consider the following network in Azure.

Picture showing the diagram that shows the arrangement of virtual machines inside the different subnets of the same virtual network

Click to Enlarge

Below are the virtual machines as per the above diagram in the Azure portal.

Picture showing the list of virtual machines in different subnets of the virtual network in the Azure portal

Click to Enlarge

In all the virtual machines, we have the same set of NSG rules.

Picture showing the inbound port rules that are common to all three virtual machines in the Azure portal

Click to Enlarge

Now, let us try to answer the below questions

Can VM1 and VM2 communicate? Answer: Yes, because
1. Both virtual machines are in the same virtual network
2. Rule no 65000 i.e., AllowVNetInbound is enabled
Can VM1 and VM3 communicate? Answer: No, because
1. Both virtual machines are on different networks
2. There is no peering between the virtual networks
3. Rule no 65500 i.e., DenyAllInbound is enabled

Let us check the above 2 scenarios using the IP flow verify tool.

IP Flow Verify Tool

First, search the word network in the search box. Click on the Network Watcher service in the search result.

Picture showing the network watcher in the search menu

Click to Enlarge

On the network watcher screen, click on the IP flow verify submenu. A screen will open on the right-hand side.

Picture showing the IP flow verify screen inside the network watcher

Click to Enlarge

Along with the other details, enter the IP address of VM1 and VM2 and click on the Check button.

Picture showing the section of the screen to check the connection between the 2 virtual machines

Click to Enlarge

The output is that communication is allowed because of the rule AllowVnetInBound. Now, change the IP address of VM2 with VM3 and click on the Check button.

Picture showing the section of screen to check the connection between vm2 and vm3

Click to Enlarge

The output is that communication is not allowed because of rule DenyAllInBound

Posted By -	Karan Gupta

Posted On -	Saturday, May 8, 2021

Query/Feedback

Your Email Id		**

Subject		*

Query/Feedback	Characters remaining 250	**