and on Azure Stack
Published: 2019-10-26

If you configure restricted NSG without “Internet” service tag on Azure Stack, you need to consider and This entry is the summary of my investigation about and on Azure Stack.


ASDK 1908 in @syuheiuda ’s physical container

Ref:https://thinkit.co.jp/article/13243 is an instance metadata service. A virtual machine needs to access during the deployment process. If the NSG which is attached to the virtual machine blocks the outbound traffic to, the deployment of this virtual machine becomes a timeout and fails.

In Azure, NSG permits the traffic to implicitly. But in Azure Stack, NSG doesn’t allow the traffic to implicitly. You need to add “” or “Internet” to NSG to allow the traffic to is DHCP, DNS and etc on in VNet. also is not permitted implicitly in NSG. If NSG blocks the traffic to and a virtual machine uses a default DNS server, a virtual machine can’t resolve FQDN.

In Azure, is in “VirtualNetwork” service tag. But in Azure Stack, is not in “VirtualNetwork”. You need to add “” or “Internet” to allow the traffic to