Keep managed Service Fabric NSG overrides inside the supported priority band

Source facts

Service Fabric managed clusters reserve NSG priorities 0–999 for essential functionality and prohibit custom rules below 1000. Custom rules belong in priorities 1000–3000 and can override the optional rules placed at 3001–4000. The provider-access rule for the cluster client and HTTP gateway ports is always created and cannot be overridden. Microsoft Learn.

Applicability

Use this distinction when reviewing the managed cluster’s networkSecurityRules configuration. Identify the actual rule being challenged before selecting a priority. This article addresses the managed service’s rule-ownership boundary, not a general Windows Firewall precedence policy or permission to open an application port.

DSE recommendation

DSE recommends classifying a proposed exception as an override of an optional rule or a conflict with required provider access. Record the target rule, traffic direction, ports and intended scope. If the design assumes that a custom deny can suppress the provider’s mandatory gateway rule, return that assumption to the architecture owner instead of trying increasingly aggressive priority values. Keep application access requests separate from service-management requirements.

Verification

Review the deployed effective rules against the proposed configuration in a controlled cluster. Confirm that the custom rule falls within the supported band and affects only the optional traffic being changed. Check both the intended allowed or denied application path and continued management access. Preserve the observed rule identifiers and priorities with the change record; the presence of a custom rule alone does not show which traffic it controls.

Official references

Microsoft Learn. Source retrieved September 9, 2026.