Cannot isolate Azure subnets in same virtual network - azure

Question

I may be way off base here because I am not a networking expert, and new to Azure. I am having problems isolating two subnets in an Azure virtual network.
Scenario:
One virtual network (vn) with address space 10.0.0.0/16.
Two subnets (subnet1 and subnet2)
subnet1: 10.0.0.0/24
subnet2: 10.0.1.0/24
Two virtual machines (vm1 and vm2). Each virtual machine is Windows Server 2012 R2 with Windows Firewall disabled.
vm1 lives in subnet1,
vm2 lives in subnet2
vm2 has web service bound to port 5550. vm1 has client (browser) hitting web service on vm2. I can successfully access the web server action on vm2 via client (browser) on vm1.
Two network security groups (nsg1 and nsg2).
nsg1 is associated with subnet1,
nsg2 is associated with subnet2
The default inbound rules, particularly for nsg2, allows access from vnet via default rule:
PRIORITY: 65000,
NAME: AllowVnetInbound,
SOURCE: VirtualNetwork,
DESTINATION: VirtualNetwork,
SERVICE: Custom(Any/Any),
ACTION: Allow
I am trying to configure nsg2 to DENY traffic from vm1 to vm2 i.e. subnet1 to subnet2. I can't seem to make this work; not matter what deny rule I put in place the client on vm1 is always able to access the web server on vm2.
I added a new rule with higher priority:
PRIORITY: 200,
NAME: DenyVnetInbound,
SOURCE: VirtualNetwork,
DESTINATION: VirtualNetwork,
SERVICE: Custom(Any/Any),
ACTION: Deny
Does not work, client on vm1 is still able to access web server on vm2.
Also tried variations..
PRIORITY: 200,
NAME: DenyVnetInbound,
SOURCE: 10.0.0.0/24,
DESTINATION: 10.0.1.0/24,
SERVICE: Custom(Any/Any),
ACTION: Deny
This doesn't work either. Is it possible to isolate subnets in the same virtual network in Azure?

Answer 1

I can now block other subnets in a repeatable fashion. I am using rule:
PRIORITY: 4000
NAME: DenyVNet
SOURCE: VirtualNetwork
DESTINATION: All
SERVICE: Custom (Any/Any)
ACTION: Deny
I believe the root cause is that I had a faulty test(s). I suspect the issue has to do with HTTP persistent connections from the browser (and other test applications using HTTP). HTTP Keep-Alive?
When I change the NSG rules (inbound on target subnet):
ACTION RESULT
Kill both client and service New rule always works
Kill either client or service New rule works...most of time
Don't kill either client or service New rule never works, old rule behaviour remains
This pattern seems repeatable for Azure NSGs. I also believe this to be the case for AWS VPC security groups / network ACLs.