Introduction to Azure Application Gateway

Azure Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications. It provides load balancing across various virtual machines and services, whether they are in the cloud or on-premises.

Application Gateway offers a variety of layer 7 load balancing capabilities, including:

SSL termination and end-to-end SSL encryption.
Cookie-based session affinity.
Web Application Firewall (WAF) for protection against common web vulnerabilities.
URL-based routing.
Multiple site hosting.
Redirection.
Path-based routing.
Rewrite HTTP headers and URLs.

It operates at the application layer (Layer 7), allowing for more intelligent routing decisions based on attributes like request headers, URIs, and server variables.

Key Features

Application Gateway is designed to be a robust and scalable solution for modern web applications. Its key features include:

SSL Termination and End-to-End SSL: Offload SSL processing from your web servers and maintain SSL encryption all the way to your backend.
Web Application Firewall (WAF): Protect your web applications from common exploits and vulnerabilities like SQL injection and cross-site scripting.
URL-Based Content Routing: Route traffic to different backend pools based on the URL path of the request.
Cookie-Based Session Affinity: Ensure that requests from the same client are consistently sent to the same backend server.
Multiple Site Hosting: Host multiple web applications on the same Application Gateway instance.
Health Monitoring: Continuously monitor the health of backend instances to ensure traffic is only sent to healthy servers.
Autoscaling: Automatically scales up or down to handle varying traffic loads.
HTTP/HTTPS Load Balancing: Distributes incoming HTTP and HTTPS traffic across multiple backend resources.

Architecture Overview

An Azure Application Gateway consists of several key components that work together to manage and route web traffic:

Frontend IP Configuration: The public or private IP address that the Application Gateway listens on for incoming traffic.
Listeners: A combination of frontend IP, port, and protocol (HTTP or HTTPS) that matches incoming requests.
Backend Pools: A collection of backend servers (e.g., Virtual Machines, Virtual Machine Scale Sets, App Services) that will serve traffic.
HTTP Settings: Define how Application Gateway forwards requests to the backend pool. This includes protocol, port, cookie affinity, connection draining, and custom probes.
Routing Rules: Connects a listener, backend pool, and HTTP settings to define how traffic flows.
Health Probes: Used to test the health of backend servers.

The Application Gateway acts as a reverse proxy, receiving incoming requests and forwarding them to the appropriate backend server based on configured rules.

Configuration Steps

Configuring an Azure Application Gateway involves defining several interconnected resources. Below is a high-level overview of the essential steps:

Frontend IP Configuration

You can configure a single public IP address, a single private IP address, or both for your Application Gateway. This is the IP address clients will connect to.

Choose a public IP for internet-facing applications or a private IP for internal applications.

Backend Pools

Define the groups of backend servers that will receive traffic. These can be individual VMs, VMSS, or even other Azure services.

Example of a backend pool definition:

    Resource "myBackendPool" of Microsoft.Network/applicationGateways/backendAddressPools @ "2023-04-01" {
        name: "appGatewayBackendPool"
        properties {
            backendIPConfigurations = [
                {
                    ipAddress: "10.0.0.4"
                },
                {
                    ipAddress: "10.0.0.5"
                }
            ]
        }
    }
                

Listeners

A listener is a logical component that accepts connections from clients. It requires a frontend IP, port, and protocol.

For HTTPS listeners, you'll also need to configure an SSL certificate.

Routing Rules

Routing rules bind a listener to a backend pool and HTTP settings. This is where you define the logic for directing traffic.

Path-based routing rules can direct traffic to different backend pools based on the URL path.

Health Probes

Configuring custom health probes allows Application Gateway to actively check the health of backend instances. You can specify the protocol, host, path, interval, and thresholds.

Well-defined health probes are crucial for maintaining application availability.

HTTP Settings

HTTP settings define how Application Gateway communicates with the backend. Key settings include:

Protocol: HTTP or HTTPS.
Port: The port on which the backend servers listen.
Cookie-based affinity: Enable or disable.
Connection draining: Gracefully remove backend servers from service.
Request timeout: Set the timeout for requests.

Security Considerations

Azure Application Gateway offers robust security features to protect your web applications:

Web Application Firewall (WAF): Deploy managed rulesets (e.g., OWASP Core Rule Set) or custom rules to defend against common attacks.
SSL/TLS Encryption: Enforce secure connections using SSL certificates and configure cipher suites.
Network Security Groups (NSGs): Apply NSGs to the subnet where Application Gateway resides to control network traffic.
Private Endpoints: For enhanced security, use private endpoints to connect to backend services, keeping traffic within your virtual network.
IP Restrictions: Restrict access to your Application Gateway based on source IP addresses.

Monitoring and Diagnostics

Effective monitoring is key to ensuring the health and performance of your Application Gateway:

Azure Monitor: Collect metrics on request counts, latency, errors, and backend health.
Diagnostic Logs: Enable detailed logs for request logs, application gateway logs, and WAF logs. These can be sent to Log Analytics, Storage Accounts, or Event Hubs.
Application Gateway Health: Monitor the health status of backend instances directly within the Azure portal.
WAF Logs: Analyze WAF logs to identify and investigate security threats.

Troubleshooting Common Issues

When encountering issues with your Application Gateway, consider the following:

Health Probe Failures: Verify that health probes are correctly configured and that backend servers are responsive on the specified port and path. Check NSGs and firewall rules.
5xx Errors: Investigate backend server logs, Application Gateway logs, and ensure the backend is reachable and healthy.
SSL/TLS Handshake Failures: Confirm that the correct SSL certificate is uploaded and associated with the listener. Check cipher suite compatibility.
Routing Problems: Review routing rules, listener configurations, and backend pool associations. Ensure correct host headers and URL paths are being used.
WAF Blocking Legitimate Traffic: If the WAF is blocking valid requests, review WAF logs and consider tuning custom rules or exceptions.

Refer to the official Azure documentation for more in-depth troubleshooting guides.

Azure Application Gateway Details