Hi there, I've been facing an issue with FrontDoor health probe and the application gateway that I'm unable to find a solution to. I have the following architecture. Frontdoor has a few routes and origin groups with two origins configured with each origin pointing to IP addresses of AGW 1 and AGW 2. AGW 1 has a priority of 1 while AGW 2 has a priority of 2. The origin host headers of origins point to some domains and not the IP of the application gateway. This has been done for AGW to understand and route requests to appropriate applications on AKS. AGW has been connected to AKS via ingress controllers and health probes are also configured. Both health probes are configured with the same path and HTTP method. With the context set, I'll come to the problem I'm facing. The health probes from Frontdoor have been only throwing a 404 status code even if the probes configured with AGW show a status of healthy for all applications. The SampleSize is configured to 4 and SuccessfulSampleSize is configured to 4 to avoid false positives. The status code for health probes from frontdoor was viewed from the FrontdoorHealthProbeLogs . Any help would be greatly appreciated, thanks!

Frontdoor Health probe throws 404 with application gateway

Tricky Clown 0

Hi there,
I've been facing an issue with FrontDoor health probe and the application gateway that I'm unable to find a solution to. I have the following architecture.

Frontdoor has a few routes and origin groups with two origins configured with each origin pointing to IP addresses of AGW 1 and AGW 2. AGW 1 has a priority of 1 while AGW 2 has a priority of 2.
The origin host headers of origins point to some domains and not the IP of the application gateway. This has been done for AGW to understand and route requests to appropriate applications on AKS.
AGW has been connected to AKS via ingress controllers and health probes are also configured.
Both health probes are configured with the same path and HTTP method.

With the context set, I'll come to the problem I'm facing. The health probes from Frontdoor have been only throwing a 404 status code even if the probes configured with AGW show a status of healthy for all applications. The SampleSize is configured to 4 and SuccessfulSampleSize is configured to 4 to avoid false positives.

The status code for health probes from frontdoor was viewed from the FrontdoorHealthProbeLogs.

Any help would be greatly appreciated, thanks!

Praveen Bandaru 425 Reputation points Microsoft Vendor

2025-02-03T13:25:27.4633333+00:00

Hello Tricky Clown

Greetings!

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are encountering an issue with the Front Door health probe.

Your front door backend is configured with an application gateway using a multisite listener. When accessing the front door URL, you receive a 404-status code because the front door is unable to determine the correct route for the request. The AFD health probe sends a request to the application gateway's public IP. If there is no basic listener application, it will return a 404 response. You can review the application gateway access logs in your Azure portal for further details.

To resolve this, please test by replacing the origin URLs with the application gateway listener hostname.

I hope this has been helpful!

Your feedback is important so please take a moment to accept answers. If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.
Tricky Clown 0 Reputation points

2025-02-03T14:11:41.32+00:00
Hello @Praveen Bandaru ,

Thank you for the quick response. I have indeed configured the listener's hostname as the origin URL on AFD. For your understanding, I'll provide an end-to-end example below:

Suppose we have the following domain mysubdomain.contoso.com and the health probe runs on /check path. With this, the following are configured in both the AGW.

There's one listener on port 443 with the hostname mysubdomain.contoso.com which is associated with one rule and that rule is further associated with one backend setting and backend pool.

The backend setting associated with that same listener also has a health probe configured on the same hostname in the path /check.

Suppose we have the following endpoint in AFD myendpoint.azurefd.net and the following is configured under that endpoint:

The hostname (mysubdomain.contoso.com) is added as a domain on AFD domains with SSL.

The hostname is also correctly pointing to the endpoint as a CName record.

A route is created and is associated with this domain and an origin group.

Inside the origin group there are two origins with the following configuration:

Hostname -> IP of AGW

Origin-Host header -> hostname of listener (mysubdomain.contoso.com)

The health probe is also configured to /check for the AFD health probe perfectly mirroring the AGW health probe.

Note: The application is accessible on the URLs but all traffic is being routed through AGW 2 which has a priority 2 even when applications are running AGW 1 with a priority of 1. This was checked from AFD access logs.
Praveen Bandaru 425 Reputation points Microsoft Vendor

2025-02-03T14:37:42.2033333+00:00

Hello Tricky Clown

Greetings!

Thank you for your response.

I understand that you are using same host name for application gateway and azure front door. Can please try to check Application gateway logs for AFD health probe request to see what backend of application gateway is giving.

Thanks
Tricky Clown 0 Reputation points

2025-02-04T06:56:16.77+00:00

Hello @Praveen Bandaru ,

I've checked the logs and I found something rather bizarre. I see that the AFD health probe logs show a status code of 404 and 502 for both AGWs but when viewing the logs from AGW it shows a status of 200 for the same time.

Does AFD health probe logs only show failed requests or does it display success request as well?
Praveen Bandaru 425 Reputation points Microsoft Vendor

2025-02-04T13:03:46.2366667+00:00

Hello Tricky Clown

Greetings!

Thank you for your response.

The front door health probe logs only display failed requests. Please review your application gateway logs and verify whether the application gateway backend is in a healthy or unhealthy state.

Additionally, in the application gateway logs, please filter by the user agent as 'edge health' to observe how the application gateway is responding to AFD health probes.
Praveen Bandaru 425 Reputation points Microsoft Vendor

2025-02-05T11:23:58.7633333+00:00

Hello Tricky Clown

Greetings!

Following up to see if the above suggestion was helpful. And, if you have any further query do let us know.

Thanks

Share via

Frontdoor Health probe throws 404 with application gateway

Your answer