going with the application gateway in fornt of azure firewall does it lose the benefit of l7 load balancing

Question

I have an Azure firewall in a hub and spoke architecture, and one of the spokes contains my web servers, for HTTPS filtering I have an application gateway with the WAF feature and l7 load balancing. I have a requirement to keep centralized security management. Does placing the application GW in front of the Azure firewall cause the layer 7 load balancing feature to be lost? If the non-HTTPS traffic hits app GW and is then forwarded to Azure FW then it is forwarded back to app GW to keep l7 load balancing capabilities, does that add latency that Azure FW can't handle? What is the best practice in this case while keeping centralized security management?

Answer 1

@Mohammad Nemer ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are trying to configure Application Gateway before Firewall set up.

To address your queries,

#1. Does placing the application GW in front of the Azure firewall cause the layer 7 load balancing feature to be lost?

• The Load Balancing will happen without any issues.
• From App Gateway perspective, the backends are still the VMs
• You are using the UDR to force the traffic to route via AzFW before the backend VMs.

#2. If the non-HTTPS traffic hits app GW and is then forwarded to Azure FW then it is forwarded back to app GW to keep l7 load balancing capabilities, does that add latency that Azure FW can't handle?

• I doubt you will be able to achieve such an architecture design.
• Moreover, in this scenario, non-HTTPS/HTTP traffic would not hit the App Gateway to begin with, see : Summarized Table
  • 

Please review the workflow,

• In step 2,
• 

Please let us know if we can be of any further assistance here.

Thanks,

Kapil

---

Please Accept an answer if correct.

Original posters help the community find answers faster by identifying the correct answer.