How to add application gateway to the azure web app service

ReCloudS 40

Hi ,

I have the requirement of setting up a Azure App Gateway to the azure app service to configure a WAF rule to restrict the access from specific regions , so I will deploy an App Gateway with WAF2 and VNET to talk to each other on azure and configure frontend ip and backendpool and add the routing rule later.SO, my question here is the azure app service was existed already and and added the custom domain aswell , upon adding the new frontend public ip in the app gateway do In need to change the frontend public ip of the azure app service to the new frontend ip in the domain provider ? or if I ahve the CNAME record in place for the azure webapp I don't think I have to make any changes here , let me know If I am on the right lane ? anything would need to have a look at ?

Jose Benjamin Solis Nolasco 631 Reputation points

2025-03-03T13:12:39.6066667+00:00
@ReCloudS

You're on the right track. Since your CNAME record is already pointing to your Azure App Service, you don’t need to update anything at your domain provider when introducing the Azure Application Gateway. The CNAME ensures that requests to your custom domain (app.yourdomain.com) resolve to the App Service, and that doesn't change just because you're adding an App Gateway in front of it.

Key Things to Consider:

CNAME Stays the Same

If your DNS setup uses a CNAME pointing to yourwebapp.azurewebsites.net, you’re good.

The App Service’s frontend IP remains the same, and clients will still resolve the domain via DNS.

Configuring App Gateway Backend Pool

When setting up the backend pool in App Gateway, use the FQDN (yourwebapp.azurewebsites.net), not an IP.

If you use private endpoints, you might need an internal VNet integration.

Ensure Traffic Goes Through App Gateway
- If you want to **enforce WAF protection**, restrict direct access to the App Service by setting up **Access Restrictions**. - Allow only traffic coming from the **Application Gateway subnet** and block public access. **WAF & Region Restriction Rules** - Define custom WAF policies to block traffic from unwanted regions. - Monitor WAF logs in **Azure Monitor** or **Log Analytics** to confirm it's working as expected.

When Would You Need a DNS Update?

If you were using an A record (pointing to an IP instead of a CNAME), then you’d need to update it.

If you wanted to force all traffic through the App Gateway, you could update the CNAME to point to the App Gateway’s frontend domain instead.You're on the right track. Since your CNAME record is already pointing to your Azure App Service, you don’t need to update anything at your domain provider when introducing the Azure Application Gateway. The CNAME ensures that requests to your custom domain (app.yourdomain.com) resolve to the App Service, and that doesn't change just because you're adding an App Gateway in front of it. Key Things to Consider:

CNAME Stays the Same

If your DNS setup uses a CNAME pointing to yourwebapp.azurewebsites.net, you’re good.

The App Service’s frontend IP remains the same, and clients will still resolve the domain via DNS.

Configuring App Gateway Backend Pool

When setting up the backend pool in App Gateway, use the FQDN (yourwebapp.azurewebsites.net), not an IP.

If you use private endpoints, you might need an internal VNet integration.

Ensure Traffic Goes Through App Gateway

If you want to enforce WAF protection, restrict direct access to the App Service by setting up Access Restrictions.

Allow only traffic coming from the Application Gateway subnet and block public access.

WAF & Region Restriction Rules

Define custom WAF policies to block traffic from unwanted regions.

Monitor WAF logs in Azure Monitor or Log Analytics to confirm it's working as expected.

When Would You Need a DNS Update?

If you were using an A record (pointing to an IP instead of a CNAME), then you’d need to update it.

If you wanted to force all traffic through the App Gateway, you could update the CNAME to point to the App Gateway’s frontend domain instead.

If you found it helpful, could you kindly click the “Accept Answer and upvote” on the post.

If you have any further queries, please let us know we are glad to help you.
ReCloudS 40 Reputation points

2025-03-03T14:29:02.2333333+00:00

Thank you @Jose Benjamin Solis Nolasco for the answer. I also have quick doubt on Ensure traffic goes through app gateway how does this work ? meaning how do I set this up ? or if I simply follow this https://learn.microsoft.com/en-us/azure/web-application-firewall/ag/application-gateway-web-application-firewall-portal that would suffice right ? or necessarily I need to make changes on access restriction in the web app under settings>networking ?
Jose Benjamin Solis Nolasco 631 Reputation points

2025-03-03T15:18:07.44+00:00

Just following up @ReCloudS .

If my answer helped you resolve your issue, please consider marking it as the correct answer. This helps others in the community find solutions more easily. Thanks!

2 answers

Praveen Bandaru 700 Reputation points Microsoft External Staff

2025-03-03T14:31:14.64+00:00
Hello ReCloudS

Greetings!
I understand that you want to set up an application gateway in the frontend of your web app service.

The Application Gateway allows you to use an App Service app or other multi-tenant service as a backend pool member. App Service with Application Gateway This article explains how to configure an App Service app with Application Gateway. The configuration will vary based on how the App Service is accessed:

The first option uses a custom domain for both the Application Gateway and the backend App Service.

The second option allows the Application Gateway to access the App Service using its default domain, ending in ".azurewebsites.net".

Note: You also need to add an A record in the DNS zone pointing to the application gateway frontend IP. Only then will the traffic route via the application gateway. And remove the existing CNAME record those points to the web app in the DNS record.

Check the below reference documents:

https://learn.microsoft.com/en-us/azure/architecture/best-practices/host-name-preservation

https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app?tabs=customdomain%2Cazure-portal

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Please sign in to rate this answer.

1 person found this answer helpful.
ReCloudS 40 Reputation points

2025-03-06T07:08:20.6333333+00:00

@praveen Bandaru Thanks for answering , by reading your answer , you were stating that even though the CNAME is added , I must remove that from the records and add the Frontend IP which we created during App gateway this needs to be added compulsory right ? inorder to pass the traffic from App gateway to the Web app ?

Praveen Bandaru 700 Reputation points Microsoft External Staff

2025-03-06T07:39:19.9833333+00:00

Hello ReCloudS

Greetings!

Thank you for your response.

Yes, you are correct. If you want to route the traffic through the application gateway, you need to create an "A" record pointing to the application gateway frontend public IP. Only then will the traffic be routed through the application gateway. Additionally, remove the existing CNAME record those points to the web app in the DNS record.

Hope the above answer helps! Please let us know do you have any further queries.

Please do consider to “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Praveen Bandaru 700 Reputation points Microsoft External Staff

2025-03-07T09:11:42.16+00:00

Hello ReCloudS

Greetings!

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Praveen Bandaru 700 Reputation points Microsoft External Staff

2025-03-10T02:47:45.9533333+00:00

Hello ReCloudS

Greetings!

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Jose Benjamin Solis Nolasco 631 Reputation points

2025-03-03T14:36:04.7866667+00:00

I strongly suggest you to ensure that all traffic goes thought the gateway making changes on the service app as you said, you are almost in the right way @ReCloudS

Additionally these video help me out when I have the same doubt.

1- https://www.youtube.com/watch?v=xtey4xQjG70&pp=ygUqIEVuZm9yY2luZyBUcmFmZmljIFRocm91Z2ggdGhlIEFwcCBHYXRld2F5

2-https://www.youtube.com/watch?v=B3O6bXu-NbM&pp=ygUqIEVuZm9yY2luZyBUcmFmZmljIFRocm91Z2ggdGhlIEFwcCBHYXRld2F5

If you found it helpful, could you kindly click the “Accept Answer and upvote” on the post.

If you have any further queries, please let us know we are glad to help you.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to add application gateway to the azure web app service

2 answers

Your answer