Does Azure App Gateway WAF V2 uses same static public IP for outbound calls?

Question

To call our client APIs, I provided my client with my Azure WAF V2 Application Gateway public IP (2*..*.*9 (MY-AppGateway-pip)) to safelist our IP, and they successfully safelisted it.

However, I am still unable to hit their APIs. Upon further investigation, they informed me that my requests were coming from a different IP address than the provided Azure App Gateway public IP.

Could anyone shed some light on this issue?

Answer 1

Hello Raghava Sai Akula

from my experiance the AppGW PIP uses only for the inbound traffics, if you want to whaitlisted your outpound Public IP check your NAT GW public IP or the other outbound Connectivity" Virual hub, experss route".

-Ahmed Hammam

Azure Arch certified

Answer 2

@Raghava Sai Akula

I understand you wish to know which IP address is used by Azure Application Gateway when it is reaching out to the Client API.

The behavior here will actually depend on how the API call is implemented by the backend server.

If the Client API endpoint is added as a Backend Pool member of your Application Gateway then the IP used by the Application Gateway will be as documented here

Based on the API Endpoint Backend:

• Is a public endpoint, the application gateway uses its frontend public IP to reach the server. If there isn't a frontend public IP address, one is assigned for the outbound external connectivity.
• Contains an internally resolvable FQDN or a private IP address, the application gateway routes the request to the backend server by using its instance private IP addresses.
• Contains an external endpoint or an externally resolvable FQDN, the application gateway routes the request to the backend server by using its frontend public IP address. If the subnet contains service endpoints, the application gateway will route the request to the service via its private IP address. DNS resolution is based on a private DNS zone or custom DNS server, if configured, or it uses the default Azure-provided DNS. If there isn't a frontend public IP address, one is assigned for the outbound external connectivity.

If the Client API endpoint is not added as the backend pool member of your Application Gateway. In this scenario if the Client API Endpoint is accessed over the internet then the request would be sent using the backend pools Public IP address.As mentioned by Ahmed above the Application Gateway's Public IP is only used for inbound traffic. If there is a requirement to send a outbound connection from the backend pool member then it recommended to use Azure Firewall for such communication as described here.

Hope this helps! Please let me know if you have any additional questions. Thank you!

---

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.