I am trying to put application gateway as origins in azure front door. Can anyone point me in the right documentation

Hi @Gowda, Hariprasad , Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you are trying to add Azure AppGateway behind an AFD. You can refer to the below , Refer : https://learn.microsoft.com/en-us/azure/frontdoor/how-to-configure-origin Go to your front-door and navigate to Origin-groups Click on "Add". Then click on "Add an Origin" Under OriginType, select Application Gateway Then under Host name, select the application gateway which you want to add. Please refer to the below document on scenarios where you would need this setup https://learn.microsoft.com/en-us/azure/frontdoor/front-door-faq under "When should we deploy an Application Gateway behind Front Door?". Feel free to let us know if you have any queries on this. Cheers, Kapil. ---------------------------------------------------------------------------------------------------------------- Please don’t forget to close the thread by clicking " Accept the answer " wherever the information provided helps you, as this can be beneficial to other community members.

Azure frontdoor behind Azure application gateway

Accepted answer

KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2022-08-04T08:43:58.22+00:00
Hi @Gowda, Hariprasad ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you are trying to add Azure AppGateway behind an AFD.

You can refer to the below ,

Refer : https://learn.microsoft.com/en-us/azure/frontdoor/how-to-configure-origin

Go to your front-door and navigate to Origin-groups

Click on "Add". Then click on "Add an Origin"

Under OriginType, select Application Gateway

Then under Host name, select the application gateway which you want to add.

Please refer to the below document on scenarios where you would need this setup
https://learn.microsoft.com/en-us/azure/frontdoor/front-door-faq under "When should we deploy an Application Gateway behind Front Door?".

Feel free to let us know if you have any queries on this.

Cheers,
Kapil.

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.
Gowda, Hariprasad 86 Reputation points

2022-08-04T08:55:10.227+00:00

Is there any document that refers to the configuration of Application Gateway behind Front Door

KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2022-08-04T09:06:49.463+00:00

Hi @Gowda, Hariprasad ,

There are no specific documents as such.

Configuring the app gateway as the origin is a straightforward process and you can diretly select the origin as AppGateway from the Portal.

If this answers your query, please don’t forget to click "Accept the answer" and Up-Vote for the same, which might be beneficial to other community members reading this thread

Cheers,
Kapil.

Gowda, Hariprasad 86 Reputation points

2022-08-04T09:14:59.27+00:00

So NSG rules on the application gateway subnet is not needed right?
If my Application Gateway's frontend IP is private will this configuration works as it is? Or do we need to any other changes for it to work

KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2022-08-04T09:35:02.287+00:00

Hi @Gowda, Hariprasad ,

With respect to NSG,

You will be required to create an Inbound rule for the service tag FrontDoor.backend

https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview

Placing the App Gateway behind AFD is like placing any other public-facing resource behind AFD.

Refer : https://learn.microsoft.com/en-us/azure/frontdoor/front-door-faq under "How do I lock down the access to my backend to only Azure Front Door?"

With respect to Private IP,

App Gateway should have a public IP associated with it.

Any resource behind AFD requires public internet connectivity.

The only exception is when we make use of the Private Link service: https://learn.microsoft.com/en-us/azure/frontdoor/private-link

However, the above is applicable only for a Load balancer, App Service, and Storage account, not for an App gateway as of now.

Hope the above helps. Please let me know if you need more details on any of the above points.

Cheers,
Kapil.

-------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Gowda, Hariprasad 86 Reputation points

2022-08-04T10:57:53.797+00:00

Previously application gateway's IP had the Domain name associated. Now i configured the Front door and put the appGw in the backend. My domain is now associated to endpoints of the Front door. Even though all configuration is done. My application isn't working

KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2022-08-04T11:27:27.143+00:00

Hi @Gowda, Hariprasad ,

Are you able to access the Application gateway directly?

Either by using the Public IP address of the App Gateway or by configuring host file entry to map the Domain name to App Gateway's public IP?

What error are you getting when you try to access the site via the Front door?

Any HTTP error code/status or time out?

Make sure the origin is healthy and AFD is able to reach it.

You can check the metrics section of AFD to verify the above : https://learn.microsoft.com/en-us/azure/frontdoor/standard-premium/how-to-monitor-metrics

Please make sure the domain validation state is approved

https://learn.microsoft.com/en-us/azure/frontdoor/standard-premium/how-to-add-custom-domain#domain-validation-state

Thanks,
Kapil

Gowda, Hariprasad 86 Reputation points

2022-08-04T12:00:17.493+00:00

Thanks for the help. My issue got resolved. In my App gateway NSG there was one inbound rule which was allowing the internet inbound. I removed it and it is working fine now

KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2022-08-04T13:15:34.347+00:00

Sure.

Thanks for keeping the thread updated.

Cheers,
Kapil.

Lakkappa Sunagar 0 Reputation points

2023-05-30T10:21:10.7733333+00:00

Hi There!

I am also trying to on board an custom domain with application gateway as origin type under the origin Groups in Azure Front Door. But I am trying to achieve this with automation (i.e. with Terraform resource) but not getting proper guidelines or documents which illustrates choosing of different origin types under the Origin Group either with the terraform or PowerShell. Could you please share if you have anything?

KapilAnanth-MSFT 48,081 Reputation points Microsoft Employee

2023-05-31T11:45:09.53+00:00

Lakkappa Sunagar

You can try using New-AzFrontDoorCdnOrigin

Here, you should give the Application Gateway's resource ID and this should add the Azure resource as the Origin

Cheers,

Kapil
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure frontdoor behind Azure application gateway

0 additional answers

Your answer