Application Gateway (Layer 7) in Azure - Commands & Configuration

Introduction

When you want to control and secure web traffic to your apps, an Application Gateway helps by managing traffic at the web level. It directs user requests to the right place and protects your apps from bad traffic.

When you want to balance web traffic across multiple servers to keep your app fast and available

When you need to block harmful web requests before they reach your app

When you want to route users to different parts of your app based on the web address they use

When you want to add SSL encryption to secure user data between them and your app

When you want to monitor and log web traffic to understand user behavior and troubleshoot issues

Config File - application-gateway.json

application-gateway.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "resources": [
    {
      "type": "Microsoft.Network/applicationGateways",
      "apiVersion": "2023-02-01",
      "name": "myAppGateway",
      "location": "eastus",
      "properties": {
        "sku": {
          "name": "Standard_v2",
          "tier": "Standard_v2",
          "capacity": 2
        },
        "gatewayIPConfigurations": [
          {
            "name": "appGatewayIpConfig",
            "properties": {
              "subnet": {
                "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVnet/subnets/mySubnet"
              }
            }
          }
        ],
        "frontendIPConfigurations": [
          {
            "name": "appGatewayFrontendIP",
            "properties": {
              "publicIPAddress": {
                "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Network/publicIPAddresses/myPublicIP"
              }
            }
          }
        ],
        "frontendPorts": [
          {
            "name": "appGatewayFrontendPort",
            "properties": {
              "port": 80
            }
          }
        ],
        "backendAddressPools": [
          {
            "name": "appGatewayBackendPool",
            "properties": {
              "backendAddresses": [
                { "ipAddress": "10.0.1.4" },
                { "ipAddress": "10.0.1.5" }
              ]
            }
          }
        ],
        "backendHttpSettingsCollection": [
          {
            "name": "appGatewayBackendHttpSettings",
            "properties": {
              "port": 80,
              "protocol": "Http",
              "cookieBasedAffinity": "Disabled"
            }
          }
        ],
        "httpListeners": [
          {
            "name": "appGatewayHttpListener",
            "properties": {
              "frontendIPConfiguration": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', 'myAppGateway'), '/frontendIPConfigurations/appGatewayFrontendIP')]"
              },
              "frontendPort": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', 'myAppGateway'), '/frontendPorts/appGatewayFrontendPort')]"
              },
              "protocol": "Http"
            }
          }
        ],
        "requestRoutingRules": [
          {
            "name": "rule1",
            "properties": {
              "ruleType": "Basic",
              "httpListener": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', 'myAppGateway'), '/httpListeners/appGatewayHttpListener')]"
              },
              "backendAddressPool": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', 'myAppGateway'), '/backendAddressPools/appGatewayBackendPool')]"
              },
              "backendHttpSettings": {
                "id": "[concat(resourceId('Microsoft.Network/applicationGateways', 'myAppGateway'), '/backendHttpSettingsCollection/appGatewayBackendHttpSettings')]"
              }
            }
          }
        ]
      }
    }
  ]
}

This JSON file is an Azure Resource Manager template that creates an Application Gateway named myAppGateway in the eastus region.

The sku defines the size and features of the gateway.

The gatewayIPConfigurations link the gateway to a subnet in a virtual network.

The frontendIPConfigurations set up a public IP address where users connect.

The frontendPorts define which port listens for web traffic (port 80 for HTTP).

The backendAddressPools list the IP addresses of servers that will receive the traffic.

The backendHttpSettingsCollection defines how to connect to backend servers.

The httpListeners listen for incoming requests on the frontend IP and port.

The requestRoutingRules connect listeners to backend pools, directing traffic properly.

Commands

This command creates an Azure Application Gateway named myAppGateway in the myResourceGroup resource group. It sets the size to Standard_v2 with 2 instances, connects it to the myVnet virtual network and mySubnet subnet, and assigns the public IP myPublicIP for users to access.

Terminal

az network application-gateway create --name myAppGateway --resource-group myResourceGroup --location eastus --sku Standard_v2 --capacity 2 --vnet-name myVnet --subnet mySubnet --public-ip-address myPublicIP

Expected Output

{

  "frontendIpConfigurations": [

    {

      "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Network/applicationGateways/myAppGateway/frontendIPConfigurations/appGatewayFrontendIP",

      "properties": {

        "privateIpAddress": null,

        "publicIpAddress": {

          "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Network/publicIPAddresses/myPublicIP"

        }

      },

      "name": "appGatewayFrontendIP"

    }

  ],

  "gatewayIPConfigurations": [

    {

      "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Network/applicationGateways/myAppGateway/gatewayIPConfigurations/appGatewayIpConfig",

      "properties": {

        "subnet": {

          "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Network/virtualNetworks/myVnet/subnets/mySubnet"

        }

      },

      "name": "appGatewayIpConfig"

    }

  ],

  "location": "eastus",

  "name": "myAppGateway",

  "sku": {

    "capacity": 2,

    "name": "Standard_v2",

    "tier": "Standard_v2"

  },

  "resourceGroup": "myResourceGroup",

  "type": "Microsoft.Network/applicationGateways"

}

→

--sku - Defines the size and features of the Application Gateway

→

--capacity - Sets the number of instances for load balancing

→

--public-ip-address - Assigns the public IP for user access

This command updates the backend HTTP settings for the Application Gateway to connect to backend servers on port 80 using HTTP protocol and disables cookie-based affinity for simple load balancing.

Terminal

az network application-gateway http-settings update --gateway-name myAppGateway --resource-group myResourceGroup --name appGatewayBackendHttpSettings --port 80 --protocol Http --cookie-based-affinity Disabled

Expected Output

{

  "name": "appGatewayBackendHttpSettings",

  "properties": {

    "port": 80,

    "protocol": "Http",

    "cookieBasedAffinity": "Disabled"

  }

}

→

--port - Specifies the port to connect to backend servers

→

--protocol - Sets the protocol used to communicate with backend servers

This command creates a routing rule named rule1 that connects the HTTP listener to the backend address pool using the specified backend HTTP settings. It directs incoming web traffic to the backend servers.

Terminal

az network application-gateway rule create --gateway-name myAppGateway --resource-group myResourceGroup --name rule1 --http-listener appGatewayHttpListener --rule-type Basic --address-pool appGatewayBackendPool --http-settings appGatewayBackendHttpSettings

Expected Output

{

  "name": "rule1",

  "properties": {

    "ruleType": "Basic",

    "httpListener": {

      "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Network/applicationGateways/myAppGateway/httpListeners/appGatewayHttpListener"

    },

    "backendAddressPool": {

      "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Network/applicationGateways/myAppGateway/backendAddressPools/appGatewayBackendPool"

    },

    "backendHttpSettings": {

      "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Network/applicationGateways/myAppGateway/backendHttpSettingsCollection/appGatewayBackendHttpSettings"

    }

  }

}

→

--rule-type - Defines the type of routing rule (Basic or Path-based)

This command shows the current configuration and status of the Application Gateway to verify it was created and configured correctly.

Terminal

az network application-gateway show --name myAppGateway --resource-group myResourceGroup

Expected Output

{

  "name": "myAppGateway",

  "location": "eastus",

  "sku": {

    "name": "Standard_v2",

    "tier": "Standard_v2",

    "capacity": 2

  },

  "provisioningState": "Succeeded",

  "operationalState": "Running"

}

Key Concept

If you remember nothing else from this pattern, remember: Application Gateway manages and routes web traffic securely and efficiently at the web (Layer 7) level.

Common Mistakes

Not assigning a public IP address to the Application Gateway frontend configuration

Without a public IP, users cannot reach the Application Gateway from the internet.

Always create or assign a public IP address and link it to the frontend IP configuration.

Using mismatched ports between frontend listener and backend HTTP settings

Traffic will fail to route correctly if ports do not match between listener and backend settings.

Ensure frontend listener port and backend HTTP settings port are consistent.

Forgetting to create routing rules connecting listeners to backend pools

Without routing rules, the Application Gateway does not know where to send incoming requests.

Always create routing rules that link HTTP listeners to backend address pools and HTTP settings.

Summary

Create the Application Gateway with proper SKU, subnet, and public IP to accept web traffic.

Configure backend HTTP settings to define how the gateway connects to backend servers.

Create routing rules to connect frontend listeners to backend pools for traffic routing.

Verify the Application Gateway status and configuration to ensure it is running correctly.

Practice

1. What is the main function of an Azure Application Gateway at Layer 7?

easy

A. It stores data in a scalable database.

B. It manages virtual machines in a subnet.

C. It routes web traffic based on URL paths and content.

D. It provides DNS resolution for domain names.

Solution

1. Step 1: Understand Layer 7 role

   Layer 7 means the application layer, which handles web traffic content like URLs.

2. Step 2: Identify Application Gateway function

   Application Gateway routes traffic based on URL paths and content, unlike DNS or VM management.

3. Final Answer:

   It routes web traffic based on URL paths and content. -> Option C

4. Quick Check:

   Layer 7 routing = URL-based traffic routing [OK]

Hint: Layer 7 means web content routing, not VM or DNS tasks [OK]

Common Mistakes:

• Confusing Application Gateway with DNS or VM services
• Thinking it works at network layer instead of application layer
• Assuming it stores data like a database

2. Which of the following is the correct way to define a frontend IP configuration for an Azure Application Gateway in ARM template JSON?

easy

A. {\"name\": \"appGatewayFrontendIP\", \"properties\": {\"publicIPAddress\": {\"id\": \"/subscriptions/.../publicIPAddresses/myPublicIP\"}}}

B. {\"name\": \"appGatewayFrontendIP\", \"location\": \"eastus\"}

C. {\"frontendIP\": \"myPublicIP\"}

D. {\"ipConfig\": {\"publicIP\": \"myPublicIP\"}}

Solution

1. Step 1: Review ARM template frontend IP syntax

   The frontend IP config requires a name and properties including a reference to a public IP resource by its ID.

2. Step 2: Match correct JSON structure

   {\"name\": \"appGatewayFrontendIP\", \"properties\": {\"publicIPAddress\": {\"id\": \"/subscriptions/.../publicIPAddresses/myPublicIP\"}}} correctly uses "name" and "properties" with "publicIPAddress" and its "id" field, matching ARM schema.

3. Final Answer:

   {"name": "appGatewayFrontendIP", "properties": {"publicIPAddress": {"id": "/subscriptions/.../publicIPAddresses/myPublicIP"}}} -> Option A

4. Quick Check:

   Frontend IP config needs name + publicIPAddress id [OK]

Hint: Look for 'properties' with 'publicIPAddress' and 'id' fields [OK]

Common Mistakes:

• Missing 'properties' wrapper around publicIPAddress
• Using 'location' inside frontend IP config incorrectly
• Incorrect field names like 'frontendIP' or 'ipConfig'

3. Given this simplified ARM snippet for an Application Gateway backend HTTP settings, what will be the effect of setting "pickHostNameFromBackendAddress" to true?

{
  "name": "appGatewayBackendHttpSettings",
  "properties": {
    "port": 80,
    "protocol": "Http",
    "pickHostNameFromBackendAddress": true
  }
}

medium

A. The backend hostname is taken from the backend pool IP or FQDN instead of the HTTP settings.

B. The Application Gateway ignores the backend pool and uses the frontend hostname.

C. The backend HTTP settings port is ignored and defaults to 443.

D. The Application Gateway disables SSL termination.

Solution

1. Step 1: Understand 'pickHostNameFromBackendAddress'

   This setting tells the gateway to use the hostname from the backend pool's address (IP or FQDN) for HTTP requests.

2. Step 2: Analyze effect on backend requests

   When true, the hostname in HTTP headers matches backend pool address, not the HTTP settings hostname.

3. Final Answer:

   The backend hostname is taken from the backend pool IP or FQDN instead of the HTTP settings. -> Option A

4. Quick Check:

   pickHostNameFromBackendAddress true = use backend pool hostname [OK]

Hint: True means use backend pool hostname, not HTTP settings hostname [OK]

Common Mistakes:

• Thinking it changes port or protocol
• Confusing frontend hostname with backend hostname
• Assuming it disables SSL termination

4. You deployed an Application Gateway but it fails to route traffic to backend servers. The backend pool uses IP addresses, but the health probes always fail. What is a likely cause?

medium

A. The Application Gateway subnet is too large.

B. The backend HTTP settings have 'pickHostNameFromBackendAddress' set to true but backend IPs lack proper DNS names.

C. The frontend IP configuration is missing a public IP address.

D. The backend pool uses FQDNs instead of IP addresses.

Solution

1. Step 1: Understand health probe failure with IP backend pool

   If 'pickHostNameFromBackendAddress' is true, the gateway uses backend hostname from IP, which fails if no DNS name exists.

2. Step 2: Identify mismatch causing probe failure

   Backend IPs lack DNS names, so probes fail when hostname is required but missing.

3. Final Answer:

   The backend HTTP settings have 'pickHostNameFromBackendAddress' set to true but backend IPs lack proper DNS names. -> Option B

4. Quick Check:

   IP backend + pickHostNameFromBackendAddress true = probe fails [OK]

Hint: Check if backend IPs have DNS names when pickHostNameFromBackendAddress is true [OK]

Common Mistakes:

• Blaming subnet size for routing issues
• Assuming frontend IP config missing public IP causes backend probe failure
• Confusing backend pool IPs with FQDNs

5. You want to configure an Azure Application Gateway to route requests to different backend pools based on URL paths: /images/* to an image server pool and /api/* to an API server pool. Which configuration step is essential to achieve this?

hard

A. Configure the backend HTTP settings to use HTTPS only.

B. Assign multiple public IP addresses to the frontend configuration.

C. Use multiple frontend ports with the same backend pool.

D. Create path-based routing rules with URL path maps specifying backend pools for each path.

Solution

1. Step 1: Understand URL-based routing requirement

   Routing based on URL paths requires path-based routing rules with URL path maps.

2. Step 2: Configure path-based rules

   Define URL path maps that link specific URL patterns like '/images/*' and '/api/*' to their respective backend pools.

3. Final Answer:

   Create path-based routing rules with URL path maps specifying backend pools for each path. -> Option D

4. Quick Check:

   URL path routing = path-based rules with URL maps [OK]

Hint: Use path-based routing rules with URL maps for URL path routing [OK]

Common Mistakes:

• Thinking multiple public IPs are needed for URL routing
• Using multiple frontend ports without path rules
• Assuming backend HTTP settings control URL routing