Application Gateway (Layer 7) in Azure - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is an Azure Application Gateway?

Azure Application Gateway is a web traffic load balancer that operates at Layer 7 (the application layer). It helps manage traffic to web applications by routing requests based on URL paths, host headers, and more.

beginner

What does Layer 7 mean in the context of Application Gateway?

Layer 7 refers to the application layer in the OSI model. It means the gateway can inspect and route traffic based on content like URLs, HTTP headers, and cookies, not just IP addresses or ports.

intermediate

How does Application Gateway improve security for web applications?

It can integrate with a Web Application Firewall (WAF) to protect against common web attacks like SQL injection and cross-site scripting, helping keep applications safe.

intermediate

What is path-based routing in Application Gateway?

Path-based routing lets the gateway send requests to different backend servers based on the URL path. For example, requests to '/images' can go to one server, while '/videos' go to another.

intermediate

Why would you use SSL termination with Application Gateway?

SSL termination means the gateway decrypts incoming HTTPS traffic, so backend servers get plain HTTP. This reduces the load on backend servers and lets the gateway inspect traffic for routing or security.

What layer of the OSI model does Azure Application Gateway operate on?

A Layer 7 - Application Layer

B Layer 3 - Network Layer

C Layer 4 - Transport Layer

D Layer 2 - Data Link Layer

Azure Application Gateway works at Layer 7, allowing it to route traffic based on application-level information like URLs and headers.

Which feature allows Application Gateway to send requests to different servers based on URL paths?

A DNS resolution

B IP-based routing

C Path-based routing

D Port forwarding

Path-based routing lets the gateway route requests depending on the URL path, directing traffic to specific backend pools.

What is the main benefit of enabling SSL termination on Application Gateway?

A It encrypts traffic between backend servers

B It decrypts HTTPS traffic at the gateway, reducing backend load

C It disables HTTPS for faster connections

D It blocks all HTTP traffic

SSL termination decrypts incoming HTTPS traffic at the gateway, so backend servers receive unencrypted traffic, reducing their processing work.

How does Application Gateway enhance security for web apps?

A By integrating with a Web Application Firewall (WAF)

B By blocking all incoming traffic

C By encrypting backend databases

D By disabling user authentication

Application Gateway can include a WAF to protect web apps from common attacks like SQL injection and cross-site scripting.

Which of these is NOT a routing method supported by Application Gateway?

A Path-based routing

B Host-based routing

C IP address-based routing

D MAC address-based routing

Application Gateway does not route based on MAC addresses; it supports path-based and host-based routing among others.

Explain how Azure Application Gateway routes web traffic and why operating at Layer 7 is important.

Think about how a traffic director decides where to send cars based on their destination signs.

Describe the security benefits of using Application Gateway with a Web Application Firewall.

Imagine a security guard checking visitors before they enter a building.

Practice

1. What is the main function of an Azure Application Gateway at Layer 7?

easy

A. It stores data in a scalable database.

B. It manages virtual machines in a subnet.

C. It routes web traffic based on URL paths and content.

D. It provides DNS resolution for domain names.

Solution

1. Step 1: Understand Layer 7 role

   Layer 7 means the application layer, which handles web traffic content like URLs.

2. Step 2: Identify Application Gateway function

   Application Gateway routes traffic based on URL paths and content, unlike DNS or VM management.

3. Final Answer:

   It routes web traffic based on URL paths and content. -> Option C

4. Quick Check:

   Layer 7 routing = URL-based traffic routing [OK]

Hint: Layer 7 means web content routing, not VM or DNS tasks [OK]

Common Mistakes:

• Confusing Application Gateway with DNS or VM services
• Thinking it works at network layer instead of application layer
• Assuming it stores data like a database

2. Which of the following is the correct way to define a frontend IP configuration for an Azure Application Gateway in ARM template JSON?

easy

A. {\"name\": \"appGatewayFrontendIP\", \"properties\": {\"publicIPAddress\": {\"id\": \"/subscriptions/.../publicIPAddresses/myPublicIP\"}}}

B. {\"name\": \"appGatewayFrontendIP\", \"location\": \"eastus\"}

C. {\"frontendIP\": \"myPublicIP\"}

D. {\"ipConfig\": {\"publicIP\": \"myPublicIP\"}}

Solution

1. Step 1: Review ARM template frontend IP syntax

   The frontend IP config requires a name and properties including a reference to a public IP resource by its ID.

2. Step 2: Match correct JSON structure

   {\"name\": \"appGatewayFrontendIP\", \"properties\": {\"publicIPAddress\": {\"id\": \"/subscriptions/.../publicIPAddresses/myPublicIP\"}}} correctly uses "name" and "properties" with "publicIPAddress" and its "id" field, matching ARM schema.

3. Final Answer:

   {"name": "appGatewayFrontendIP", "properties": {"publicIPAddress": {"id": "/subscriptions/.../publicIPAddresses/myPublicIP"}}} -> Option A

4. Quick Check:

   Frontend IP config needs name + publicIPAddress id [OK]

Hint: Look for 'properties' with 'publicIPAddress' and 'id' fields [OK]

Common Mistakes:

• Missing 'properties' wrapper around publicIPAddress
• Using 'location' inside frontend IP config incorrectly
• Incorrect field names like 'frontendIP' or 'ipConfig'

3. Given this simplified ARM snippet for an Application Gateway backend HTTP settings, what will be the effect of setting "pickHostNameFromBackendAddress" to true?

{
  "name": "appGatewayBackendHttpSettings",
  "properties": {
    "port": 80,
    "protocol": "Http",
    "pickHostNameFromBackendAddress": true
  }
}

medium

A. The backend hostname is taken from the backend pool IP or FQDN instead of the HTTP settings.

B. The Application Gateway ignores the backend pool and uses the frontend hostname.

C. The backend HTTP settings port is ignored and defaults to 443.

D. The Application Gateway disables SSL termination.

Solution

1. Step 1: Understand 'pickHostNameFromBackendAddress'

   This setting tells the gateway to use the hostname from the backend pool's address (IP or FQDN) for HTTP requests.

2. Step 2: Analyze effect on backend requests

   When true, the hostname in HTTP headers matches backend pool address, not the HTTP settings hostname.

3. Final Answer:

   The backend hostname is taken from the backend pool IP or FQDN instead of the HTTP settings. -> Option A

4. Quick Check:

   pickHostNameFromBackendAddress true = use backend pool hostname [OK]

Hint: True means use backend pool hostname, not HTTP settings hostname [OK]

Common Mistakes:

• Thinking it changes port or protocol
• Confusing frontend hostname with backend hostname
• Assuming it disables SSL termination

4. You deployed an Application Gateway but it fails to route traffic to backend servers. The backend pool uses IP addresses, but the health probes always fail. What is a likely cause?

medium

A. The Application Gateway subnet is too large.

B. The backend HTTP settings have 'pickHostNameFromBackendAddress' set to true but backend IPs lack proper DNS names.

C. The frontend IP configuration is missing a public IP address.

D. The backend pool uses FQDNs instead of IP addresses.

Solution

1. Step 1: Understand health probe failure with IP backend pool

   If 'pickHostNameFromBackendAddress' is true, the gateway uses backend hostname from IP, which fails if no DNS name exists.

2. Step 2: Identify mismatch causing probe failure

   Backend IPs lack DNS names, so probes fail when hostname is required but missing.

3. Final Answer:

   The backend HTTP settings have 'pickHostNameFromBackendAddress' set to true but backend IPs lack proper DNS names. -> Option B

4. Quick Check:

   IP backend + pickHostNameFromBackendAddress true = probe fails [OK]

Hint: Check if backend IPs have DNS names when pickHostNameFromBackendAddress is true [OK]

Common Mistakes:

• Blaming subnet size for routing issues
• Assuming frontend IP config missing public IP causes backend probe failure
• Confusing backend pool IPs with FQDNs

5. You want to configure an Azure Application Gateway to route requests to different backend pools based on URL paths: /images/* to an image server pool and /api/* to an API server pool. Which configuration step is essential to achieve this?

hard

A. Configure the backend HTTP settings to use HTTPS only.

B. Assign multiple public IP addresses to the frontend configuration.

C. Use multiple frontend ports with the same backend pool.

D. Create path-based routing rules with URL path maps specifying backend pools for each path.

Solution

1. Step 1: Understand URL-based routing requirement

   Routing based on URL paths requires path-based routing rules with URL path maps.

2. Step 2: Configure path-based rules

   Define URL path maps that link specific URL patterns like '/images/*' and '/api/*' to their respective backend pools.

3. Final Answer:

   Create path-based routing rules with URL path maps specifying backend pools for each path. -> Option D

4. Quick Check:

   URL path routing = path-based rules with URL maps [OK]

Hint: Use path-based routing rules with URL maps for URL path routing [OK]

Common Mistakes:

• Thinking multiple public IPs are needed for URL routing
• Using multiple frontend ports without path rules
• Assuming backend HTTP settings control URL routing