DevOps PeachApplication Gateway takes HTTP/HTTPS requests and picks a backend from the request content (L7). Backends can be VMs, VM scale sets, App Service or on-premises servers (by IP/FQDN).
flowchart LR
C["Client"] --> FIP["Frontend IP"]
FIP --> L["Listener :443 (TLS cert)"]
L --> R{"Routing rule (path-based)"}
R -- "/images/*" --> P1["Pool images"]
R -- "/video/*" --> P2["Pool video"]
R -- "default" --> P3["Pool web"]
W["WAF (optional)"] -.-> L
| Part | Role |
|---|---|
| Frontend IP | Public and/or private IP |
| Listener | Port, protocol, host name, certificate |
| Routing rule | Links a listener to backends; basic or path-based; v2 needs a priority |
| Backend pool + HTTP settings | Targets and how to call them (port, protocol, cookie affinity) |
| Health probe | Checks the backends |
| WAF | Web Application Firewall (OWASP) with the WAF_v2 SKU — optional |
Two routing styles: path-based (/images/* → pool A, /video/* → pool B) and multiple-site (several domains on one gateway). The gateway also does TLS termination.
- Choose a v2 SKU (
Standard_v2,WAF_v2): autoscaling and zones; v1 was retired (28 Apr 2026). - The gateway needs a dedicated subnet.
- Need URL routing → Application Gateway; only L4 TCP/UDP → Load Balancer.
| Command | Meaning |
|---|---|
az network application-gateway list -g rg-devops-lab -o table |
List gateways |
Listeners, redirects, and rewrites
A basic listener accepts every host name on its port; a multi-site listener matches specific host names such as shop.example.com, which lets one gateway serve many sites. Common extras:
- Redirects send HTTP on port 80 to HTTPS, or one path to another site.
- Rewrite rules add or change request and response headers (for example
X-Forwarded-Proto) or rewrite the URL path before it reaches the backend. - End-to-end TLS re-encrypts traffic to the backend when the network between gateway and servers must stay encrypted too.
- Certificates can be pulled from Azure Key Vault through a managed identity, so renewals do not require redeploying the gateway.
Web Application Firewall
The WAF inspects requests against Microsoft's managed rule set (based on OWASP Core Rule Set) to block attacks such as SQL injection and cross-site scripting. It runs in Detection mode (log only) or Prevention mode (block). Start in Detection, review false positives in the logs, add exclusions, then switch to Prevention. Custom rules can block by country, IP range, or rate of requests, and bot protection filters known bad bots. WAF settings live in a separate WAF policy resource.
Health and troubleshooting
az network application-gateway show-backend-health -g rg-devops-lab -n agw-web shows each backend's status and the probe error. A frequent 502 Bad Gateway cause is a backend that does not answer the probe path, an NSG on the gateway subnet that blocks the infrastructure ports Azure needs, or a certificate name mismatch with end-to-end TLS.
Related services
Application Gateway for Containers is a newer L7 load balancer designed for AKS traffic through Kubernetes Gateway API resources. For global HTTP entry with caching and WAF at the edge, Azure Front Door sits in front of regional gateways or App Service.