Learn to configure Azure Gateway components – Listeners, Health Probes, Routing Rules

To configure Azure Application Gateway components such as listeners, health probes, and routing rules, you can use the Azure Portal, Azure CLI, or ARM templates.

Below is a detailed guide on how to configure each of these components using Azure CLI.

1. Listeners

Listeners define how the Application Gateway handles incoming traffic based on the protocol (HTTP or HTTPS).

They are associated with a frontend IP address and a specific port.

a. Create an HTTP Listener

xxxxxxxxxx
7
1
az network application-gateway listener create \
2
--gateway-name MyAppGateway \
3
--resource-group MyResourceGroup \
4
--name MyHttpListener \
5
--frontend-ip MyPublicIP \
6
--frontend-port 80 \
7
--protocol Http

• MyPublicIP: The public IP to associate with the listener.

• MyHttpListener: The name of the listener.

• frontend-port 80: The port to listen on (e.g., 80 for HTTP).

b. Create an HTTPS Listener

For SSL termination, you'll need to provide an SSL certificate.

xxxxxxxxxx
8
1
az network application-gateway listener create \
2
--gateway-name MyAppGateway \
3
--resource-group MyResourceGroup \
4
--name MyHttpsListener \
5
--frontend-ip MyPublicIP \
6
--frontend-port 443 \
7
--protocol Https \
8
--ssl-cert MySslCertificate

• --ssl-cert MySslCertificate: Specify the SSL certificate name (either stored in Azure Key Vault or uploaded manually).

Health Probes

Health probes are used to monitor the health of backend servers (or pools) to determine whether traffic should be forwarded to them.

Probes can use HTTP, HTTPS, or TCP protocols.

a. Create an HTTP Health Probe

xxxxxxxxxx
10
1
az network application-gateway probe create \
2
--gateway-name MyAppGateway \
3
--resource-group MyResourceGroup \
4
--name MyHttpProbe \
5
--protocol Http \
6
--host "example.com" \
7
--path "/health" \
8
--interval 30 \
9
--timeout 20 \
10
--unhealthy-threshold 3

• --protocol Http: Set the protocol for the probe (can also be Https or Tcp).

• --host: The host to check (usually the domain name or IP of the backend server).

• --path: The URL path to check (e.g., /health for health checks).

• --interval 30: The probe interval in seconds.

• --timeout 20: The time in seconds before the probe times out.

• --unhealthy-threshold 3: The number of consecutive failed probes before marking the backend as unhealthy.

b. Create an HTTPS Health Probe (Optional)

xxxxxxxxxx
10
1
az network application-gateway probe create \
2
--gateway-name MyAppGateway \
3
--resource-group MyResourceGroup \
4
--name MyHttpsProbe \
5
--protocol Https \
6
--host "example.com" \
7
--path "/health" \
8
--interval 30 \
9
--timeout 20 \
10
--unhealthy-threshold 3

• Use Https for encrypted probes if your backend supports HTTPS health checks.

Routing Rules

Routing rules define how traffic should be directed to backend pools based on URL paths or hostnames.

These rules are applied to listeners.

a. Basic Routing

Basic routing means routing all traffic from a listener to a single backend pool.

xxxxxxxxxx
7
1
az network application-gateway url-path-map rule add \
2
--gateway-name MyAppGateway \
3
--resource-group MyResourceGroup \
4
--url-path-map-name MyPathMap \
5
--rule-name MyBasicRule \
6
--address-pool MyBackendPool \
7
--http-settings MyHttpSettings

• MyBackendPool: The backend pool to which traffic is forwarded.

• MyHttpSettings: HTTP settings to configure how traffic is forwarded (e.g., port, protocol).

b. Path-Based Routing

Path-based routing allows traffic to be forwarded to different backend pools based on the URL path.

xxxxxxxxxx
8
1
az network application-gateway url-path-map rule add \
2
--gateway-name MyAppGateway \
3
--resource-group MyResourceGroup \
4
--url-path-map-name MyPathMap \
5
--rule-name MyApiRule \
6
--paths "/api/*" \
7
--address-pool ApiBackendPool \
8
--http-settings ApiHttpSettings

• --paths "/api/*": Routes requests with /api/* to the ApiBackendPool.

• ApiBackendPool: The backend pool for API services.

• ApiHttpSettings: The HTTP settings associated with the API backend pool.

c. Multi-Site Routing

Multi-site routing allows different domains or hostnames to direct traffic to different backend pools.

xxxxxxxxxx
8
1
az network application-gateway url-path-map rule add \
2
--gateway-name MyAppGateway \
3
--resource-group MyResourceGroup \
4
--url-path-map-name MyPathMap \
5
--rule-name MySiteRule \
6
--hosts "site1.example.com" \
7
--address-pool Site1BackendPool \
8
--http-settings Site1HttpSettings

• --hosts "site1.example.com": Routes requests to site1.example.com to the Site1BackendPool.

You can also configure routing rules based on the hostname and path together, such as routing site1.example.com/api/* to a specific backend.

4. Combining Health Probes and Routing Rules

In a production environment, you should associate health probes with backend pools to ensure that traffic is only routed to healthy servers.

a. Associating Health Probes with Backend Pools

You can create or update a backend pool and associate the health probe with it.

xxxxxxxxxx
5
1
az network application-gateway address-pool update \
2
--gateway-name MyAppGateway \
3
--resource-group MyResourceGroup \
4
--name MyBackendPool \
5
--probe MyHttpProbe

• --probe MyHttpProbe: Associates the health probe (MyHttpProbe) with the backend pool (MyBackendPool).

Example: Full Deployment with Listeners, Health Probes, and Routing Rules

This example sets up an Azure Application Gateway with:

1. HTTP and HTTPS listeners.

2. Health probes for backend monitoring.

3. Path-based routing to route API traffic to a separate backend pool.

xxxxxxxxxx
47
1
# Create HTTP listener
2
az network application-gateway listener create \
3
--gateway-name MyAppGateway \
4
--resource-group MyResourceGroup \
5
--name MyHttpListener \
6
--frontend-ip MyPublicIP \
7
--frontend-port 80 \
8
--protocol Http
9

10
# Create HTTPS listener
11
az network application-gateway listener create \
12
--gateway-name MyAppGateway \
13
--resource-group MyResourceGroup \
14
--name MyHttpsListener \
15
--frontend-ip MyPublicIP \
16
--frontend-port 443 \
17
--protocol Https \
18
--ssl-cert MySslCertificate
19

20
# Create health probes
21
az network application-gateway probe create \
22
--gateway-name MyAppGateway \
23
--resource-group MyResourceGroup \
24
--name MyHttpProbe \
25
--protocol Http \
26
--host "example.com" \
27
--path "/health" \
28
--interval 30 \
29
--timeout 20 \
30
--unhealthy-threshold 3
31

32
# Add path-based routing
33
az network application-gateway url-path-map rule add \
34
--gateway-name MyAppGateway \
35
--resource-group MyResourceGroup \
36
--url-path-map-name MyPathMap \
37
--rule-name MyApiRule \
38
--paths "/api/*" \
39
--address-pool ApiBackendPool \
40
--http-settings ApiHttpSettings
41

42
# Associate health probe with backend pool
43
az network application-gateway address-pool update \
44
--gateway-name MyAppGateway \
45
--resource-group MyResourceGroup \
46
--name MyBackendPool \
47
--probe MyHttpProbe

Final Configuration

After you have configured listeners, health probes, and routing rules, it's important to:

• Monitor the Application Gateway using Azure Monitor for traffic insights.

• Test the routing by accessing the gateway’s public IP or DNS name with different paths (e.g., /api/* or /images/*).

• Scale the Application Gateway if needed (v2 allows automatic scaling based on traffic).

Write in comment and let me know if you need further assistance with any specific part of the configuration.