Hello, I deploy an architecture on Azure. I have a spoke vnet for DMZ where I have currently 2 Web servers (application1.company.com, application2.company.com). The spoke DMZ communicate, via a vnet peering, with our Hub where I deployed a firewall (Palo Alto vm-series) and the Azur Application Gateway. The application gateway is configured with an IP public for the frontend. The backend is configured to forward traffic to the Palo Alto. On the dns public, each entry (application1.company.com and application2.company.com) is registred with the IP public of the application gateway. My objective is when user, on Internet, will enter application1.company.com or application2.company.com, the trafic will send to the the correct Web server in our DMz. What is your recommandation and is-it the correct approach to cover my needs? BR

Hi @Jérôme , Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you would like to host two applications behind a single App gateway. This is achievable by using Multisite Listeners . You have to create two Multisite HTTPS Listeners each with the respective FQDN and certificate. This document should help you to set up the Applications, Refer : Create and configure an application gateway to host multiple web sites using the Azure portal Thanks, Kapil ---------------------------------------------------------------------------------------------------------------- Please don’t forget to close the thread by clicking " Accept the answer " wherever the information provided helps you, as this can be beneficial to other community members.

Sounds you should put Firewall before the application gateway, then use multiple listener to traffic to two web servers. Also you should set a NAT policy in firewall. The whole path should be: client -> firewall -> azure application gateway -> web server1 client -> firewall -> azure application gateway -> web server2

Internal Web servers access from Internet

Accepted answer

KapilAnanth-MSFT 34,606 Reputation points Microsoft Employee

2022-11-01T13:48:51.03+00:00

Hi @Jérôme ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that you would like to host two applications behind a single App gateway.

This is achievable by using Multisite Listeners.
You have to create two Multisite HTTPS Listeners each with the respective FQDN and certificate.

This document should help you to set up the Applications,
Refer : Create and configure an application gateway to host multiple web sites using the Azure portal

Thanks,
Kapil

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.
Jérôme 21 Reputation points

2022-11-01T18:01:16.567+00:00

Hello,

Thank you. But in my case, the backend is not the vm server directly but our firewall. We have the Gateway in front of Internet, alternative we have the firewall and behind, we have our servers. From the gateway, the listeners are configured to forward trafic to the firewall..

BR

KapilAnanth-MSFT 34,606 Reputation points Microsoft Employee

2022-11-03T05:59:01.437+00:00

Hi @Jérôme ,

In that case, you should configure your Firewall to route the traffic to the appropriate servers.

This should be possible if you are using TLS Termination, then your firewall can inspect the traffic and route it accordingly.

From AppGateway perspective, a single listener can accept traffic for more than one domain
Refer to: Application Gateway multiple site hosting

You may also use multiple listeners, one for each domain as well, depending upon your requirement.

Hope this provides more clarity.

Thanks,
Kapil

----------------------------------------------------------------------------------------------------------------

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Jérôme 21 Reputation points

2022-11-03T07:35:07.12+00:00

Thank'you.

If I wan't to have AP before the Palo Alto firewall to use WAF policy, is-it possible to create listener

Listener1 : host : apptestdsi1.company.com / backend = 10.111.0.4
Listener2 : host : apptestdsi2.company.com / backend = 10.111.0.5

and create a route table for the AppGW subnet (10.128.0.0/24) as shown on my picture ? do you think it's ok ? Or I need to add nat rule on the firewall ?

Lynn Niu 236 Reputation points

2022-11-03T07:53:17.097+00:00

The source of nat policy in firewall should be the IP address, since the source IP address in this case is same, that's why I suggest the firewall before the application gateway. However seems the route table should be OK, you can try it. Please kindly keep update.

KapilAnanth-MSFT 34,606 Reputation points Microsoft Employee

2022-11-03T08:25:52.243+00:00

Hi @Jérôme ,

Application gateways can only forward traffic to their backends.
In your case, since you have configured your firewall appliances as backend, traffic can only be forwarded to them.

Having a route table on the app gateway subnet will not work.
Even if you are to make this work hypothetically, it defeats the purpose of having a Firewall if you are going to bypass it.

There are 2 ways you can set this environment,

With Firewall appliances as backend,

A listener can support upto 5 domains

You can either configure individual listener with multiple host names

or you can configure individual listeners for each domain

You should configure the firewall to inspect the traffic and forward it to the appropriate servers

With servers as backend,

This configuration is straight forward.

Just like above , you can either use a single listener or multiple listeners

Group the servers into individual backends and create individual rules to forward traffic accordingly.

Let me know if you have any questions here.

Thanks,
Kapil

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Jérôme 21 Reputation points

2022-11-03T08:33:53.903+00:00

Hello

In my vision, the objective was not to bypass firewall. The objective was to define the backend as the target server for each application and to add a route to inform Gateway that to join server in the DMZ subnet, the route is via the firewall.

My objective was to not define Palo Alto as the backend for all access but define the Windows server on the DMZ and add a route on the Gateway subnet to define that to contact 10.111.0.0/24 subnet (dmz), the traffic must go via Palo Alto (10.110.129/4)

KapilAnanth-MSFT 34,606 Reputation points Microsoft Employee

2022-11-03T10:01:20.257+00:00

Hi @Jérôme ,

Thanks for the update.

However, as stated, attaching route table to an app gateway subnet will not help here.

"Adding a server as backend pool" means the "next hop from App gateway should be the server".
We will not be able to route this traffic via NVA firewall (Palo Alto) to the backend pool, i.e, we will not be able to introduce the NVA as an intermediate hop

Either have the Palo Alto as backend,

Here, servers are not a part of backend, i.e, App gateway is not aware of the servers at all

Then, you configure the Palo Alto FW to forward traffic to the servers.

Or directly have the servers as backend, in this case, completely ignoring the firewall from traffic path

Please let me know if you need more details on this.

Cheers,
Kapil

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Sign in to comment

Internal Web servers access from Internet

1 additional answer