The application gateway 'igcnx-icce-ag' is not able to connect to pg-identity (IP '52.189.183.12') and the heath probe is stating that the connection to PG-Identity is unhealthy. Upon deeper diagnosis, it shows the error 'local gateway' on Application Gat

Question

I have checked the backend server and it is healthy. Only the connection of Application Gateway to Backend server is not working.

Answer 1

Hello Ravi Kant Sharma

The "local gateway" error in Azure Application Gateway typically indicates a connectivity issue between the gateway and the backend server. Here are some steps to troubleshoot and resolve the problem:

1. Please ensure that the NSG associated with the Application Gateway subnet allows inbound traffic to the backend server's IP (52.189.183.12) on the required ports (e.g., 80 or 443).
2. Also, check if there are UDRs associated with the Application Gateway subnet that might be redirecting traffic away from the backend server. Ensure proper routing to the backend server.
3. If the backend server is referenced by its Fully Qualified Domain Name (FQDN), verify that the DNS resolution is working correctly. Misconfigured DNS settings can lead to "local gateway" errors.
4. Review the health probe settings in the Application Gateway. Ensure that the probe is configured to use the correct protocol, port, and path. If the backend server requires specific headers or authentication, update the probe settings accordingly.
5. Double-check the backend server's firewall (windows/Linux) and firewall settings to ensure it allows traffic from the Application Gateway's.
6. Enable diagnostic logging for the Application Gateway to get detailed insights into the issue. Logs can help pinpoint the exact cause of the connectivity problem.

In addition to these, could you please check the connection troubleshooting from the application gateway to the backend server IP/FQDN on the specified port and share the results with us? If possible, deploy the Windows VM on the same VNET and test if you can connect to the backend server IP/FQDN on the port to isolate the issue from the application gateway.

---

If above is unclear and/or you are unsure about something add a comment below.

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.