Hi, I have integrated azure app gateway with my app service to have WAF in front of my web app. I see that I have app gateway's IP address via which I can access the app service, is there any possibility that I use the default domain of web app even with the app gateway?

@Najam ul Saqib , Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I understand that you would like to know if you can use the App Service's default domain on to access the App gateway in front of it. To answer your query, No It is not possible Further explanation, While it is technically possible to configure a listener with "<YOURSITE>.azurewebsites.net" on the application gateway, you cannot route traffic to this listener via Internet This is because, "azurewebsites.net" domain is owned and managed by Microsoft and you cannot update any records within the domain This means, "<YOURSITE>.azurewebsites.net" will always resolve to App Service It cannot be made to resolve to the Application gateway's IP In the document , Configure App Service with Application Gateway myapp .westeurope.cloudapp.azure.com and myapp .azurewebsites.net are two different domains myapp .westeurope.cloudapp.azure.com is the default domain of Public IP of the App Gateway - Not the App Service Kindly let us know if this helps or you need further assistance on this issue. Thanks, Kapil Please don’t forget to close the thread by clicking " Accept the answer " wherever the information provided helps you, as this can be beneficial to other community members.

Is it possible to use .azurewebsites.net domain with application gateway?

Accepted answer

KapilAnanth-MSFT 46,776 Reputation points Microsoft Employee

2024-09-03T11:45:42.05+00:00
@Najam ul Saqib ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you would like to know if you can use the App Service's default domain on to access the App gateway in front of it.

To answer your query,

No

It is not possible

Further explanation,

While it is technically possible to configure a listener with "<YOURSITE>.azurewebsites.net" on the application gateway, you cannot route traffic to this listener via Internet

This is because, "azurewebsites.net" domain is owned and managed by Microsoft and you cannot update any records within the domain

This means, "<YOURSITE>.azurewebsites.net" will always resolve to App Service

It cannot be made to resolve to the Application gateway's IP

In the document , Configure App Service with Application Gateway

myapp.westeurope.cloudapp.azure.com and myapp.azurewebsites.net are two different domains

myapp.westeurope.cloudapp.azure.com is the default domain of Public IP of the App Gateway - Not the App Service

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.
Please sign in to rate this answer.
Najam ul Saqib 340 Reputation points

2024-09-04T01:24:39.7266667+00:00

@KapilAnanth-MSFT Thank you, further if we go with the default domain of app service like in https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app?wt.mc_id=knwlserapi_inproduct_azportal&tabs=defaultdomain%2Cazure-portal#configure-app-service-with-application-gateway can we somehow enable HTTPS for the default domain of app gateway since that is also owned by Microsoft? Currently I am running HTTP and I want to go to HTTPS and for that I need to upload SSL but domain is owned by Microsoft no?

KapilAnanth-MSFT 46,776 Reputation points Microsoft Employee

2024-09-04T11:02:58.9033333+00:00

@Najam ul Saqib - you are welcome

To answer your query,

No

Listeners with HTTPS require you to update a SSL certificate for the host name you define

See : Application Gateway listener configuration Protocol

As you mentioned, since the domain is maintained by Microsoft, you will not be able to generate a SSL Certificate for this domain

To use HTTPS, you must consider using a custom domain.

See : end-to-end TLS encryption.

Alternatively, you can consider using Azure Front Door which provides HTTPS capability even on the default domain.

NOTE :

Using default domains or two different domains (one in proxy such as AFD/AppGW and one in the backend such as AppService) is not recommended as this could lead to potential issues such as

Incorrect absolute URLs

Incorrect redirect URLs

Broken cookies

A detailed explanation is provided here : Host Name Preservation

The Implementation guidance from Azure would be to use a custom domain

Hope this helps

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Najam ul Saqib 340 Reputation points

2024-09-04T17:06:25.9466667+00:00

@KapilAnanth-MSFT I see WAF can be integrated with Front Door as well; which one is preferred btw Front Door or App Gateway if all I need is WAF in front of my web app?

KapilAnanth-MSFT 46,776 Reputation points Microsoft Employee

2024-09-06T03:32:57.76+00:00

@Najam ul Saqib - yes, WAF can be used with both AFD and AppGW.

However, please note that they offer different rule sets and require different configuration to achieve the end goal.

While both AppGW WAF and AFD WAF can be utilized to arrive at the end state,

The major difference lies in the availability

Note that AppGW is a regional resource while AFD is a Global resource

This means, AFD is expected to have a low latency for users from a different region than the App Gateway

You can see the difference in features provided by them by comparing

Azure Web Application Firewall on Azure Application Gateway

Azure Web Application Firewall on Azure Front Door

Kindly choose the one that best suits your requirement and environment

Thanks,

Kapil

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.

Najam ul Saqib 340 Reputation points

2024-09-06T12:56:11.0966667+00:00

@KapilAnanth-MSFT AG is a load-balancer and FD is a CDN service, what if we dont want CDN or load balancer and just want to deploy a WAF in front of app service?

KapilAnanth-MSFT 46,776 Reputation points Microsoft Employee

2024-09-06T15:43:03.0033333+00:00

@Najam ul Saqib - No, WAF is provided with AFD and App Gw only.

App Service offers Network access restrictions.

Cheers,

Kapil
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Is it possible to use .azurewebsites.net domain with application gateway?

0 additional answers

Your answer