Azure Application Gateway Configuration Without Private IP

Question

Hello,

I hope this message finds you well.

I am reaching out to seek your expert advice on our Azure Application Gateway configuration. Currently, our Application Gateway only includes a public IP address to manage incoming internet traffic. This internet traffic is then redirected to an application running on a VM named 'VM1' in the private subnet 'sub1'. Outgoing traffic passes through a NAT. All resources are within the same VNet. Internal communications pass through the public IP of the App Gateway, and this concerns me.

Is it advisable to create a private IP for the Application Gateway to secure the communication between the Application Gateway and our VM?

I am open to any suggestions or recommendations you might have to optimize our Azure infrastructure.

Thank you in advance for your time and expertise.

Sincerely,

Answer 1

@Alexandre Cerret

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

If your VM is in the backend of the App gateway and you have added this VM as "Target Type" as "Virtual Machine", then communication between Application Gateway and this VM is contained within the virtual network.

• 

Wrt, "Internal communications pass through the public IP of the App Gateway,"

• As you have mentioned your App gateway uses a Public IP only, all inbound communications to this App gateway can only come in via Internet.
• However, as mentioned above, the traffic between the App Gateway and the backend VM is contained within the VNET.

How an App gateway works:

• Application Gateway is deployed into a subnet in the VNET.
• Application gateway instances are assigned IP Addresses from the subnet (Private IPs).
• Application gateway uses this instance IPs to communicate to the backend VMs.

Refer : How an application gateway routes a request

The traffic flow is as follows:

Source <---> via Internet <---> AppGateway <---> via VNET <---> Backend VM

The use of "private IP for the Application Gateway" is to enable communication "to" the App gateway and not from the App gateway to happen via the Virtual Network/Private Network.

• Refer : Public and private IP address support

Thanks,

Kapil

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.