Integration of Azure application gateway WAF v2 with APIM

Question

Integration of Azure application gateway WAF v2 with APIM

Debjyoti Ganguly 25 Microsoft Employee

Hi Team Scenario - I have azure application gateway waf v2 in which I want to use apim as backend to test imported api. In this above scenario what networking configuration should i do in APIM can i enable Virtual network as "Internal" and also enable inbound Private endpoint for my APIM

ChaitanyaNaykodi-MSFT 11,501 Reputation points Microsoft Employee

2023-03-13T19:33:33.1233333+00:00

@Debjyoti Ganguly

Thank you for reaching out.

If I have understood you question correctly. Your current set-up is

backend(test_*api) -> APIM ->Application_*Gateway -> Internet(users).

I understand you want to set up VNet connectivity for your API Management instance in the internal mode but based on your statement above.

and also enable inbound Private endpoint for my APIM

I did not understand the requirement for enabling inbound Private endpoint for your APIM. As shown here you can integrate an APIM deployed with internal mode with Application Gateway without configuring a private endpoint.

Did you meant "to say to enable inbound Private endpoint for my Application Gateway" instead?
Debjyoti Ganguly 25 Reputation points Microsoft Employee

2023-03-14T02:49:08.7966667+00:00

Hi Chaitanya,

Thanks for replying to the question asked.
Actually the flow of our approved design POC is
D365 ( Power Pages ) -> Azure Application gateway -> APIM -> Function application.

Now while configuring we found that After we set Virtual network to "Internal" in the networking section of APIM we are not able to provision Inbound Private endpoint for the APIM.

We just wanted to know can Inbound Private endpoint provisioning is possible in this case for APIM.

In this scenario we want the traffic to stay in Microsoft Backbone only.
Debjyoti Ganguly 25 Reputation points Microsoft Employee

2023-03-14T03:21:20.59+00:00

At the moment we don't want to enable Private endpoint for our existing Azure application gateway waf v2

ChaitanyaNaykodi-MSFT 11,501 Reputation points Microsoft Employee

2023-03-13T19:33:33.1233333+00:00

@Debjyoti Ganguly

Thank you for reaching out.

If I have understood you question correctly. Your current set-up is

backend(test_*api) -> APIM ->Application_*Gateway -> Internet(users).

I understand you want to set up VNet connectivity for your API Management instance in the internal mode but based on your statement above.

and also enable inbound Private endpoint for my APIM

I did not understand the requirement for enabling inbound Private endpoint for your APIM. As shown here you can integrate an APIM deployed with internal mode with Application Gateway without configuring a private endpoint.

Did you meant "to say to enable inbound Private endpoint for my Application Gateway" instead?
Debjyoti Ganguly 25 Reputation points Microsoft Employee

2023-03-14T02:49:08.7966667+00:00

Hi Chaitanya,

Thanks for replying to the question asked.
Actually the flow of our approved design POC is
D365 ( Power Pages ) -> Azure Application gateway -> APIM -> Function application.

Now while configuring we found that After we set Virtual network to "Internal" in the networking section of APIM we are not able to provision Inbound Private endpoint for the APIM.

We just wanted to know can Inbound Private endpoint provisioning is possible in this case for APIM.

In this scenario we want the traffic to stay in Microsoft Backbone only.
Debjyoti Ganguly 25 Reputation points Microsoft Employee

2023-03-14T03:21:20.59+00:00

At the moment we don't want to enable Private endpoint for our existing Azure application gateway waf v2

Answer 1

JimmySalian-2011 30,151

Hey Debjyoti,

There is an excellent writeup for similar architecture requirements and the blog is listed here - https://medium.com/azure-architects/azure-api-management-and-application-gateway-integration-a31fde80f3db

Hope this helps.

JS

==

Please accept as answer and do a Thumbs-up to upvote this response if you are satisfied with the community help. Your upvote will be beneficial for the community users facing similar issues.

Debjyoti Ganguly 25 Reputation points Microsoft Employee

2023-03-14T03:01:30.18+00:00

Hi Jimmy,

Thanks for sharing the doc as it relates to our scenario which we want to test but the problem statement is bit different. Let me elaborate the design which we want to test -

Actually the flow of our approved design POC is
D365 ( Power Pages ) -> Azure Application gateway -> APIM -> Function application.

Now while configuring we found that After we set Virtual network to "Internal" in the networking section of APIM we are not able to provision Inbound Private endpoint for the APIM.

We just wanted to know can Inbound Private endpoint provisioning is possible in this case for APIM.
MuthuKumaranMurugaachari-MSFT 8,811 Reputation points

2023-03-14T21:43:43.2333333+00:00

Debjyoti Ganguly No, it is not possible to use private endpoint when injected into Virtual Network. Here are networking options for APIM: https://learn.microsoft.com/en-us/azure/api-management/virtual-network-concepts?tabs=stv2 and each can choose either VNET - Internal or Private Endpoint option based on the use case.

Note, in VNET - Internal mode, all three components Gateway, Developer Portal and Management plane are accessible only within VNET and the endpoints are exposed through Application Gateway. However, when enabling private endpoints, it can be accessed from internet unless public access is disabled.

Feel free to refer the docs and let us know if any questions.
Debjyoti Ganguly 25 Reputation points Microsoft Employee

2023-03-15T03:17:05.78+00:00

Got it .
Thanks again for clearing my queries.
MuthuKumaranMurugaachari-MSFT 8,811 Reputation points

2023-03-15T13:21:12.5033333+00:00

Sure, you are welcome.

Integration of Azure application gateway WAF v2 with APIM

0 additional answers

Activity