Unable to access web app via app gateway

Question

Hello,

Unable to access web app via app gateway. Able to access web app directly, so its working ok. Also, backend health shows all healthy. Dont know why its giving SSL_Error. Any help would be appreciated.

Other backend which is pointing to a VM on 8080 works fine.

The URL gets changed to "<app_service_url>:80"

Thanks

Answer 1

You need to create a routing rule for HTTPS, and upload a certificate the Azure Application Gateway.

Answer 2

Hello @Salman Ahmad !

Welcome to Microsoft QnA!

For Application Gateway to work correctly you need

1. A Routing rule as @Luke Murray already said that will instuct the APPGW where to send requests for the Http Listener.
2. The Certificate you use on the WEB SERVER must be uploaded into the APPGW

Read through these links

https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app?tabs=customdomain%2Cazure-portal

https://learn.microsoft.com/en-us/azure/application-gateway/create-ssl-portal?WT.mc_id=AZ-MVP-5004796#configuration-tab

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards

Answer 3

Hello @Salman Ahmad !

Have a look here :

https://learn.microsoft.com/en-us/azure/application-gateway/configure-web-app?tabs=customdomain%2Cazure-portal

And here :

Frontend port

Associate a frontend port. You can select an existing port or create a new one. Choose any value from the allowed range of ports. You can use not only well-known ports, such as 80 and 443, but any allowed custom port that's suitable. The same port can be used for public and private listeners (Preview feature).

Note

When using private and public listeners with the same port number, your application gateway changes the "destination" of the inbound flow to the frontend IPs of your gateway. Hence, depending on your Network Security Group's configuration, you may need an inbound rule with Destination IP addresses as your application gateway's public and private frontend IPs.

Inbound Rule:

• Source: (as per your requirement)
• Destination IP addresses: Public and Private frontend IPs of your application gateway.
• Destination Port: (as per listener configuration)
• Protocol: TCP

Outbound Rule: (no specific requirement)

Protocol

Choose HTTP or HTTPS:

If you choose HTTP, the traffic between the client and the application gateway is unencrypted.

Choose HTTPS if you want TLS termination or end-to-end TLS encryption. The traffic between the client and the application gateway is encrypted and the TLS connection will be terminated at the application gateway. If you want end-to-end TLS encryption to the backend target, you must choose HTTPS within backend HTTP setting as well. This ensures that traffic is encrypted when application gateway initiates a connection to the backend target.

To configure TLS termination, a TLS/SSL certificate must be added to the listener. This allows the Application Gateway to decrypt incoming traffic and encrypt response traffic to the client. The certificate provided to the Application Gateway must be in Personal Information Exchange (PFX) format, which contains both the private and public keys.

Note

When using a TLS certificate from Key Vault for a listener, you must ensure your Application Gateway always has access to that linked key vault resource and the certificate object within it. This enables seamless operations of TLS termination feature and maintains the overall health of your gateway resource. If an application gateway resource detects a misconfigured key vault, it automatically puts the associated HTTPS listener(s) in a disabled state. Learn more.

I hope this helps!

Kindly mark the answer as Accepted and Upvote in case it helped!

Regards

Answer 4

Thanks for all your input. Issue is resolved now. All it needed was this simple setting