Hello Everyone I am having troubles with solving an issue with DNS name translation. I think the issue stems from DNS not translating properly because I have checked the network settings and it seems fine to me. Browser Error Message: "502 Bad Gateway" Microsoft-Azure-Application-Gateway/v2 Environment: 1.Domain name was purchased via App Service Domain. 2.TLS certificates are from a well-known CA. (TLS certifcates were imported into the server, exported as .pfx files and upload to the application gateway) 3.Public and Private DNS already configured (with child DNS Zone). Records have been created. Backend server: windows server. Network Environment: Hub and Spoke network environment Application gateway, firewall and DNS (public and private) resides in the hub network. Network architecture: Client PC→Application Gateway→Azure Firewall→Backend server. FW rules allow https port traffic to the backend target subnet. Routes to and from both networks have been created. Private DNS already linked to the backend target network. Application gateway backend probe not configured. Findings: NSG test: OK Network connection test: Fails with "Socket could not be opened to run the connectivity check" on the backend target. Backend Health: Unhealthy (Received invalid status code: 502 in the backend server’s HTTP response. As per the health probe configuration, 200-399 is the acceptable status code. Either modify probe configuration or resolve backend issues.) Any help would be appreciated.

@KapilAnanth-MSFT Thank you for all the suggestions. I reached out to support the same day I posted here, and they got back to me. The problem was because DNS was not properly translating as I had suspected. All I needed to do was link the Private DNS to the application gateway virtual network and restarted the application gateway. That solved the problem and now the backend health status has changed to "healthy".

"502 Bad Gateway"

Jessie 85

Hello Everyone

I am having troubles with solving an issue with DNS name translation.

I think the issue stems from DNS not translating properly because I have checked the network settings and it seems fine to me.

Browser Error Message:

"502 Bad Gateway"

Microsoft-Azure-Application-Gateway/v2

Environment:

1.Domain name was purchased via App Service Domain.

2.TLS certificates are from a well-known CA.

(TLS certifcates were imported into the server, exported as .pfx files and upload to the application gateway)

3.Public and Private DNS already configured (with child DNS Zone).

Records have been created.
Backend server: windows server.

Network Environment:

Hub and Spoke network environment Application gateway, firewall and DNS (public and private) resides in the hub network.
Network architecture: Client PC→Application Gateway→Azure Firewall→Backend server.
FW rules allow https port traffic to the backend target subnet.
Routes to and from both networks have been created.
Private DNS already linked to the backend target network.
Application gateway backend probe not configured.

Findings:

NSG test: OK

Network connection test: Fails with "Socket could not be opened to run the connectivity check" on the backend target.

Backend Health: Unhealthy (Received invalid status code: 502 in the backend server’s HTTP response. As per the health probe configuration, 200-399 is the acceptable status code. Either modify probe configuration or resolve backend issues.)

Any help would be appreciated.

KapilAnanth-MSFT 48,261 Reputation points Microsoft Employee

2023-07-04T08:07:54.2033333+00:00
@Jessie

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I understand that you are facing "502 Bad Gateway" with Azure App gateway.

I don't think this error has anything to do with DNS resolution.

What makes you say there could be a problem with DNS?

I see you are having an architecture with Both Azure App Gateway and Azure Firewall

This architecture includes a lot of complexity

Was your setup working before adding a custom Domain to point to App Gateway's IP?

Or is it a brand new set up and this never worked?

In this case, can you verify if the set up works without Azure Firewall

And confirm that the configuration is indeed correct to begin with?

For your current configuration

To troubleshoot this, you will be required to enable logs at the Application Gateway

The 502 is because the backend is unhealthy as stated

So, enable App Gateway Access logs and see what is the response given by the backend

This should be 502 but just to make sure

Refer : Access log data structure

And then check the Azure Firewall logs and see what is the request/response for traffic between App gateway and Backend VMs

Cheers,

Kapil

Jessie 85

@KapilAnanth-MSFT

Thank you for responding swiftly to my comment.
The answers to your questions are follows.

1. What makes you say there could be a problem with DNS?
>>It was a case of not knowing what the exact problem is.
  The Microsoft Docs I read regarding this issue suggested that
  the cause might be either NSG, Firewall or DNS translation.
  As far as I could tell, NSG and Firewall seemed fine.

2. I see you are having an architecture with Both Azure App Gateway and Azure Firewall.
is it a brand new set up and this never worked?

>>It is a brand new setup and the policy was to setup a firewall behind the Application Gateway.
  Removing the Azure firewall would mean going contrary to the rule. As complicated as it is, I can not do   without the firewall.


Thank you for sharing the links.
I will give a try and see what happens.

KapilAnanth-MSFT 48,261 Reputation points Microsoft Employee

2023-07-04T10:48:30.6733333+00:00
@Jessie

Wrt verifing if the set up works without Azure Firewall,

This is to isolate if Azure Firewall or the VM(backend) is the culprit.

This is just for POC and for your final production workload, you can add the components (Firewall) once the base set up works fine

Sure, you can enable the logs and let us know what's the backend status.

Cheers,

Kapil
Ben Gimblett 4,540 Reputation points Microsoft Employee

2023-07-04T11:19:16.12+00:00

@Jessie you mention in your question the following under point 6 "Application gateway backend probe not configured". But, this is required. If you don't set up probes then App Gateway cant send probe traffic to the backend to determine if it's healthy and you'll receive an error (as you noted). See here for more info

Please also note the following. Current version of App Gateway (v2) does not support a route pushing all traffic (quad zeroes) to a firewall (or network virtual appliance). See here for more info.
Ben Gimblett 4,540 Reputation points Microsoft Employee

2023-07-04T11:23:00.9+00:00

please setup a probe to your backend.

As per comments above , test direct from App Gateway to backend.

If trying to use custom route to force traffic via the firewall please remove this

Alternatively, If you're using DNS to return the firewall IP, or the firewall Ip is the backend (assumes the firewall itself is reverse proxying the backend) please change this so the backend target is the web app or api.
KapilAnanth-MSFT 48,261 Reputation points Microsoft Employee

2023-07-06T12:58:59.2033333+00:00

@Jessie

Can you please update us if the action plan provided was helpful?

Should there be any follow-up questions or concerns, please let us know and we shall try to address them.

Thanks,

Kapil

1 answer

Jessie 85 Reputation points

2023-07-10T00:03:00.1166667+00:00

@KapilAnanth-MSFT

Thank you for all the suggestions.

I reached out to support the same day I posted here, and they got back to me.

The problem was because DNS was not properly translating as I had suspected.

All I needed to do was link the Private DNS to the application gateway virtual network and restarted the application gateway.

That solved the problem and now the backend health status has changed to "healthy".
Please sign in to rate this answer.
KapilAnanth-MSFT 48,261 Reputation points Microsoft Employee

2023-07-10T09:34:19.99+00:00

@Jessie

I am glad the issue has been resolved.

Cheers,

Kapil
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

"502 Bad Gateway"

1 answer

Your answer