AZURE APPLICATION GATEWAY

Question

AZURE APPLICATION GATEWAY

Andrea Ciciliano 120

Hi to all,

It's possible migrate an Azure application Gateway betwen two subscription?

Thank you

Andrea

Abdelwahid El Mazghari 115 Reputation points

2023-09-25T13:56:28.55+00:00

Hello,

Thank you for getting in touch, it is certainly possible!

When it comes to moving an Azure Application Gateway from one subscription to another, there are several important things to keep in mind because else you will not have a good day and management will give you a headache because of the outage. I'll break it down step by step:

Firstly, it's essential to check if the Application Gateway has any important connections or relationships with other resources in the current subscription. If it does, moving it could potentially disrupt these connections unless you take appropriate steps to address them.

Next, have a close look at the network setup. Make sure that the virtual networks and subnets in the new subscription are configured in a way that the Application Gateway can smoothly operate within them. Sometimes, adjustments might be necessary to align everything correctly.

IP addressing is another critical consideration. Ensure that the IP configurations, both public and private, match the plan for the new subscription. If there are any differences, you'll need to update these settings accordingly.

Don't forget about SSL certificates if you're using them. Check that these certificates are still accessible and valid in the new subscription. If they aren't, you may need to update how they're configured and put in a CSR request to the on prem team or wathever you are using with your organisation. :)

For the backend pools and the resources they point to, confirm that they are still accessible and correctly set up in the new subscription. You want to ensure that the services relying on the Application Gateway continue to function smoothly.

Listeners and routing rules deserve a careful review. Make sure that they align with the new subscription's setup so that traffic is directed to the right places.

Health probes also require attention. Ensure that they remain valid in the new subscription and make any necessary changes if they need to be updated.

If you're using Web Application Firewall (WAF) policies, make sure they're correctly configured in the new subscription to maintain security levels.

Keep in mind that there might be some downtime during the migration process, so it's essential to plan for this and communicate it to the relevant parties to minimize disruptions. Its best to be a litlle concervative with downtime estimation and if it takes less then they will worship you like you deserve as a cloud specialist!

Before you start routing production traffic through the migrated Application Gateway, run thorough tests to make sure everything is functioning correctly in the new subscription.

As a precaution, think about creating a backup or snapshot of the Application Gateway and its related resources in the original subscription. This provides a safety net in case anything unexpected happens during the move.

I hope these considerations help make your Azure Application Gateway migration a smooth and successful process. If you have any more questions or need further guidance, please feel free to ask.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-09-26T06:50:13.2833333+00:00

Hello @Abdelwahid El Mazghari ,

As per Azure move support, Application gateways and WAF policies are not supported for move across resource groups/subscriptions/regions.

Refer: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftnetwork

I also confirmed this with Azure Application gateway Product Group team.

The only way to migrate an Application gateway to another subscription is to recreate it in the new subscription.

Regards,

Gita
Andrea Ciciliano 120 Reputation points

2023-09-26T10:29:05.2366667+00:00

OK Thank you guys

Accepted answer

0 additional answers

Your answer

GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2023-09-26T06:50:13.2833333+00:00

Hello @Abdelwahid El Mazghari ,

As per Azure move support, Application gateways and WAF policies are not supported for move across resource groups/subscriptions/regions.

Refer: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftnetwork

I also confirmed this with Azure Application gateway Product Group team.

The only way to migrate an Application gateway to another subscription is to recreate it in the new subscription.

Regards,

Gita
Andrea Ciciliano 120 Reputation points

2023-09-26T10:29:05.2366667+00:00

OK Thank you guys

Answer 1

Hello @Andrea Ciciliano ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you would like to know if it is possible to move an Application Gateway between two subscriptions.

Application gateways and WAF policies are not supported for move across resource groups/subscriptions/regions.

User's image

Refer: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/move-support-resources#microsoftnetwork

So, the only option is to recreate the Application gateway in the new subscription.

However, to minimize downtime, you could follow a few steps as below:

You can export your existing App gateway configuration via ARM template, Bicep, PowerShell, CLI, etc.
You can either export template from your existing resource group or the Application gateway.

Refer: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/export-template-portal

https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/export-template-cli

https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/export-template-powershell

Deploy the dependent resources such Key vaults and upload certificates.
Modify the exported template per your requirement and then deploy the Application gateway in the new subscription using that template.
Do a DNS swap to the newly provisioned application gateway (meaning point your DNS name or custom domain to the newly created application gateway).
Once the newly created Application gateway is fully provisioned and working, you can delete your old gateway.

This should result in almost no downtime.

Kindly let us know if the above helps or you need further assistance on this issue.

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Zahid Makandar - TSS Consultancy 75 Reputation points

2024-02-13T07:05:32.5733333+00:00

Hi Does redeploying application gateway with template works in scenario where we have https(port 443) listeners as well? because I tried and it gave me multiple errors.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2024-02-14T15:55:00.7033333+00:00

@Zahid Makandar - TSS Consultancy, what errors are you receiving?

Share via

AZURE APPLICATION GATEWAY

0 additional answers

Your answer