Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,217 questions
I can't reach my Azure VM website via https through azure app gateway
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(83.2, 91%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EM%3C/text%3E%3C/svg%3E)
MoTaar
310
Reputation points
I have a virtual machine hosting a website accessible via its public IP address on port 80. I want to enhance the security of the website by configuring access through an Azure Application Gateway using port HTTPS.
Here are the steps I've taken so far:
- Created the virtual machine and deployed the website, successfully accessible via port 80.
- Linked the virtual machine to the backend pool in the Application Gateway.
- Set up backend settings, health probes, two listeners (one for HTTP and one for HTTPS), and two rules. The first rule directs traffic to the HTTPS listener, and the second rule redirects traffic from port 80 to port 443.
- Allowed port 443 on the virtual machine and blocked port 80.
However, after allowing port 443 and blocking port 80, the website is no longer functioning. I would appreciate any guidance or assistance in resolving this issue.
Azure Application Gateway
{count} votes
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 59%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
ChaitanyaNaykodi-MSFT 27,481 Reputation points Microsoft Employee Moderator2023-12-06T04:57:42.9466667+00:00 Thank you for reaching out.
If I understand correctly you have a virtual machine hosting a website accessible via its public IP address on port 80. You want to enhance the website's security by configuring access through an Azure Application Gateway using port HTTPS. However, after allowing port 443 and blocking port 80, the website is no longer functioning. You need guidance or assistance in resolving this issue.
You can try following steps and see if they help in resolving the issue.
- Try accessing the website using the VM's public IP and see if there are no errors, if you able to access the website then the issue is with Application Gateway configuration.
- Follow the troubleshooting document here if there are any backend health issues. Especially
- If there are no backend health issue, it will help if you could share more information on error recieved and screenshots of the routing rules, redirect rule, listener configuration and health probe for your application gateway to help troubleshoot.
Thank you!
-
MoTaar 310 Reputation points
2023-12-06T13:58:54.3066667+00:00 Thank you @ChaitanyaNaykodi-MSFT There is one detail that is missing. The website I created is going to be only for internal use, so I don't have a host name for it. so I didn't set it up in the dns server. I'm accessing it only with the vm's public ip, which is not working any more.
-
ChaitanyaNaykodi-MSFT 27,481 Reputation points Microsoft Employee Moderator
2023-12-08T01:53:16.17+00:00 Thank you for getting back.
The website I created is going to be only for internal use, so I don't have a host name for it. so I didn't set it up in the dns server. I'm accessing it only with the vm's public ip, which is not working any more.
You can create DNS label for the VM's public IP as shown here.
As documented here for End-End TLS in Azure Application Gateway if the backend pool address is an IP address SNI will be set as the hostname from the input FQDN from the client and the backend certificate's CN has to match with this hostname.
If you create a DNS label for the VM as per the document shared above and add the Backend end pool as this FQDN then SNI header (server_name) is set as the hostname from the HTTP settings, otherwise, if PickHostnameFromBackendAddress option is chosen or if no hostname is mentioned, then it will be set as the FQDN in the backend pool configuration.
If I may, you can also choose to do TLS termination at the application gateway, after which traffic typically flows unencrypted to the backend servers.
Thank you!
-
ChaitanyaNaykodi-MSFT 27,481 Reputation points Microsoft Employee Moderator
2023-12-11T17:45:52.5766667+00:00 Just following up here to see if you were able take a look at my comment above. Thank you!
-
MoTaar 310 Reputation points
2023-12-11T23:04:28.7333333+00:00 @ChaitanyaNaykodi-MSFT I tried with the change you provided but it didn't solve the issue.
-
MoTaar 310 Reputation points
2023-12-12T15:23:15.4266667+00:00 The thing that I noticed is that the vm and the app gw are on different subscription and different vnet. so I peered them but still not working :(
-
ChaitanyaNaykodi-MSFT 27,481 Reputation points Microsoft Employee Moderator
2023-12-15T02:09:38.3133333+00:00 Thank you for getting back.
From your question above
virtual machine hosting a website accessible via its public IP address on port 80.
For the HTTPS 443 port are you accessing the backend over a private IP?
If yes then I understand you have peered the VNETS, can you please check if there is no NSG present which is blocking this connectivity?
It will help if you could deploy a test VM in the VNET containing Application Gateway and test if you able to access the Backend VM via HTTPS. You can also run the IP flow verify to test if any NSG is blocking the connectivity.
If this does not help resolve the issue, please share requested details below.
Please share more information on errors received and screenshots of the routing rules, redirect rule, listener configuration and health probe for your application gateway to help troubleshoot.
Thank you!
Sign in to comment
Sign in to answer