Configure Custom page on Application Gateway with static web site in the storage account

Question

Configure Custom page on Application Gateway with static web site in the storage account

SLIMANI Smail 60

hello,

I want to configure error pages (403, 502..) on the Application Gateway using a static site hosted on a storage account. I've allowed the subnet of the Application Gateway and its public IP address.

When I add the URL of the dedicated page to my listener, I encounter this error.

Error: Custom error page for status code '403', has a URL xxxx.z28.web.core.windows.net/static/403/index.html' for which the blob or container does not exist, for httpListeners

However, when I remove the IP address restrictions on the storage account(enable for all network), adding the URL to the listener works.

Any Help please ?

regards

ChaitanyaNaykodi-MSFT 27,661 Reputation points Microsoft Employee Moderator

2023-12-18T22:29:17.3133333+00:00

@SLIMANI Smail OBS/DD

Thank you for reaching out. I understand you are getting an error when you apply IP restrictions on your Azure Storage account to only allow Application gateway's public IP and the private subnet address to access the custom error URL.

Currently the documentation for custom error pages states that

ensure the error page is publicly accessible and return a 200 response.

The documentation does not mention that the error page should be accessible using Azure Application gateway's public IP. Let me confirm if this is the expected behavior with the team internally.

Meanwhile can you please let me know what is your use case to restrict the access to the static page only to Application Gateway?

Thank you!
SLIMANI Smail 60 Reputation points

2023-12-19T08:27:36.4833333+00:00

@ChaitanyaNaykodi-MSFT

Thank you for your response. We use a storage account to host the static web for various reasons, such as custom pages on the application gateway and a backend for when our site is in maintenance status.
We want only the Application Gateway to have access to the static site.
ChaitanyaNaykodi-MSFT 27,661 Reputation points Microsoft Employee Moderator

2023-12-21T21:15:40.77+00:00

@SLIMANI Smail OBS/DD

Thank you for sharing the information above. I have reached out to the team internally regarding this issue and will make an update here as soon as I get a response. Thank you!

1 answer

Your answer

ChaitanyaNaykodi-MSFT 27,661 Reputation points Microsoft Employee Moderator

2023-12-18T22:29:17.3133333+00:00

@SLIMANI Smail OBS/DD

Thank you for reaching out. I understand you are getting an error when you apply IP restrictions on your Azure Storage account to only allow Application gateway's public IP and the private subnet address to access the custom error URL.

Currently the documentation for custom error pages states that

ensure the error page is publicly accessible and return a 200 response.

The documentation does not mention that the error page should be accessible using Azure Application gateway's public IP. Let me confirm if this is the expected behavior with the team internally.

Meanwhile can you please let me know what is your use case to restrict the access to the static page only to Application Gateway?

Thank you!
SLIMANI Smail 60 Reputation points

2023-12-19T08:27:36.4833333+00:00

@ChaitanyaNaykodi-MSFT

Thank you for your response. We use a storage account to host the static web for various reasons, such as custom pages on the application gateway and a backend for when our site is in maintenance status.
We want only the Application Gateway to have access to the static site.
ChaitanyaNaykodi-MSFT 27,661 Reputation points Microsoft Employee Moderator

2023-12-21T21:15:40.77+00:00

@SLIMANI Smail OBS/DD

Thank you for sharing the information above. I have reached out to the team internally regarding this issue and will make an update here as soon as I get a response. Thank you!

Answer 1

ChaitanyaNaykodi-MSFT 27,661 Microsoft Employee Moderator

@SLIMANI Smail OBS/DD

Thank you for your patience here.

I got a response back from the team.

The storage account must be publicly accessible for the custom error pages to work. Currently it is not possible to restrict access to the custom error pages only to the Application Gateway. If you wish to add this as a feature, please feel free to share your feedback on the Azure Feedback portal

Hope this helps! Please let me know if you have any additional questions. Thank you!

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

SLIMANI Smail 60 Reputation points

2023-12-26T08:28:08.4166667+00:00

Hello @ChaitanyaNaykodi-MSFT

Out of curiosity, I enabled logs at the storage account level to monitor incoming traffic during my test from the Application Gateway. Strangely, I came across a private IP address that doesn't seem to belong to any subnet in my virtual network.

2.0;2023-12-19T15:52:37.0000910Z;GetWebContentProperties;AnonymousIpAuthorizationError;404;3;3;anonymous;;xxxxxxxx;blob;https://xxxxxxxx.z28.web.core.windows.net/static/502/index.html;"/xxxxxxxx/$web/static/502/index.html";89c0652f-e01e-00d2-0793-32313c000000;0;10.0.118.166;2018-03-28;316;0;133;0;0;;;;Monday, 01-Jan-01 00:00:00 GMT;;"Azure-Storage/9.3.2 (.NET CLR 4.0.30319.42000; Win32NT 6.2.9200.0)";;"94b7cb00-d66c-42a2-be24-6053b906c1c3";;;;;;;;

Do you have any insights into the origin of this IP, and is there a way to authorize and whitelist it?

Regards,
ChaitanyaNaykodi-MSFT 27,661 Reputation points Microsoft Employee Moderator

2023-12-29T00:41:55.2033333+00:00

@SLIMANI Smail OBS/DD

Thank you for reaching out.

Actually, the IP used for the internal working and validations of the Azure Application Gateway which is proprietary to Azure. I do not think authoring and whitelisting this IP address will help.

Hope this helps! Please let me know if you have any additional questions. Thank you!

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.

Share via

Configure Custom page on Application Gateway with static web site in the storage account

1 answer

Your answer