Hello all, I'm using Azure Front Door (AFD) with Azure Kubernetes Service (AKS), employing a Private Link Service (PLS) to provide internal access (AFD > PLS > Private Link > Internal Load Balancer > Pod). I've configured one endpoint in AFD with two routes: Route A: domain.com/* Origin: pls-alias:8443 Route B: domain.com/api/* Origin: pls-alias:8444 However, when I access the URL of Route A, I'm being redirected to the port of Route B. I've checked the logs (FrontDoorAccessLog), and I can confirm that the rule mappings are correct (the traffic is mapped to Route A but redirects to the port of Route B). The Origin URL in the logs is domain.com:8444/. When accessing the internal IP from the Internal Load Balancer, I can access the backend correctly on ports 8444 and 8443 (as expected). Can someone help me? Thanks.

@Redel, Renan Augusto , Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well. I tried to repo your set up and I was not able to. I had an IIS Service with 2 Ports - 80 and 81. A single end point Route1 Patterns to match - /* OriginGroup - origingroup1 has one origin with a PublicIP origingroup1's origin has HTTP port as 80 Route2 Patterns to match - /api/* OriginGroup - origingroup2 with a PublicIP (I am using a second origin group with same IP as origingroup1) origingroup2's origin has HTTP port as 81 Please see the logs : P.S : You have to make sure there exists a folder called "api" in your origin. I'd suggest you check the configuration once again. Should the issue persist, can you please share the results of this Kusto query so I can verify it. AzureDiagnostics | where Category == "FrontDoorAccessLog" |where routingRuleName_s == " | project TimeGenerated, requestUri_s, httpStatusCode_s, httpStatusDetails_s, routingRuleName_s, originUrl_s , domain_s i.e. write an AND condition to Match RouteA in "routingRuleName_s" and the Port of RouteB in "originUrl_s" If the result is empty set, this means Route A never redirected traffic to the Port of RouteB. Cheers, Kapil

Azure Frontdoor using wrong port to forward traffic to AKS

Accepted answer

KapilAnanth-MSFT 47,726 Reputation points Microsoft Employee

2024-05-13T05:12:32.8433333+00:00
@Redel, Renan Augusto ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

I tried to repo your set up and I was not able to.

I had an IIS Service with 2 Ports - 80 and 81.

A single end point

Route1

Patterns to match - /*

OriginGroup - origingroup1 has one origin with a PublicIP

origingroup1's origin has HTTP port as 80

Route2

Patterns to match - /api/*

OriginGroup - origingroup2 with a PublicIP (I am using a second origin group with same IP as origingroup1)

origingroup2's origin has HTTP port as 81

Please see the logs :

P.S : You have to make sure there exists a folder called "api" in your origin.

I'd suggest you check the configuration once again.

Should the issue persist, can you please share the results of this Kusto query so I can verify it.

AzureDiagnostics | where Category == "FrontDoorAccessLog" |where routingRuleName_s == " | project TimeGenerated, requestUri_s, httpStatusCode_s, httpStatusDetails_s, routingRuleName_s, originUrl_s , domain_s

i.e. write an AND condition to Match RouteA in "routingRuleName_s" and the Port of RouteB in "originUrl_s"

If the result is empty set, this means Route A never redirected traffic to the Port of RouteB.

Cheers,

Kapil
Please sign in to rate this answer.
Redel, Renan Augusto 20 Reputation points

2024-05-13T11:41:41.7833333+00:00

Hi @KapilAnanth-MSFT ,

Follow below some screenshots:

Origin group A, Route A (pattern /*):

Origin Group B, Route B (pattern /api/*)

Routers:

Both use the same host name alias (the PLS):

Logs:

As you can see, the AFD maps the traffic to the correct route, but the OriginURL sends to the PLS, using the port 8444 instead (from Route B).

Print detailed:

KapilAnanth-MSFT 47,726 Reputation points Microsoft Employee

2024-05-13T13:07:39.4766667+00:00

@Redel, Renan Augusto ,

Thanks for sharing the info. This is strange.

A mismatch between RoutingRule and the Origin of the RoutingRule (port) should not be happening.

I believe this is an isolated issue, specific to your environment.

As next steps, I'd suggest you file a support ticket, where a support engineer can have a screen share session and check the backend logs to pinpoint the issue.

In case you need a one-time free technical support, please do let us know

NOTE:

Not sure if this has been tried, you can always delete the routes and origin groups and reconfigure them (if that is something you are comfortable with)

However, doing so will not help you identify the root cause in the pre-deleted configuration.

Cheers,

Kapil.

Redel, Renan Augusto 20 Reputation points

2024-05-15T12:21:42.8666667+00:00

I just got the reply from the MS Support.

There's a limitation/issue on the PLS. If there two or more routes to the same PLS and both (or more) routes using in the same region, the AFD use the latest PLS configuration added to every connection. This behavior are under invetigation by MS.

To workaround this, is possible to adjust the PLS connect (in the AFD), to another region. This will create another Private Endpoint (to be approved), and increase the latency between the User, AFD and Origin resource.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.