Application Gateway in front of Azure Firewall design

Question

Application Gateway in front of Azure Firewall design

AzurePro 60

i have requirment where need to seperate public facing application traffic seperately. we going to use Application Gateway in front of Azure Firewall design.

Internet >> Application gateway >> Azure firewall >> Vnet(web application)

what will be there backend pool of application gateway needs to be configured here? if azure firewall then which ip of azure firewall should be configure?

G Sree Vidya 660 Reputation points Microsoft External Staff

2025-03-18T17:00:17.78+00:00

Hello AzurePro

I wanted to follow up and check if you had the opportunity to review the information provided by Divyesh Govaerdhanan in our previous post.

Additionally! you can refer Network routing to route the outbound traffic from the web app using below document.

https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration#network-routing

Kindly let us know if the above helps or you need further assistance on this issue.
G Sree Vidya 660 Reputation points Microsoft External Staff

2025-03-19T07:23:57.4066667+00:00

Hello AzurePro

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution,

please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

1 answer

Your answer

G Sree Vidya 660 Reputation points Microsoft External Staff

2025-03-18T17:00:17.78+00:00

Hello AzurePro

I wanted to follow up and check if you had the opportunity to review the information provided by Divyesh Govaerdhanan in our previous post.

Additionally! you can refer Network routing to route the outbound traffic from the web app using below document.

https://learn.microsoft.com/en-us/azure/app-service/overview-vnet-integration#network-routing

Kindly let us know if the above helps or you need further assistance on this issue.
G Sree Vidya 660 Reputation points Microsoft External Staff

2025-03-19T07:23:57.4066667+00:00

Hello AzurePro

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution,

please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Answer 1

Hello,

Welcome to Microsoft Q&A, thank you for asking your question.

You should set the Application Gateway's backend pool to the Azure Firewall's private IP address. This setup ensures that all incoming traffic passes through the Application Gateway and is then forwarded to the Azure Firewall for inspection before reaching your web applications within the Virtual Network (VNet).

Navigate to your Azure Firewall instance in the Azure Portal.
Locate the private IP address assigned to the firewall within its dedicated subnet (AzureFirewallSubnet).

For more information on the architecture and best practices, please have a look into the below link.

https://learn.microsoft.com/en-us/azure/architecture/example-scenario/gateway/firewall-application-gateway#application-gateway-in-front-of-azure-firewall-design Diagram that shows the Application Gateway in front of Azure Firewall design.

Please Upvote and Accept the answer if it helps!!

Share via

Application Gateway in front of Azure Firewall design

1 answer

Your answer