如何结合azure app proxy以及 azure load balancer进行应用代理

Question

如何结合azure app proxy以及 azure load balancer进行应用代理

陈敏 1

我的应用场景：使用azure AD进行应用身份认证，并使用应用代理（azure app proxy）来保证本地web应用服务只暴露在本地网络（aws vm, webapp on-premises），如下图所示：

现在我的本地web应用要做HA，我的想法是在 azure app proxy connector和 my webapp之间加一层 azure load balancer，

但这使我感觉比较困惑，这样的话，我的应用前面岂不是经过了3次代理（user->app proxy->app proxy connector->azure load balancer-> my webapp），

性能方面也会损失，请问有更好的方法吗？

期待你们的回复，谢谢！

SaiKishor-MSFT 17,336 Reputation points Moderator

2021-09-14T16:37:50.2+00:00

@陈敏 Thank you for reaching out to Microsoft Q&A.

I understand that you are having questions regarding adding a Load Balancer in between your App Proxy and your Web App since you need HA for your local apps.

I would suggest you to rather place the Load Balancer in front of the App Proxy as shown in the picture below:

The request goes through an Azure Load Balancer to determine which Application Proxy service instance should take the request. Per region, there are tens of instances available to accept the request. This method helps to evenly distribute the traffic across the service instances. Please go through High Availability and Load Balancing of your application Proxy connectors and applications for more details.

I will be moving this issue to the AD-Application-Proxy Team so they can also answer further if needed. In the meanwhile, if you have any further questions/concerns, please do let us know.
陈敏 1 Reputation point

2021-09-15T04:09:11.423+00:00

thank you very much, I also want to know what the AD-Application-Proxy Team sugguest.

1 answer

Your answer

SaiKishor-MSFT 17,336 Reputation points Moderator

2021-09-14T16:37:50.2+00:00

@陈敏 Thank you for reaching out to Microsoft Q&A.

I understand that you are having questions regarding adding a Load Balancer in between your App Proxy and your Web App since you need HA for your local apps.

I would suggest you to rather place the Load Balancer in front of the App Proxy as shown in the picture below:

The request goes through an Azure Load Balancer to determine which Application Proxy service instance should take the request. Per region, there are tens of instances available to accept the request. This method helps to evenly distribute the traffic across the service instances. Please go through High Availability and Load Balancing of your application Proxy connectors and applications for more details.

I will be moving this issue to the AD-Application-Proxy Team so they can also answer further if needed. In the meanwhile, if you have any further questions/concerns, please do let us know.
陈敏 1 Reputation point

2021-09-15T04:09:11.423+00:00

thank you very much, I also want to know what the AD-Application-Proxy Team sugguest.

Answer 1

JamesTran-MSFT 37,221 Microsoft Employee Moderator

@陈敏
Thank you for your post, and for your time and patience throughout this issue!

As @SaiKishor-MSFT suggested, and based off our High availability and load balancing of your Application Proxy connectors and applications documentation, it's recommended to place the Load Balancer in front of the App Proxy.

For more info - Traffic distribution across connectors

Additional Links:
Plan an Azure AD Application Proxy deployment
Understand Azure AD Application Proxy connectors
Publish applications on separate networks and locations using connector groups

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

陈敏 1 Reputation point

2021-09-16T04:13:28.54+00:00

Thank you！Another question want to ensure，Do azure app proxy connectors know my backend servers alive or ALB knows？
the diagrams below witch is right？
JamesTran-MSFT 37,221 Reputation points Microsoft Employee Moderator

2021-09-20T20:43:07.003+00:00

@陈敏
Thank you for following up on this!

Based off our documentation, if you're organizing connectors into a Connector Group, you can set each application to work with a specific connector group. In your specific diagram, I believe scenario B would be correct since it's leveraging Connectors within a Connector Group.

For more info, I'd recommend reviewing our Publish applications on separate networks and locations using connector groups or Traffic flow between connectors and back-end application servers documentation.

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

Share via

如何结合azure app proxy以及 azure load balancer进行应用代理

1 answer

Your answer