502 Bad Gateway when calling a container app via the application gateway

Question

502 Bad Gateway when calling a container app via the application gateway

AzureRACO 20

I've followed the guide here: https://learn.microsoft.com/en-us/azure/container-apps/waf-app-gateway?tabs=custom-domain

I have:

1 container app running on port 8080
1 container app environment, set to internal, in a subnet in a vnet with a network endpoint
1 private DNS zone, with the container app environment IP added to the records
1 application gateway, in a subnet in the same vnet as above, with a network endpoint added.
1 frontend
1 backend pool, with the container app added

The backend health shows 'Cannot connect to backend server. Check whether any NSG/UDR/Firewall is blocking access to the server. Check if application is running on correct port. To learn more visit - https://aka.ms/servernotreachable.'. Clicking 'troubleshoot' shows 'Probes sent: 30, probes failed: 30', but seeing the details shows both as healthy.

I've checked the app (it's healthy), the frontend and backend pool, everything is as it should be (I believe).

I'm at a loss as to where to look next.

Pravallika KV 10,725 Reputation points Microsoft External Staff Moderator

2026-02-24T12:56:47.1933333+00:00
Hi @AzureRACO ,

Based on your setup, here are some potential causes and steps you can take:

Your backend health report indicates that it "Cannot connect to backend server." This is often due to Network Security Group (NSG) rules, User-Defined Routes (UDR), or firewall configurations disrupting traffic. Double-check that these policies allow communication between your app and the Application Gateway.

App Configuration:

Ensure your container app is correctly configured to listen on port 8080, which should be specified in your backend pool settings.

Verify the ingress settings of your container app to see if internal or external access is properly set up. For example, if the HTTP ingress is enabled, make sure the targetPort corresponds to the port your application listens on.

Timeout Settings: Azure Application Gateway has a default request timeout of 20 seconds. If your backend application needs more time to process requests, consider increasing this timeout setting in your backend HTTP settings.

Confirm that your Application Gateway health probes are correctly configured for your backend pool. Make sure that the health probe can reach the endpoint of your container app and that it returns a healthy response.

Check your Log Analytics workspace for any errors related to the downtime or health probes. Look for any entries that are timestamped around the time you experienced the issue. This can help pinpoint the cause.

Verify that your container app can run locally without issues. It’s essential to ensure there's nothing in site-specific configurations that might disrupt its ability to accept requests.

If you are using private DNS, ensure it correctly maps to your container app's environment IP.

Hope this helps!

References:

Monitor and Troubleshoot Azure Application Gateway

HTTP response codes - Azure Application Gateway

Troubleshoot bad gateway errors in Application Gateway

Troubleshoot 504 Gateway Timeout Errors
AzureRACO 20 Reputation points

2026-02-24T13:31:48.0266667+00:00
@Pravallika KV

Yeap, it's all configured.

It's correctly.

Ingress for the environment is 'internal', and is enabled on the app itself.

The app is returning static data, so no timeouts.

It isn't just the health probes - it's the whole request bringing a 502 Bad Gateway

There isn't any logs for this as we don't get to the container app.

It can, and was running fine before we tried to get it exposed via the AAG.

The IP for the environment is in the private DNS. Tried both the IP for the container app environment and the NIC.
Pravallika KV 10,725 Reputation points Microsoft External Staff Moderator

2026-02-27T09:26:55+00:00

Hi @AzureRACO , following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

1 answer

Your answer

AzureRACO 20 Reputation points

2026-02-24T13:31:48.0266667+00:00

@Pravallika KV

Yeap, it's all configured.

It's correctly.

Ingress for the environment is 'internal', and is enabled on the app itself.

The app is returning static data, so no timeouts.

It isn't just the health probes - it's the whole request bringing a 502 Bad Gateway

There isn't any logs for this as we don't get to the container app.

It can, and was running fine before we tried to get it exposed via the AAG.

The IP for the environment is in the private DNS. Tried both the IP for the container app environment and the NIC.
Pravallika KV 10,725 Reputation points Microsoft External Staff Moderator

2026-02-27T09:26:55+00:00

Hi @AzureRACO , following up to see if you had a chance to check the above response and if it was helpful. Please let me know if you have any questions.

Answer 1

Hi @AzureRACO ,

Thanks for reaching out to Microsoft Q&A.

Since the app was working before and is now throwing a 502 Bad Gateway, the issue is likely with the Application Gateway configuration or network routing. Double-check:

NSG/UDR rules: Double-check the NSGs on the subnets where both the Application Gateway and container app are located. Ensure that both incoming and outgoing traffic are allowed, especially for traffic from the Application Gateway’s frontend to the container app environment.
- Inbound NSG: Ensure it's allowing traffic from the Application Gateway subnet.
- Outbound NSG: Ensure outbound traffic is allowed from the container app to the Application Gateway.
- If you're using User-Defined Routes (UDRs), make sure there are no conflicting routes that might block the traffic to your container app.
Health Probe Configuration:

You mentioned both probes show healthy, but it’s worth diving into probe settings:

Protocol: Confirm the probe is set to HTTP/HTTPS (depending on your app’s setup).
- Path: Ensure the probe path is correct (e.g., /health if that’s how your container app is set up).
- Port: Confirm the probe is checking the right port (8080 in your case).
- Interval and Timeout: Double-check if the probe settings are too aggressive (timeouts too short, or probe interval too long). A smaller interval (e.g., 10 seconds) or longer timeout (e.g., 10 seconds) might help.

Private DNS: You mentioned using private DNS. Verify that:
- The DNS resolution is correctly pointing to the correct backend IP.
- Ensure the DNS record has propagated correctly across the VNet (sometimes DNS issues can be subtle and take time to resolve across the network).
App Gateway settings: Verify the correct backend pool, HTTP settings, and health probes are configured.
Direct access: Test accessing the container app directly (bypassing AAG) to isolate if the issue is with the AAG.

A misconfiguration or missing setting in the AAG could be causing the 502 error. Hope this helps!

If the resolution was helpful, kindly take a moment to click on User's image and click on Yes for was this answer helpful. And, if you have any further query do let us know.

Pravallika KV 10,725 Reputation points Microsoft External Staff Moderator

2026-03-03T20:39:18.6066667+00:00

@AzureRACO , following up to see if the provided answer was helpful. If this answers your query, do click Accept Answer =>Yes, and upvote it. If you have any further queries do let us know.

Share via

502 Bad Gateway when calling a container app via the application gateway

1 answer

Your answer