Azure Windows VM based IIS Server fails to open new webpage of website - Frontended by Azure Application Gateway

Question

Azure Windows VM based IIS Server fails to open new webpage of website - Frontended by Azure Application Gateway

Ravi Kumar Shanker 121

Hello Team,

This is a very simple setup. All we have is

One app server (Azure Windows VM with IIS Role installed)
Managed SQL DB
One VNET with 3 subnets for VPN Gateway, Application Gateway and Private subnet for App Server (Windows VM)

The application server is front ended by application gateway (WAF, Medium Size Instance) with public IP address. This public IP address is registered to a domain registrar with custom DNS name.

User can access the application server by accessing the custom DNS name of application gateway via internet and everything works great!

However, when user clicks on any module within website's landing page, when it opens new tab it makes use of private IP address of the application server (windows VM) to open and it fails.

Locally to resolve this issue inside the application server itself, we created a IIS binding with custom DNS name but this did not resolve the issue while accessing via internet.

How to fix this issue? How to make sure the IIS server does not use the local IP address of server to open new webpage or is there a way we need to do any configuration with the application gateway to redirect local IP to DNS name etc.?

GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2021-12-29T14:26:01.39+00:00

Hello @Ravi Kumar Shanker ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

What is the SKU of your Application gateway (v1 or v2)?

Could you please share the listener configuration on your Application gateway?
Also, when opening the module within website's landing page, does the webpage do a redirect (301/302)?

On the twitter post, you have mentioned that the users login to the webpage, what is the authentication type used?

Regards,
Gita Sharma
Ravi Kumar Shanker 121 Reputation points

2021-12-29T17:22:06.09+00:00

Hello Gita,
Thank you for responding.

Application Gateway tier is WAF and size is Medium (Not sure if WAF tier falls under V1 or V2).

Listener Config:
Frontend IP: Public
Port: 443
Protocol: HTTPS
Certificate: Custom CA signed cert
Listener Type: Basic
Error page url: No

It is 302 redirect.

User login via credentials created at the application level, not Azure AD etc.

The landing page works fine, but the subsequent webpage when customer click any module fails since it tries loading via private IP address of the app server.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2021-12-29T18:09:27.307+00:00
Thank you for the details, @Ravi Kumar Shanker .

Could you please add a HTTP listener with port 80 and create a rule for HTTP to HTTPS redirection?

Steps to follow:

Create a basic HTTP listener with port 80.

Select Rules and then select +Request routing rule.

For the Rule name, type a desired name.

Ensure the newly created HTTP listener is selected for the listener.

Click on Backend targets tab and select Target type as Redirection.

For Redirection type, select Permanent.

For Redirection target, select Listener.

Ensure the Target listener is set to your existing HTTPS listener.

For the Include query string and Include path select Yes.

Select Add.

Reference : https://learn.microsoft.com/en-us/azure/application-gateway/redirect-http-to-https-portal#add-a-listener-and-redirection-rule

And post this configuration, check if the webpage works fine via Application gateway.

Regards,
Gita
Ravi Kumar Shanker 121 Reputation points

2021-12-29T18:39:24.177+00:00

Hello Gita,

Thanks again!

I just tried the steps you shared but there is no change.

So, for example: https://contoso.com/Test/Dashboard/Default.aspx is the default URL which users via internet will access the website hosted in application server (Windows VM IIS) -> This portion works fine and user is able to see the page and login etc.

Once they are in, when they click on any module, this is the URL it tries to load: http://10.10.1.4/Test/Dashboard1/login.aspx

(Where 10.10.1.4 is the private IP address of the application server (Windows VM)) and if I manually replace the URL as this: https://contoso.com/Test/Dashboard1/login.aspx it works.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2021-12-29T18:53:47.697+00:00

@Ravi Kumar Shanker , could you please share the binding settings from your IIS server?
Ravi Kumar Shanker 121 Reputation points

2021-12-29T19:03:34.933+00:00

Sure! Here is the IIS Server Binding:
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2021-12-29T19:15:51.737+00:00

Thank you for sharing the details, @Ravi Kumar Shanker .

Looks like you are using a hostname in your IIS server bindings but in Application gateway, you are using a Basic listener which will not work.

Could you please change your HTTPS listener type from Basic to Multi-site?
Just click on the existing listener and change the listener type to Multi-site and add the host name as the one added in your IIS bindings and save the listener.

Wait for sometime and try again.
Ravi Kumar Shanker 121 Reputation points

2021-12-29T19:24:27.977+00:00

Gita,

Just tried your suggestion and did the necessary changes, it did not work.

Basically, AppGW's public IP is domain registered and the same registered DNS name we have used inside the application server IIS for binding.

Also, with in the application server itself, everything works good because of binding and the DNS resolution of 10.10.1.4 to the registered domain name.

If somehow, we force IIS to open new webpage using the DNS name instead of private IP 10.10.1.4, we should be able to resolve the issue.

But I am running out of thoughts.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2021-12-29T19:46:08.337+00:00

@Ravi Kumar Shanker , I suggested changing the listener to multi-site because the IIS binding had a host name configured which means the backend server would expect the request to come in via the specific configured host name.

Let us try one last thing and if that doesn't work, we will take this issue offline for further investigation.

Change the HTTPS listener back to basic type.
Do not delete the HTTP listener and redirection rule that we created before.

Now, go to IIS bindings of your web server and remove the host name from it and click OK.

Restart your IIS server and try again.
If this doesn't fix the issue, please send us an email as requested in the private message.

Regards,
Gita
Ravi Kumar Shanker 121 Reputation points

2021-12-30T04:19:16.807+00:00

Hello Gita,

Thank you for your support so far.

I tried the last action plan and still the same issue. I sent you an email as requested.

Accepted answer

0 additional answers

Your answer

GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2021-12-29T14:26:01.39+00:00

Hello @Ravi Kumar Shanker ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

What is the SKU of your Application gateway (v1 or v2)?

Could you please share the listener configuration on your Application gateway?
Also, when opening the module within website's landing page, does the webpage do a redirect (301/302)?

On the twitter post, you have mentioned that the users login to the webpage, what is the authentication type used?

Regards,
Gita Sharma
Ravi Kumar Shanker 121 Reputation points

2021-12-29T17:22:06.09+00:00

Hello Gita,
Thank you for responding.

Application Gateway tier is WAF and size is Medium (Not sure if WAF tier falls under V1 or V2).

Listener Config:
Frontend IP: Public
Port: 443
Protocol: HTTPS
Certificate: Custom CA signed cert
Listener Type: Basic
Error page url: No

It is 302 redirect.

User login via credentials created at the application level, not Azure AD etc.

The landing page works fine, but the subsequent webpage when customer click any module fails since it tries loading via private IP address of the app server.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2021-12-29T18:09:27.307+00:00

Thank you for the details, @Ravi Kumar Shanker .

Could you please add a HTTP listener with port 80 and create a rule for HTTP to HTTPS redirection?

Steps to follow:

Create a basic HTTP listener with port 80.

Select Rules and then select +Request routing rule.

For the Rule name, type a desired name.

Ensure the newly created HTTP listener is selected for the listener.

Click on Backend targets tab and select Target type as Redirection.

For Redirection type, select Permanent.

For Redirection target, select Listener.

Ensure the Target listener is set to your existing HTTPS listener.

For the Include query string and Include path select Yes.

Select Add.

Reference : https://learn.microsoft.com/en-us/azure/application-gateway/redirect-http-to-https-portal#add-a-listener-and-redirection-rule

And post this configuration, check if the webpage works fine via Application gateway.

Regards,
Gita
Ravi Kumar Shanker 121 Reputation points

2021-12-29T18:39:24.177+00:00

Hello Gita,

Thanks again!

I just tried the steps you shared but there is no change.

So, for example: https://contoso.com/Test/Dashboard/Default.aspx is the default URL which users via internet will access the website hosted in application server (Windows VM IIS) -> This portion works fine and user is able to see the page and login etc.

Once they are in, when they click on any module, this is the URL it tries to load: http://10.10.1.4/Test/Dashboard1/login.aspx

(Where 10.10.1.4 is the private IP address of the application server (Windows VM)) and if I manually replace the URL as this: https://contoso.com/Test/Dashboard1/login.aspx it works.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2021-12-29T18:53:47.697+00:00

@Ravi Kumar Shanker , could you please share the binding settings from your IIS server?
Ravi Kumar Shanker 121 Reputation points

2021-12-29T19:03:34.933+00:00

Sure! Here is the IIS Server Binding:
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2021-12-29T19:15:51.737+00:00

Thank you for sharing the details, @Ravi Kumar Shanker .

Looks like you are using a hostname in your IIS server bindings but in Application gateway, you are using a Basic listener which will not work.

Could you please change your HTTPS listener type from Basic to Multi-site?
Just click on the existing listener and change the listener type to Multi-site and add the host name as the one added in your IIS bindings and save the listener.

Wait for sometime and try again.
Ravi Kumar Shanker 121 Reputation points

2021-12-29T19:24:27.977+00:00

Gita,

Just tried your suggestion and did the necessary changes, it did not work.

Basically, AppGW's public IP is domain registered and the same registered DNS name we have used inside the application server IIS for binding.

Also, with in the application server itself, everything works good because of binding and the DNS resolution of 10.10.1.4 to the registered domain name.

If somehow, we force IIS to open new webpage using the DNS name instead of private IP 10.10.1.4, we should be able to resolve the issue.

But I am running out of thoughts.
GitaraniSharma-MSFT 50,021 Reputation points Microsoft Employee Moderator

2021-12-29T19:46:08.337+00:00

@Ravi Kumar Shanker , I suggested changing the listener to multi-site because the IIS binding had a host name configured which means the backend server would expect the request to come in via the specific configured host name.

Let us try one last thing and if that doesn't work, we will take this issue offline for further investigation.

Change the HTTPS listener back to basic type.
Do not delete the HTTP listener and redirection rule that we created before.

Now, go to IIS bindings of your web server and remove the host name from it and click OK.

Restart your IIS server and try again.
If this doesn't fix the issue, please send us an email as requested in the private message.

Regards,
Gita
Ravi Kumar Shanker 121 Reputation points

2021-12-30T04:19:16.807+00:00

Hello Gita,

Thank you for your support so far.

I tried the last action plan and still the same issue. I sent you an email as requested.

Answer 1

Hello @Ravi Kumar Shanker ,

Below is the summary and resolution of the issue:

You have an Azure application gateway setup with Azure Windows VM based IIS Server backend which fails to open new webpage of website. You were able to access the application server via the custom DNS name of application gateway and were able to login. However, when you click on any module within website's landing page, it opens a new tab and uses the private IP address of the application server (windows VM) to open and fails.

We checked the network diagnostics when accessing the application gateway and found that the application is sending the private IP address in the host name of all the modules in it's response. You then changed the backend HTTP setting configuration of the application gateway to "Override with new host name" and added the custom domain in the settings as below:

Post this change, the application gateway is able to access all the modules without any issues.

----------------------------------------------------------------------------------------------------------------

Please don’t forget to close the thread by clicking "Accept the answer", as this can be beneficial to other community members.

Share via

Azure Windows VM based IIS Server fails to open new webpage of website - Frontended by Azure Application Gateway

0 additional answers

Your answer