Is it long connection between azure application gateway and back-end server pools?

Question

Is it long connection between azure application gateway and back-end server pools?

Lynn Niu 236

In official document, we never find this. We have some strange issues related to this. Is it long connection between azure application gateway and back-end server pools? Or every new request, azure application gateway will open a new connection?

1 answer

Your answer

Answer 1

Hello @Lynn Niu

Here is a picture that shows how application gateway works.
Short answer: After the application gateway determines the backend server, it opens a new TCP session with the backend server based on HTTP settings

First, the request is coming from the client, If a request is valid and not blocked by WAF, the application gateway evaluates the request routing rule that's associated with the listener. This action determines which backend pool to route the request to.
Based on the request routing rule, the application gateway determines whether to route all requests on the listener to a specific backend pool, route requests to different backend pools based on the URL path, or redirect requests to another port or external site.
When the application gateway selects the backend pool, it sends the request to one of the healthy backend servers in the pool (y.y.y.y). The health of the server is determined by a health probe. If the backend pool contains multiple servers, the application gateway uses a round-robin algorithm to route the requests between healthy servers. This load balances the requests on the servers.
After the application gateway determines the backend server, it opens a new TCP session with the backend server based on HTTP settings. HTTP settings specify the protocol, port, and other routing-related settings that are required to establish a new session with the backend server.
The port and protocol used in HTTP settings determine whether the traffic between the application gateway and backend servers is encrypted (thus accomplishing end-to-end TLS) or is unencrypted.
When an application gateway sends the original request to the backend server, it honors any custom configuration made in the HTTP settings related to overriding the hostname, path, and protocol. This action maintains cookie-based session affinity, connection draining, host-name selection from the backend, and so on.

Azure Application Gateway Health Probes:
Azure Application Gateway probes backend servers to check their health status and to check whether they're ready to serve requests.
The default probe request is sent in the format of <protocol>://127.0.0.1:<port>/. For example, http://127.0.0.1:80 for an http probe on port Only HTTP status codes of 200 through 399 are considered healthy. The protocol and destination port are inherited from the HTTP settings.
After Application Gateway sends an HTTP(S) probe request to the backend server, it waits for a response from the backend server for a configured period. If the backend server doesn't respond within the configured period (the timeout value), it's marked as Unhealthy until it starts responding within the configured timeout period again.

https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-backend-health-troubleshooting

Azure Application Gateway Keep-Alives:
Keep-Alive timeout governs how long the Application Gateway will wait for a client to send another HTTP request on a persistent connection before reusing it or closing it. TCP idle timeout governs how long a TCP connection is kept open in case of no activity.
The Keep-Alive timeout in the Application Gateway v1 SKU is 120 seconds and in the v2 SKU it's 75 seconds. The TCP idle timeout is a 4-minute default on the frontend virtual IP (VIP) of both v1 and v2 SKU of Application Gateway. You can configure the TCP idle timeout value on v1 and v2 Application Gateways to be anywhere between 4 minutes and 30 minutes. For both v1 and v2 Application Gateways, you'll need to navigate to the public IP of the Application Gateway and change the TCP idle timeout under the "Configuration" blade of the public IP on Portal

https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-faq

Lynn Niu 236 Reputation points

2022-03-22T05:52:20.317+00:00

Thanks your answer anyway.
However I already check this official document, here it says a new TCP Session will be open, how about HTTP connection (over TCP connection)? Before I contact Microsoft Engineer they say that the application gateway is something like Nginx, and we also know for Nginx it is short connection by default, every new request it will open a new HTTP connection, I want to know how application gateway works since we have strange 502 issues occasionally.
Andriy Bilous 11,821 Reputation points MVP Volunteer Moderator

2022-03-22T09:37:29.263+00:00

Yes, you are right application gateway is something like Nginx, and every new request it will open a new HTTP connection.
Could you please share logs or other related to information to 502 errors?
Lynn Niu 236 Reputation points

2022-03-23T05:13:00.127+00:00

I open a ticket with Microsoft, that's they find in their end (application gateway log), "upstream prematurely closed connection". I can't understand this, if it will open a new HTTP connection, why upstream will close connection cause I'm sure the status of server is working well.
Andriy Bilous 11,821 Reputation points MVP Volunteer Moderator

2022-03-25T07:15:50.553+00:00

The problem is (most often) related to timeouts. Especially if your application on the backend isn’t able to handle requests in an orderly fashion. I’d first increase App Gateway timeouts

Increase TCP idle timeout to 30 minutes(Default is 4 minutes). https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-faq#what-are-the-settings-for-keep-alive-timeout-and-tcp-idle-timeout
Increase HTTP Request timeout(Default is 30 seconds). https://docs.azure.cn/en-us/cli/network/application-gateway/http-settings?view=azure-cli-latest
Lynn Niu 236 Reputation points

2022-03-25T08:52:40.827+00:00

We have tried to increase the timeout, It is not working. And It is not related to timeout since when error happened, the server response time is 0.04s in application gateway access log, it is very short.
Andriy Bilous 11,821 Reputation points MVP Volunteer Moderator

2022-03-28T09:44:42.13+00:00

Another possible error of upstream prematurely closed connection means that your Backend closed connection or App Gateway received an invalid response from the Backend server.

You could see error like:
502 bad gateway

https://bobcares.com/blog/nginx-upstream-error/

What Web server are you using on your backend?
What error logs do you have on you your backend web servers?

Share via

Is it long connection between azure application gateway and back-end server pools?

1 answer

Your answer