I configured azure app gateway as my origin and Health probe is also enabled. When I check the Origin health percentage metrics it is showing 0%. What may be the reason for it? How health probe works in terms of Application Gateway? If I have the app service configured in the Application gateway. In the backend health of the application gateway, app service status is unhealthy. Will the frontdoor routes the traffic to the same app gateway or it will route to the different app gateway ?

azure frontdoor origin health percentage is 0%

Gowda, Hariprasad 86

I configured azure app gateway as my origin and Health probe is also enabled. When I check the Origin health percentage metrics it is showing 0%. What may be the reason for it?
How health probe works in terms of Application Gateway?
If I have the app service configured in the Application gateway. In the backend health of the application gateway, app service status is unhealthy. Will the frontdoor routes the traffic to the same app gateway or it will route to the different app gateway ?

KapilAnanth-MSFT 36,396 Reputation points Microsoft Employee

2022-08-08T14:57:35.783+00:00
Hi @Gowda, Hariprasad ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.
I understand that your AFD Origin health percentage is showing as 0%

Wrt App gateway health,

Can you confirm if the application gateway is accessible via the internet without any issues?

Is the AppGateway responding with 200 HTTP Status or 30X?

Application Gateway Health Probe:

AppGateway probe works like every other probing mechanism.

Here, you even have the ability to create a custom probe so you can configure the interval, frequency, and failure thresholds.

https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-create-probe-portal

Refer below for more details:

https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-components

https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-backend-health-troubleshooting

Thanks,
Kapil.

<<Continuing in the next comment>>
KapilAnanth-MSFT 36,396 Reputation points Microsoft Employee

2022-08-08T14:57:52.673+00:00
Wrt traffic routing,

I assume you have multiple application gateways behind this particular AFD, and behind each app gateway, you have one or more app service(s).

Also, I take it that App Gateway's health is dependent on the respective App Services' health

If one of the AppGateway is showing as unhealthy, the AFD will remove this AppGateway (origin) from the routing pool.

However, if every AppGateway (origin) fails, then Front Door considers all backends unhealthy and routes traffic in a round-robin distribution across all of them.

Once any backend returns to a healthy state, then Front Door will resume the normal load-balancing algorithm.

Refer : https://learn.microsoft.com/en-us/azure/frontdoor/health-probes

Thanks,
Kapil
Gowda, Hariprasad 86 Reputation points

2022-08-09T03:27:29.57+00:00

You mentioned App Gw's health is dependent on the respectives app service's health. In my app gateway one app service is unhealthy will that be the reason for 0% origin health percentage?
KapilAnanth-MSFT 36,396 Reputation points Microsoft Employee

2022-08-09T07:02:31.413+00:00
Hi @Gowda, Hariprasad ,

If you have only one App Service behind the Application gateway, then that could be the issue.

However, if you do have multiple App Services behind your Application gateway, then you should not see 0% health on AFD backend.

Can you please confirm if you are able to reach the App Gateway via the Internet and it is giving a 200 response and not 30x?

Only if you could access App gateway, the health will reflect in AFD metrics.

Thanks,
Kapil.
Gowda, Hariprasad 86 Reputation points

2022-08-10T10:47:28.52+00:00

I created the inbound rules in the NSG of the app gateway to allow it from the azure frontdoor backend service tag. Now from the internet it is not reachable
KapilAnanth-MSFT 36,396 Reputation points Microsoft Employee

2022-08-10T12:31:43.533+00:00
Hi @Gowda, Hariprasad ,

If the App Gateway was already working(reachable via the Internet) before modifying the NSG, then allowing AzureFrontDoor.Backend should not make any changes to Internet reachability.

Before configuring the AppGateway as the backend of FrontDoor, it is important that we make sure AppGateway is working and reachable from the Internet.

Can you please confirm if AppGateway is reachable via the Internet and if the website is loading? (without any service tag)

If yes, then AFD should be able to reach the AppGateway.

If not, we have to troubleshoot the AppGateway on why it is not reachable.

Also, please let me know how many App Services resources are behind a single App Gateway.

Cheers,
Kapil.
Gowda, Hariprasad 86 Reputation points

2022-08-11T06:10:31.853+00:00

App gateway is reachable via internet

5 app services are behind the single app gateway.
Gowda, Hariprasad 86 Reputation points

2022-08-11T06:12:02.687+00:00

all the app services behind the app gateway is healthy
KapilAnanth-MSFT 36,396 Reputation points Microsoft Employee

2022-08-11T10:56:45.71+00:00
Hi @Gowda, Hariprasad ,

Thanks for the update.

If that's the case, adding your application gateway behind AFD should work.

Can you please let us know if you have configured App Gateway to work in HTTP, HTTPS, or both?

Can you please check if the health probes are configured with the same protocol in which the AppGateway works?

When you try to access the AFD, what error message are you getting?

Thanks,
Kapil
Gowda, Hariprasad 86 Reputation points

2022-08-11T12:01:13.927+00:00

Error i am getting is attached and status code is 503
Gowda, Hariprasad 86 Reputation points

2022-08-11T12:34:17.98+00:00

My app gateway is configured with path based routing will that in any case affects my health probe in Frontdoor?
KapilAnanth-MSFT 36,396 Reputation points Microsoft Employee

2022-08-11T13:52:17.13+00:00

Hi @Gowda, Hariprasad ,

It is possible if your website is not accessible by only the domain name.
For e.g,
www.mywebsite.com ------> does not work.
www.mywebsite.com/directory1/file1 ------> works.

Please make sure you are configuring the correct path in the AFD Origin configuration.

Let me know if this narrows down the issue.

Thanks,
Kapil
Gowda, Hariprasad 86 Reputation points

2022-08-12T03:53:35.12+00:00

This configuration didn't worked
KapilAnanth-MSFT 36,396 Reputation points Microsoft Employee

2022-08-12T05:20:34.033+00:00

Hi @Gowda, Hariprasad ,

This issue seems this would require a deeper investigation, so if you have a support plan, I request you file a support ticket, else please do let us know, and we will try and help you get a one-time free technical support.

Thanks,
Kapil.
Gowda, Hariprasad 86 Reputation points

2022-08-12T07:27:49.687+00:00

My application gateway had multiple listeners. One with basic and another 2 with multi site. Removed both multisite listeners. Now front door is able to route the traffic to app GW. If our app gw hosting multiple site isn't this will be a problem?

One more thing, Now I changed the health probe path, it is now showing 100%

Share via

azure frontdoor origin health percentage is 0%