Azure Application Gateway is a web traffic load balancer that uses listeners to accept incoming connections. A listener is defined by a combination of a frontend IP address, port, and protocol (HTTP or HTTPS). HTTPS listeners require a certificate to enable SSL/TLS termination. Configuring listeners correctly ensures the gateway can securely receive and process web traffic from the internet.
Routing rules determine how traffic flows from a listener to a backend pool of servers. You can set up basic routing to send all traffic to a single pool. More advanced options include path-based routing, which inspects the URL path to send requests to different backend pools, and multi-site hosting, which allows multiple domain names to share the same gateway. These rules allow you to efficiently direct traffic based on the request's hostname and path.
The gateway can improve performance by handling SSL/TLS encryption and decryption itself, a process called SSL/TLS offloading. This means backend servers don't have to manage certificates. You manage these certificates by integrating with Azure Key Vault. First, you create a user-assigned managed identity for the gateway and grant it permission to read certificates from Key Vault. Then, you configure the HTTPS listener to use a certificate stored in Key Vault. If your backend servers use certificates not signed by a public authority, you must upload the root certificate to the gateway to enable end-to-end TLS validation.
The Web Application Firewall (WAF) on Application Gateway protects web applications from common threats like SQL injection and cross-site scripting, as defined by the OWASP Top 10. You can customize protection by selecting a specific OWASP rule set version (2.2.9 or 3.0) and then enabling or disabling individual rules within that set. Additional features like bot protection and protocol anomaly detection can also be configured. Managing WAF policies centrally on the gateway provides consistent, easily updated security for all connected applications.
A system architecture diagram showing how Azure Application Gateway uses a user-assigned managed identity to retrieve an SSL/TLS certificate from Azure Key Vault, terminating HTTPS traffic and forwarding unencrypted HTTP to backend servers.
For continuous security monitoring, you must enable diagnostic logging for the gateway and its WAF. These logs capture critical information such as firewall actions (blocked or allowed requests), health probe results, and connection failures. You send these logs to services like Azure Monitor or Log Analytics. Once the logs are centralized, you can create alerts based on specific metrics or patterns, such as a sudden spike in blocked requests, allowing for rapid detection and response to potential security incidents.
Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
An Azure Application Gateway listener is defined by a combination of a frontend IP address, port, and protocol (HTTP or HTTPS). When using HTTPS listeners, a certificate is required to enable SSL/TLS termination so the gateway can securely receive and process web traffic.
Azure Application Gateway supports three types of routing rules: basic routing that sends all traffic to a single backend pool, path-based routing that inspects the URL path to direct requests to different pools, and multi-site hosting that allows multiple domain names to share the same gateway.
To use certificates from Azure Key Vault, you create a user-assigned managed identity for the gateway and grant it permission to read certificates from Key Vault, then configure the HTTPS listener to use the certificate stored there. For backend servers with certificates not signed by a public authority, you must upload the root certificate to the gateway for end-to-end TLS validation.
The Web Application Firewall protects web applications from common threats like SQL injection and cross-site scripting as defined by the OWASP Top 10. You can select a specific OWASP rule set version (2.2.9 or 3.0), enable or disable individual rules, and configure additional features like bot protection and protocol anomaly detection.
StudyCerts
StudyCerts