Update: Microsoft will be moving away from UserVoice sites on a product-by-product basis throughout the 2021 calendar year. We will leverage 1st party solutions for customer feedback. Learn more here.

Networking

The Networking forum covers all aspects of Networking in Azure, including endpoints, load-balancing, network security, DNS, Traffic Manager, virtual networks, and external connectivity.

Virtual Network:

  • Service overview

  • Technical documentation

  • Pricing details

  • Traffic Manager:

  • Service overview

  • Technical documentation

  • Pricing details

  • Network Watcher:

  • Service overview

  • Technical documentation

  • Pricing details

  • If you have any feedback on any aspect of Azure relating to Networking, we’d love to hear it.

    • Hot ideas
    • Top ideas
    • New ideas
    • My feedback
    1. Fully private App Gateway v2

      From: https://docs.microsoft.com/en-us/azure/application-gateway/migrate-v1-v2

      " v2 gateways currently don't support only private IP addresses."

      We need to be able to create fully private App Gateway V2, without public IP.

      At the moment V2 Gateways will be public facing so we need to stick with V1. We cannot rely on NSG/Firewall to restrict traffic: we need to be able to provision a private load balancer.

      46 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      1 comment  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    2. Application Gateway Disable Probe

      It's impossible to host non-HTTP processes behind an application gateway due to the health probes. I run a Service Fabric cluster and want the TCP management endpoint (19000) to be available through the gateway so I can take advantage of other offerings. The endpoint is marked as dead since it doesn't respond to HTTTP/S requests. If the AGW could support TCP health checks or allow marking a service as always-up I could accomplish my goal.

      46 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      under review  ·  2 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    3. Support for drainstop in Azure App Gateway

      Traditional loadbalancers support the following states, to facilitate performing maintenance on a system of multiple nodes gracefully:
      Enabled (All traffic allowed)
      Disabled (Only persistant or active connections allowed)
      Force Offline (only active connections allowed)

      When a application gateway node is "unhealthy" it only allows active connections. We are looking for a way to force a node into an "unhealthy" state.

      The currently supported method is to use a custom probe that checks a file/path. I would like a solution that doesn't involve making changes on the server going into maintenance mode.

      46 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      3 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    4. Deprecate use of Cipher Block Chaining cipher modes - TLS_RSA_WITH_AES_256_CBC_SHA256

      App Gateway is REQUIRING a WEAK CIPHER be enabled

      See: https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-configure-ssl-policy-powershell#configure-a-custom-ssl-policy

      ==Important==
      TLSRSAWITHAES256CBCSHA256 must be selected when configuring a custom SSL policy. Application gateway uses this cipher suite for backend management. You can use this in combination with any other suites, but this one must be selected as well.

      As of May 2019 - SSLLABS is identifying cipher suites using CBC as WEAK - https://blog.qualys.com/technology/2019/04/22/zombie-poodle-and-goldendoodle-vulnerabilities#comment-303228

      45 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      1 comment  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    5. Allow Application Gateways to be moved between subscriptions

      Applications Gateways currently can't be moved between subscriptions.

      Allow them to be moved between subscriptions.

      45 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      2 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    6. App GW with load balance should use single internal IP for single session

      App GW with auto-scaling enabled have Multiple internal IP for communicating hosted web service. The worst part is its communicating same session from client with Multiple IP internally because of load balance it has multiple machine for APP GW.

      e.g

      https://groups.google.com/forum/#!msg/pwm-general/miljylSaFjA/1qqhNS7lQgAJ;context-place=msg/pwm-general/za94hdmqPL4/tafnzLq5yUIJ

      We are using application with which
      NSG/IP restriction cannot be used because application is designed in such way it doesn’t allow same session from multiple IPs for security purposes and if we white list backend IP doesn’t makes sense because they always will be same from backend pools.
      Let’s suppose during some session of user some attacker hooks…

      43 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      1 comment  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →

      Thanks for the valid suggestion. Your feedback is now open for the user community to upvote which allows us to effectively prioritize your request against our existing feature list and also gives us insight into the potential impact of implementing the suggested feature

    7. Please give feature SSL certificate setup in Azure Load balancer and/or static public IP in application Gateway instead dynamic IP.

      Please give feature SSL certificate setup in Azure Load balancer and/or static public IP in application Gateway instead dynamic IP.

      41 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      4 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    8. Retry policy for failed requests on Application Gateway

      To reduce the number of 502 bad gateway requests that are served up Application Gateway should have a retry policy for failed requests, allowing it to move the the next available server. This would be especially useful when used in front of Service Fabric where services are moved between servers.

      40 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      unplanned  ·  0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    9. Allow increase to Diffie-Hellman key length in azure application gateway

      Per the feedback on this post (https://social.msdn.microsoft.com/Forums/en-US/b60a6c9b-5316-4299-b3e3-834870562827/ocsp-stapling-support-for-in-application-gateways?forum=WAVirtualMachinesVirtualNetwork&prof=required), application gateways have the Diffie-Hellman key length set to 1024. Current security standards recommend that be increased to 2048 at least. It would be nice if you could increase that or allow it to be configurable by users. Thanks!

      39 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      2 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    10. There is no way for us to find the private IP assigned for the application gateway in the back end. Hence please improve this feature.

      There is no way for us to find the private IP assigned for the application gateway in the back end. Hence please improve this feature. Please have it enabled for the GUI, so that this can be use full to troubleshoot any network issues.

      38 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      under review  ·  3 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    11. Application Gateway handling the Query parameter on back-end

      In application gateway HTTP settings when we use "override back-end path" option, it is stripping out the query parameter and retains only the resource path.

      Eg: https://<<HostName>>:443/resurcepath/invoke?api-version=2016-10-01&number=5

      It retains only "https://<<HostName>>:443/resurcepath/invoke" and ignoring "?api-version=2016-10-01&number=5"

      It will be good to retain the query parameters without doing any URL redirection etc

      38 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    12. Add ACI Containers to Application Gateway Backend Pool Targets

      Currently the only way to set the backend pool targets for ACI containers within a private VNET is by IP address. When stopping and starting ACI containers there is no guarantee that they will re-use the same IP address.

      38 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      1 comment  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    13. Allow public and private ip to have its own listener on the same port

      single gateway would support both public and private ip but the not able to create the two listeners for public and private on the same port. it would be great to have this feature else we need to create 2 application gateway for this purpose which defeats the purpose of public and private front end configurations to some extent.

      38 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    14. Backend heath status of Application Gateway

      We deployed the Application Gateway on the subnet where NSG's In-Bound rules is set. In the result, we got the status of backend health is 'unknown'. We got the 'Healthy' status when the NSG doesn't associate to subnet. Even if NSG's In-Bound rules is set, We'd like to confirm the backend health.

      33 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      9 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    15. application gateway monitor

      Application Gateways need more troubleshooting tools. The healthy/unhealthy logging is almost useless. We need to be able to initiate a ping/netcat from the AppGw to a host to verify connectivity. We also need to be able to see the DNS cache or see a log correlating incoming requests with outgoing requests by hostnames and IP addresses,

      32 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      2 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    16. Application Gateway, App Service and ARRAffinity

      We are trying to route all our app service traffic through application gateway.

      We have the apservice running on multiple instances and arraffinity is enabled on the appservice

      When we route the traffic through applicationgateway i note that the arraffinity cookie is being removed, as such user sessions switch across appservice instances and our application does nto work correctly

      I tried enabling session affinity on the http setting but it still doesnt work

      What is the correct setup to allow app gateway to be used with appservice and arraffinity

      31 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      3 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    17. Capability to apply WAF rules to each path rule.

      One of the customer wants capability to apply WAF rules to each path. Can you consider that?

      31 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      3 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    18. WAF (Application Gateway) Listeners limit increase from 100 to 200

      We had issue regarding creating more than 100 listeners in Application Gateway, and found that there is a limitation of 100 listeners maximum which is very annoying because there is always scenarios where customers need to create multiple bindings for websites\domains, and then we need to create listeners for the same. I logged a case with MS and the response is not satisfying that MS can not increase limit from 100 to 200, MS will consider it in future.

      I had to create more listeners for my requirement which increased complexity in my architecture and cost as well.

      Please increase…

      31 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →

      Thanks for the valid suggestion. Your feedback is now open for the user community to upvote which allows us to effectively prioritize your request against our existing feature list and also gives us insight into the potential impact of implementing the suggested feature

    19. Allow configuring the managed identity for app gateway through the portal

      The current CLI experience has a rather steep learning curve and is not ideal for someone just evaluating whether to use Azure.

      28 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →

      Thanks for the valid suggestion. Your feedback is now open for the user community to upvote which allows us to effectively prioritize your request against our existing feature list and also gives us insight into the potential impact of implementing the suggested feature

    20. Support for temporary removing nodes through REST API

      It would be great if there was a REST API or something similar we could use to take a node out of rotation without being dependent on the probe detecting it.

      Usecase: We run SF behind the Application Gateway. When we update our front-end service, we would like to take it out of rotation before the service is updated. This does not seem possible today, since we have to rely on the probe detecting that a node has gone down. Since the probes have a lag (it probes on a given interval), some users will have a bad experience when…

      27 votes
      Vote

      We're glad you're here

      Please sign in to leave feedback

      Signed in as (Sign out)
      You have left! (?) (thinking…)
      1 comment  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    • Don't see your idea?

    Feedback and Knowledge Base