Networking

The Networking forum covers all aspects of Networking in Azure, including endpoints, load-balancing, network security, DNS, Traffic Manager, virtual networks, and external connectivity.

Virtual Network:

  • Service overview

  • Technical documentation

  • Pricing details

  • Traffic Manager:

  • Service overview

  • Technical documentation

  • Pricing details

  • Network Watcher:

  • Service overview

  • Technical documentation

  • Pricing details

  • If you have any feedback on any aspect of Azure relating to Networking, we’d love to hear it.

    • Hot ideas
    • Top ideas
    • New ideas
    • My feedback
    1. Update activity logs to contain specific configuration change information.

      Currently the Activity Logs in Application Gateway just convey the information that configuration was updated at a specific time by a specific user.
      It should also contain the information about the specific configuration that was done or updated.
      Please refer the Support request number: 118121226003062 I had raised for the same shortcoming of Activity Logs.

      9 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    2. Application Gateway does not support a long content-security-policy header

      I am attempting to set our content-security-policy (CSP) HTTP header using a Rewrite rule.

      When I exceeded 1000 characters (the maximum allowed in AG for a header value), I was stuck.

      I attempted to add a second HTTP header for "content-security-policy" but it seems the built-in behavior is to replace the first HTTP header with the second.

      The CSP standard allows for multiple duplicate headers. AG does not appear to support this.

      I am utterly stuck. I cannot set the CSP I need because of the 1000 character limit.

      9 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  1 comment  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    3. Application Gateway WAF: need the ability to adjust rule 911100 list of methods

      API management allows additional methods such as PATCH, PUT, DELETE and TRACE which some companies use in their API's.

      The default WAF list under rule 911100 is GET HEAD POST OPTIONS which is not sufficient and leads to the disabling of the rule in the application gateway WAF in front of API Management.

      9 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    4. Increase upload limit for Application Gateway or make it configurable

      Increase upload limit for Application Gateway or make it configurable.

      Currently the limit is 2GB maximum, but we need to be able to exchange larger files as well.

      9 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    5. Azure Application gateway multiple Frontend ip addresses

      Azure Application Gateway allows multiple listeners over port 80 (HTTP), but it only allows 1 listener over port 443. You protect multiple websites using HTTP port (80), but only 1 using HTTPs (443). I propose the possibility of multiple IP frontend or just support multiple listeners over 443 (HTTPs). Trust me, is hard when you need an Application Gateway for each Azure web app...

      Best,

      9 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    6. Make default ssl settings more secure (https://www.ssllabs.com gives only B-rate).

      When we deploy SSL listener with default settings, ssl configuration in not very secure (although acceptable for some services). Popular checker https://www.ssllabs.com gives just B-rate for this. You can check recommendations for example looking at report for our sample AGW deployed with default settings https://www.ssllabs.com/ssltest/analyze.html?d=tb-ag-dev.textback.io

      9 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      1 comment  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    7. Streamline SSL Certificate Renewal

      I have a SAN SSL certificate that contains 6 different addresses, these each have their own listeners etc. To apply a renewed certificate today I've spent 4hours with Azure support, adding the new certificate, updating each site to use the new certificate one by one, and then going through the HTTPSettings and changing the certificate over in there for each site as well.
      In IIS this is much simpler, I add the new certificate and update the binding on one website and all sites are updated - done, in 1minute.
      In summary making it quicker and simpler to update a…

      8 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    8. Azure Application Gateway wasp rule issue : 941120

      Since we have observed the exlusion rule in Application Gateway WAF is not working. For one of the azure ad cookies that are being generated randomly creating 403 issue on gateway and blocking the request. So cookie will be like 'OpenIdConnect.nonce' which need to excluded but its not working since name got concatenated with the value of the cookie. Please have a review on this since this seems bug on the wasp rule

      For Ex. REQUESTCOOKIESNAMES:OpenIdConnect.nonce.XcAqQkCKX3DproXEwEN5OnpgG3E2wFYTzxvyttvCLZo%3D ....

      8 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  2 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    9. Need a function to disable the timestamp in TCP option in Application Gateway

      In some cases, the timestamp in TCP option is concerned about a security risk.

      So I want a function to make it disable in Application Gateway.

      TCP option is the setting in OS layer, so it may need a change in OS for Application Gateway.

      7 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    10. Need more information from Log Analytics for App Gateway.

      We see 400 errors in Log Analytics. We don't see these connections on the web servers. We think the App gateway is dropping traffic. Support doesnt seem to know why this happens. We don't have enough good information to track these issues. requestQuery_s is blank, MS support cannot tell me what this is, let alone what it means if it is blank.
      We need more information.

      7 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      1 comment  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    11. Increase Url query size for Application Gateway

      The size of Url for Application Gateway is 8k. But the size of Url query (as a part of Url) is only 2k.
      It will be great if there are no limits for query size in Url.

      7 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    12. Add ACI Containers to Application Gateway Backend Pool Targets

      Currently the only way to set the backend pool targets for ACI containers within a private VNET is by IP address. When stopping and starting ACI containers there is no guarantee that they will re-use the same IP address.

      7 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    13. Custom error page for 504 error

      Today we can do customer error pages for 403, and 502 errors.
      However we would like to create a customer error page when customers receive 504 errors.

      504 errors are created if the application gateway haven't received a response from the backend servers within the defined timeout period.

      This can happen if the backend is overloaded, and not yet seen as unhealthy by the application gateway.

      7 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    14. support VPN tunnels with multiple end points on premise from one azure instance using policy-based tunnels.

      support policy based tunneling to multiple sites from one azure gateway.

      7 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    15. Support App Service SSL certificates stored in Key Vault secrets for listeners on Application Gateway

      It seems like MS is 1 step away from having an extremely sticky functionality that seems like a no brainer.

      We have App Service Certificates. They are not "standard" but they work amazingly.

      They happen to be stored in the KeyVault in a really annoying way as a special data type. They are able to be auto-rotated, purchased through the portal, and create a lock in to the platform.

      Why cant we use these in the Application Gateway? It would GREATLY trivialize using it.

      6 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    16. Application Gateway: Set DNS name for frontend IP in wizard

      When creating a new Application Gateway via the portal, you are prompted to set a frontend IP. This IP is then allocated a randomly generated dns name which cannot be changed. I'm guessing that most people do not want a random name for their public facing address.

      Please allow a name to be specified in the wizard and/or the name to be changed after the fact.

      6 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    17. Rewrite header rule dose not work well using redirect rule.

      When I attached rewrite header rule to a request routing rule with redirect, I confirmed that the rewrite rule did not work. I hope we can use rewrite header rule with redirect rule.

      6 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    18. Application Gateway

      The notification for all the processes is generic. For example - if you are updating a listener or you are updating a Backend HTTP Pool, the notification is generic, and it is not possible to distinguish as to which process is taking how much time, or which process is currently in progress.

      6 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    19. Ability to enable/disable vm members on a pool without reconfiguring the gateway

      Occasionally we need to take one of the member in the pool for troubleshooting/debugging. This require to bring down the gateway at least 15-30 minutes. If possible to quickly enable/disable the member vm without long downtime.

      6 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →

      Adding/removing backend pool member would not affect live traffic – even while updates are ongoing. Updates on the gateway today are slow and we are working on enhancing this experience. We have a private preview program ongoing currently, for quicker updates and you can sign up for it by emailing me.

      Thanks,
      Amit [MSFT]

    20. More granular backend pool monitoring

      The App Gateway as it stands only allows you to monitor the overall (every member of every pool) backend pool health. It does not allow you to alert on a specific backend. One pool may be healthy with one member down and another may be unhealthy with one member down.

      6 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    • Don't see your idea?

    Feedback and Knowledge Base