Networking

The Networking forum covers all aspects of Networking in Azure, including endpoints, load-balancing, network security, DNS, Traffic Manager, virtual networks, and external connectivity.

Virtual Network:

  • Service overview

  • Technical documentation

  • Pricing details
  • Traffic Manager:

  • Service overview

  • Technical documentation

  • Pricing details
  • Network Watcher:

  • Service overview

  • Technical documentation

  • Pricing details
  • If you have any feedback on any aspect of Azure relating to Networking, we’d love to hear it.

    • Hot ideas
    • Top ideas
    • New ideas
    • My feedback
    1. Azure AppGateway same port cant be used on both private and public IP

      Currently we have an app gateway deployed, we have several listeners that are on a private IP address, (for internal users) the plan was to also make these sites available on an external IP on the same app gateway.

      However it appears once a port has been assigned in a listener, it can not be assigned to another listener with a different front end port.

      A ticket was raised with MS ref: :118062518450635.

      34 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      1 comment  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →

      Thanks for the valid suggestion. Your feedback is now open for the user community to upvote which allows us to effectively prioritize your request against our existing feature list and also gives us insight into the potential impact of implementing the suggested feature

    2. Is it possible to disable http 1.0 protocol in Azure App Gateway?

      If the request is sent as HTTP 1.0 with a blank host header, the server may respond with its own internal IP (10.x.x.x) in the Location Header. This results in the internal IP address of the Real Server being exposed.

      E.g.
      Location: https://10.19.xx.***/

      17 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      under review  ·  1 comment  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    3. Feature request: Changing idle timeout for Application Gateway with private IP address.

      Currently we can specify timeout only to a public IP address of Application Gateway. But we can’t change the timeout of a private IP of Application Gateway. Can you add a new feature to allow us to specify timeout for private IP address too.

      51 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      under review  ·  0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    4. Update activity logs to contain specific configuration change information.

      Currently the Activity Logs in Application Gateway just convey the information that configuration was updated at a specific time by a specific user.
      It should also contain the information about the specific configuration that was done or updated.
      Please refer the Support request number: 118121226003062 I had raised for the same shortcoming of Activity Logs.

      9 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    5. Increase connection drain limit on Application Gateways

      The Application Gateway has a hard limit of 3600 seconds on connection draining. It would be helpful if this limit were extended up to or over 24 hours.

      4 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    6. Support for gzip compression on response

      I know that Nginx for example do have such thing, is it something that is supported or will be in the future?

      6 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    7. Forward Request's Original Host

      This is useful when backend services need a way to recognize the client's requested domain (i.e. multitenant saas based on custom domains).

      X-Forwarded-Host or other custom header where we can get the original domain's name.

      Thanks!
      Luis

      9 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  2 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    8. Allow paths in Application Gateway rules to be defined as regular expression

      Currently, Application Gateway rules support only path matches with a wildcard at the end of the string.

      For us it means to rework our routing strategy as the first part of our route is dynamic /<domain>/<controller> (eg. /sales/process). The controllers are shared among domains. Domains can be dynamically created, what disallow us to directly use the current feature to separate only 'process' controller to standalone backend pool.

      We would prefer to be able to define something like '/[a-z]]+/process.*' as a matching criterion.

      75 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      9 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    9. Affinity cookie persistence between pools in application gateway

      Argument is: Application gateway cookie persistence for different backend pool

      I have already rise an SR for this issue.

      If you have a configuration like:

      domain/app1 forward to pool1 (server1, server2)
      domain/app2 forward to pool2 (server3,server4)

      A page that call resources in /app1 e /app2 everytime a different pool is hit from the same browser session a new affinity cookie is generated.

      To summarize:

      There is no persistence of affinity cookie between calls on different pools.

      The affinity cookie should take care about server in different pool for session persistence. So if i have affinity cookie X this should be…

      4 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      1 comment  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    10. Azure Application gateway multiple Frontend ip addresses

      Azure Application Gateway allows multiple listeners over port 80 (HTTP), but it only allows 1 listener over port 443. You protect multiple websites using HTTP port (80), but only 1 using HTTPs (443). I propose the possibility of multiple IP frontend or just support multiple listeners over 443 (HTTPs). Trust me, is hard when you need an Application Gateway for each Azure web app...

      Best,

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    11. Change WAF configuration: allow either changing prevention/detection by rule or disabling rule by application.

      Per application request, he wanted to change the WAF configuration to detection mode but this change can affect another applications that are locate di the same application gateway.
      We disable rule 942400 but we want to allow either changing prevention/detection by rule or disabling rule by application.

      45 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    12. Azure Application Gateway with upstream HTTP Reverse Proxies and XFF

      Azure Application Gateway doesn't seem to populate the "clientIP" field value on the ApplicationGatewayLog and ApplicationGatewayFirewallLog logs with the initial/ real client IP when there is an upstream HTTP Reverse Proxy with X-Forwarded-For HTTP header insert option enabled. Under that integration scenario, "clientIP" gets populated with the client IP address from the Azure Application Gateway network flow and not from the application level flow via HTTP X-Forwarded-For header.

      It would be useful to have the option to change this behaviour for certain integration scenarios.

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    13. Application Gateway - Rule 920300 confusion

      I believe there is confusion around rule
      920300 - Request Missing an Accept Header

      This rule is listed in the docs
      https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-crs-rulegroups-rules#owasp30

      However, it no longer appears in the portal GUI, it certainly used to

      I have several appgw instances, on all of them but one, it is possible to disable/enable this rule using powershell cmdlets

      On one specific instance I can not disable it using powershell, but I know the rule is being applied as I am getting preventions and detections being logged against it.

      When i try to disable it using powershell I get the error
      Failed to…

      1 vote
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    14. When Azure-application-gateway will update with support of TLS 1.3

      Akamai-CDN recommended with TLS 1.3 but Azure-application-gateway is not available with the same.
      Due to this issue, we have see url-access issue over Akamai.
      So we have moved to Azure-traffic-manager\Azure-Load balancer.

      56 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      4 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    15. Azure Application gateway - Allowed concurrent connection

      1) Tier - WAF , SKU Size - medium

      2) Tier - WAF , SKU Size - large

      3) Tier - Standard , SKU Size - small

      4) Tier - Standard , SKU Size - medium

      5) Tier - Standard , SKU Size - large

      Example: If I'm using WAF with Medium SKU and 8 Instances what will be my limit of concurrent connections.

      Thanks,
      Gulab Pasha

      1 vote
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    16. application gateway listener

      At times it becomes difficult to know what is the type of Listener in Application gateway that is, is it Multi Path or basic.

      It would be great if we can also see the Listener type at the Top

      1 vote
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    17. Allow to customize behaviour of 949110 WAF Rule

      Currently WAF signatures even though in detect mode can start to block if the preset threshold of 949110 (not user available) is reached. This is not helpful as we getting too many false positives and unfortunately we need to disable signatures completely instead of putting it in detect mode so that real attacks can get logged atleast.

      Can we have this rule 949110, be made available to user for customization of threshold and behaviour according to our environment?

      2 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    18. Allow Application Gateway's public IP to be used as CNAME alias

      Currently Traffic Manager and Public IP are available resources for selection in a dropdown for CNAME aliases. I would like to also select Application Gateway which has a public IP address associated with it.

      0 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    19. Accept request only from specific source IP address

      I'm raising this again as the original from someone else was declined, possibly due to lack of clarity on purpose.

      On an app gateway that has multiple listeners, there might be a need for listener A to be accessible from IP x and listener B to be accessible from IP y.

      Using an NSG, only the whole of the App Gateway can have rules associated with it. I can't have listener A accept from one IP and listener B from another as listeners do not have a distinct identity that can be referenced in an NSG.

      The only way around…

      10 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    20. Customizing OWASP Rules in Application Gateway

      There should be the possibility to customize the OWASP rules in the Application Gateway WAF v2, not just the ability to turn them on or off. For example, Rule 911100 (method not allowed by policy) doesn't allow PUT or PATCH HTTP methods. It would be good to be able to modify this rule to allow more methods, not just turn the rule off if we want these methods.

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Application Gateway  ·  Flag idea as inappropriate…  ·  Admin →
    • Don't see your idea?

    Feedback and Knowledge Base