Networking

The Networking forum covers all aspects of Networking in Azure, including endpoints, load-balancing, network security, DNS, Traffic Manager, virtual networks, and external connectivity.

Virtual Network:

  • Service overview

  • Technical documentation

  • Pricing details
  • Traffic Manager:

  • Service overview

  • Technical documentation

  • Pricing details
  • Network Watcher:

  • Service overview

  • Technical documentation

  • Pricing details
  • If you have any feedback on any aspect of Azure relating to Networking, we’d love to hear it.

    • Hot ideas
    • Top ideas
    • New ideas
    • My feedback
    1. Improve Front Door WAF Bot100200 managed rule (stop blocking Google crawlers)

      Currently the Front Door WAF Bot100200 managed rule blocks Google crawlers. This has resulted in pages being de-listed, and Ads being disapproved.

      This rule does, however, block malicious traffic, so disabling it completely (which is the only option) results in more malicious attempts on the backend hosts.

      This could also be fixed by putting Google crawlers into the "Good" bots rule which overrides the Bot100200. Why this hasn't happened, is anyone's guess. In its current state, this rule is unsuable.

      1 vote
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    2. Ability to skip specific rules in Font Door WAF without skipping all rules

      There are a number of managed rules that trigger false-positives in Front Door's Web Application Firewall. For example, Google will attach a "gclid" URL parameter onto links for tracking, however, due to the randomness of this value, it can trigger the SQLI 942450 rule.

      The only options to prevent this from affecting customer are either:

      a) Remove the rule altogether, thereby reducing overall security across your backend hosts.

      or, b) Add in a custom rule to skip ALL rules when the "gclid" parameter is set (ie. Allow traffic). This is perhaps even worse than option (b), since you've effectively removed…

      1 vote
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    3. Support disabling Azure Front Door weak cipher suites in TLS 1.2 and coming TLS 1.3

      We need to able to disable weak cipher suites in Azure Front Door.
      There is a some of the cipher suites in TLS 1.2 which are not secure, so they are weak.
      Feature to disable weak cipher suites in TLS 1.2 and coming TLS 1.3

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    4. Provide a lower starting cost for Front Door

      I have a simple static web page with HTML and JavaScript and a simple azure function working with a cosmos db, with very little traffic. Static web and function costs only cents and cosmos for ~23$. Adding a azure Front Door to this setup, will tripple the price (need two rules). I really like a to use Front Door, but adding this to my setup is to costly in relation to the other costs.

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    5. More Front Door routing options - based on headers and/or IP addresses

      Currently, it looks that Front Door only supports routing based on URL path. It would be nice to be able to route traffic according to headers and/or IP addresses as well.

      E.g.,
      Forward traffic coming from 6.7.8.9 to backend pool X.
      or
      Forward traffic with the header User-Agent containing googlebot to backend pool Y. (not promoting cloaking here at all, but dynamic rendering instead https://developers.google.com/search/docs/guides/dynamic-rendering)

      18 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    6. Handle passthrough of ARR affinity cookied when routing through FrontDoor

      Given that the ARR affinity at App service level relies on a cookie in the domain of the service's host name binding, FrontDoor renders this effectively dead when serving the URL differently externally. Some form of cookie passthrough/rewriting for this would allow for app-level affinity to still be possible

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    7. Support to disable health check of Frond Door

      The health check of Frond Door is too frequent, which leads some negative impact. For example:
      1. More user pages, consume a lot of computing resources.
      2. If we use Azure DNS zone, DNS query will take extra charge.

      Sometimes we only have one backend VM as backend pool, which health check is not required.

      It would be highly suggested to have a feature like users can disable health check manually in case it's not needed.

      Thanks!

      10 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    8. give FrontDoor health probes an identifiable user agent to enable traffice to be filtered in Application Insights

      Health Probe requests from Azure FrontDoor should have an identifiable user agent string, which ideally should be included in the default ApplicationInsights.Config filters section.

      Any user of FD whose sites us AI are going to find their telemetry feeds flooded with multiple requests a minute otherwise, and all suggestions given from other users or MS have been workarounds for what should be a standard filter being missing

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    9. Provide an identifiable user agent for Front Door health probe requests

      HTTP requests sent by Azure FD for health probes should provide an identifiable User Agent, enabling application insights to filter these as synthetic traffic.

      Given the volume of requests this is going to be a problem for every Front Door user who uses AI telemetry

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    10. Query string does not support without value in Azure FrontDoor

      Currently, the query string parameter in Frontdoor does not support a key withou value, it only supports format key=value. However, in RFC, it does not mandate the format with key=value. Is there any load map to have FD supports this feature?

      https://tools.ietf.org/html/rfc3986#section-3.4

      1 vote
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    11. Front Door support Range headers where the client asks for more bytes than is available from the origin

      When the Facebook sharing service reaches out to get the metadata for a page, it asks for the first 512Kb of the page. However, most of the pages on our site are 21Kb, so Front Door kicks out the request with a 503 because the Content-Length headers do not match. Please support Range requests for files smaller than the requested size as well as cache those requests as well.

      1 vote
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    12. Allow Azure Tags to be updated after the Azure Front Door has been created

      Currently Azure Front Door only supports adding Tags when the AFD resource is created. Ideally, and inline with all other Azure Resources it should allow tags to be updated at any point during the resources lifetime.

      1 vote
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    13. 6 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    14. Azure Front Door - cache Key Vault sourced certificates

      We use Front Door to host multiple clients under the same domain, and configured HTTPS with a wildcard certificate sourced from Azure Key Vault. The same source Key Vault, secret name and secret version is used for all frontend endpoints configured.
      Customer DNS records:
      customer1.domain.com -> frontdoorname.azurefd.net
      customer2.domain.com -> frontdoorname.azurefd.net
      customer3.domain.com -> frontdoorname.azurefd.net

      Wildcard certificate in Key Vault *.domain.com

      Every time a new client front end is added and HTTPS configured for it, the certificate is deployed again, which takes 20 minutes. Front Door should recognize that the same version of the same certificate is already been uploaded before and…

      36 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  1 comment  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    15. Support rewriting HTTP headers

      In order to have more control over accessing multiple services through one facade provided by Front Door it'd be nice to have an opportunity to rewrite/add some HTTP headers when it's needed. Using rewriting it'd be possible to protect apps by creating some checks on added header value (e.g. 'x-frontdoor-key') on the app side. It'd make possible to be sure that all request are coming through WAF

      43 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  4 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    16. Allow RegEx Search Patterns for URL Path Patterns in Front Door Rules, and Multiple Wildcards

      Right now, Azure Front Door URL Path Patterns support matching through only one wildcard (asterisk)
      that currently must be preceded by a slash and must appear at the very end of the URL Path Pattern.
      This is still true as of September 1, 2019.

      For some use cases, it is crucial to have much more control over each URL path pattern, than the current existing functionality in Azure Front Door.

      We would like to see the possibility to have more versatile rules in Azure Front Door, including both of the following:

      1) The ability to place more than one wildcard…

      22 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    17. Guaranteed time to roll out a custom SSL certificate when creating/updating FrontDoor endpoints

      When creating or updating a FrontDoor endpoint with a new URL it would be useful to have a expected time when all locations globally will serve with the correct certificate. I have been advised by Azure Support now that a normal turnaround time for our scenario (certificate provided by us, stored in Keyvault) should be 6-8 hours, but have just had an instance where it has taken over 24.

      Given we will be regularly adding new URLs and will need to advise clients when they should be able to correctly access the addresses a) it would be useful to be…

      6 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    18. Azure Front Door Service

      Allow to connect from Azure Front Door to a VNet in Azure. So i can make a secure connection from Azure Front Door to a Web APP or a VM with out going over the internet.

      39 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  2 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    19. Azure Front Door should automatically configure custom domains on backend app services

      When a custom domain is registered with Azure Front Door it should register that custom domain with backend app services.

      When backend app services do not have the same custom domain as AFD, app service session cookies are not passed back to the browser. Therefore session affinity is broken.

      Although there is a workaround that involves pointing the custom domain at the app services to register the domain, then pointing the custom domain back to AFD, it some cases that's just not feasible.

      We will be halting further rollout of AFD to our customers until this issue is resolved.

      6 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  1 comment  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    20. Front Door: TM’s FQDN is reflecting in drop down menu mutiple times when adding app services to a front door backend pool

      Currently if i have multiple app services connected to a traffic manager and i want to have a Azure Front door, TM's FQDN reflects in the dropdown while adding these appservices in Front door backend pool.

      For eg. Say xyz.azurewesites.net and pqr.azurewebsites.net are connected to tm.trafficmanager.net. When I create a front door and try to add these appservices to the pool, tm.trafficmanager.net shows up two times instead of real appservice names.

      This is a issue where if I want add app services among multiple backend pools say one for read and one for write, there would be no way to…

      3 votes
      Vote
      Sign in
      (thinking…)
      Sign in with: Microsoft
      Signed in as (Sign out)
      You have left! (?) (thinking…)
      triaged  ·  0 comments  ·  Azure Front Door Service  ·  Flag idea as inappropriate…  ·  Admin →
    ← Previous 1 3
    • Don't see your idea?

    Feedback and Knowledge Base