Networking
The Networking forum covers all aspects of Networking in Azure, including endpoints, load-balancing, network security, DNS, Traffic Manager, virtual networks, and external connectivity.
Virtual Network:
Traffic Manager:
Network Watcher:
If you have any feedback on any aspect of Azure relating to Networking, we’d love to hear it.
-
Application Gateway: Support wildcard hosts in listeners
Our product creates dynamic DNS zones for our customers, e.g. foo.z1.contoso.com, bar.z2.contoso.com, etc. We use Azure DNS for this. (Notice that we stripe our customer's domains across multiple zones (z1, z2), because Azure DNS has a max record count of 5000.)
So, to support this, we have a wildcard SSL certificate for each zone e.g. .z1.contoso.com, .z2.contoso.com.
In order to have Application Gateway provide SSL termintation for us, we obviously need to create Multi-site listeners for port 443. Unfortuantely, the 'Host' field on the Multi-site listener does not accept wildcard entries. Furthermore, specifying the host name 'z1.contoso.com' does not appear…
1,124 votesWildcard host names in listeners for Application Gateway v2 is currently in public preview! You can configure host names with wildcard characters (* and ?) and up to 5 host names per listener with comma separated values.
We’d love for you to try it out and provide your valuable feedback. Learn more here – https://aka.ms/wildcardlistenerpreview
-
Cross-subscription VNet (Shared VNet)
A virtual network that spans subscriptions. Multiple different subscriptions can deploy to the same virtual network in a region.
If you are interested in this feature, please up-vote and add details about your company/scenario.
We appreciate the feedback.
- VNet Team [MSFT]
361 votes -
Authentication support for application gateway
For lift & shift of legacy systems, application gateway is very useful as we have different kinds of backends (VMs, service fabric, other PaaS services, etc.). The only missing capability is authentication, so we have to implement and configure authentication in various services, which is a big overhead. Otherwise, we have to give up application gateway but set up Nginx VMs instead.
I have also looked at Azure API Gateway, but it seems to be too specialized for public APIs but our services also service static contents and ever-changing private APIs without swagger definition.
298 votesThank you for all the votes. We need more feedback on your scenarios. If you would like to get in touch with us for a discussion, please fill this form: https://aka.ms/ApplicationGatewayCohort
-
Is it possible to expose Azure blob storage via Application Gateway
Expose Azure blob storage via Application Gateway.
I would like to remove public access for Azure Blob and only make it accessible via virtual network. The Azure Application Gateway will be public facing which does the SSL termination and forwards the request to blob.
This would allow scanning for malicious content via virtual appliances before content is stored in blob.
185 votesWe are still under consideration for this feature. In the meanwhile, could you use Azure CDN to accomplish this?
-
Monitor Application Gateway Load
Provide a way to monitor Application Gateway CPU/Memory in order to track load. It's hard to know only based on current access/http errors when the WAF is under heavy preasure and we need to scale it up.
160 votesThere is no plan currently to offer these system level metrics for Application Gateway Standard (V1). However, we are planning to offer more observability with our new Autoscaling version (V2) of Application Gateway/WAF. We already offer Capacity Units as a metric which gives you a sense of the traffic load on your Application Gateway. More are planned for V2. Please send in your specific feedback via https://aka.ms/ApplicationGatewayCohort
-
Azure Loadbalancer must delete unhealthy VM of Azure VMSS
I have create Azure VMSS behind Public Azure Std LB with HTTP based Health Probe. Azure Loadbalancer is working as per expectation. But If VM is unhealthy then it must be deleted or re-provisioned. So that machine can attain healthy state again.
159 votesI’d like to ask you for more feedback on this request please. Load Balancer doesn’t control the VMSS. I think what you’re looking for is a way for VMSS to replace any instances with a LB health probe status of 0. I’ve reached out to VMSS team to get their input. LB is likely not the right place to do this.
— Christian -
Add functionality to Application Gateway for routing based on HTTP headers
The ability to route traffic to backend pools depending on HTTP headers would be much appreciated. At the moment the only way to do this is with a function app.
148 votesThis is now partially supported using path-based rules and URL rewrite (preview). Based on a condition on a request parameter, you can rewrite your incoming path to a different path and route it to a specific backend pool. Please check examples here –
https://docs.microsoft.com/en-us/azure/application-gateway/rewrite-http-headers-url#parameter-based-path-selection -
vnet peering too expensive
Best practices are to create a subscription for ExpressRoute and then peer VNets for different subscriptions. This doubles the cost of traffic to and from Azure making it a non start for most. It is understandable to have costs between regions, but for networking that would be no cost if in the same subscription, why is there then a cost for my networks in my two subscriptions in the same region? These cost make it impossible to follow best practices for security, design, partner management, etc.
132 votesThank you for your feedback.
We are evaluating what we can do in this space.
- Anavi N [MSFT]
-
Azure load balancer currently doesn't report the status of backend pool VMs based on health probes.
Azure load balancer should report the status of backend pool VMs based on the health probes we have created and not just report if the VM is running or not. Recently one of my backend pool VM went into high load and it took me minutes to identify the problematic one. LB was not sending any traffic to this VM however the portal was still showing it 'Running' instead of "Unhealthy" or "Failed". This would save a lot of time and will be easy to see health of backend pool vms.
113 votesWe recently released a pre-configured dashboard that will help with this. Let us know if you find this useful. Thanks for your feedback. https://azure.microsoft.com/en-us/blog/introducing-azure-load-balancer-insights-using-azure-monitor-for-networks/
– Anavi N [MSFT] -
Allow multiple hostnames in the same Listener Application Gateway
Sometimes we share differents hostnames with the same web site.
Currently, this means that we have to deploy differents listeners in order to provide access to the same backend pool.With a 20 listeners limit this solution is a bit expensive...
Would it be possible to add multiple hostnames/sitenames to listener?
Thanks in advance
101 votesWildcard host names in listeners for Application Gateway v2 is currently in public preview! You can configure host names with wildcard characters (* and ?) and up to 5 host names per listener with comma separated values.
We’d love for you to try it out and provide your valuable feedback. Learn more here – https://aka.ms/wildcardlistenerpreview
-
Application Gateway WAF support gzipped content in the request body
Application Gateway WAF does not support gzipped content in the request body.
94 votesThanks for reaching out, can you please share your use case scenario?
-
Need a function to URL path rewriting in Application Gateway
Currently, I know Azure Application Gateway has a function for redirection of URL path based.
Now, I need a function for rewriting URL path during redirecting a request to backend server.
For example, When Application Gateway received a HTTP request to http://www.contoso.com/test/, it redirects the request as /images/ to backend server.
In other words, I want to set a URL path for backend server in PathRuleConfig in Application Gateway.
79 votesURL rewrite for Application Gateway v2 is currently in public preview! With this, you can now rewrite URL path and query string parameters based on a condition. The condition will be on request or response parameters.
Also, you get the ability to choose the routing to a backend pool based on the original URL or the rewritten URL.
We’d love for you to try it out and let us know your valuable feedback. Learn more here – https://aka.ms/urlrewritepreview and https://aka.ms/urlrewriteconfiguration
-
Allow Traffic Manager to Support Absolute Monitoring Endpoints
Current endpoint monitoring in Traffic Manger only supports a relative path. For flexibility, it would be great to support a full url path like http://www.example.com/health
66 votesTraffic Manager constructs the probing URL by appending the endpoint FQDN with the relative path. So if the FQDN of your endpoint is example.com and a relative path is /index.html then the probing path would be example.com/index.html
You can also specify custom host header for each endpoint if required and set expected HTTP codes for the profile; in case the application does not return 200OK for the probes. Please see https://docs.microsoft.com/en-us/azure/traffic-manager/traffic-manager-monitoringCould you elaborate on the scenario that would require absolute URLs for each endpoint?
-
List the private IP address of a virtual network gateway
Show the private IP address of a virtual network gateway in the "Connected devices" blade.
39 votesHi,
Currently, the gateway private IP addresses are not required for configurations or operations, other than the GatewaySubnet range. They should have been hidden from users. The gateway resource model does not have a field for those either.
There may be use cases for new features down the road. We will update the gateway resource model accordingly and expose those properly.
Thanks,
Yushun [MSFT] -
35 votes
Would love to get feedback on the need for a private version of this: https://docs.microsoft.com/en-us/azure/load-balancer/cross-region-overview
-
Enable Jumbo Frames with Accelerated Network
Accelerated Network still has MTU = 1500, which creates too much overhead at 30 Gb/s speed. Would be helpful to have it at 9000 by default or at least configurable.
23 votesAccelerated Networking offloads this function to hardware allowing the VM to send larger segments so the overhead should be minimal or even negligible. How are you measuring overhead?
-
Azure load balancer health checks should have more configurable options
The current Azure Load Balancer checks are very basic. They should be extended to allow
* Custom headers added to HTTP checks
* Auth headers on HTTP checks
* Check returned content for a pattern
* Allow POST rather than GET with customisable content
* Accept other HTTP return statuses (for example, 3xx) as valid
* TCP checks should allow configuration of Send/Expect strings
* Maybe additional checks for such services as LDAP, DNS, etcAs comparison, the popular HAProxy load balancer supports most of these capabilities.
21 votesThank you for the feedback.
-
custom domain verification for Azure users is a hassle and blocker
We are setting up an Azure tenant which we want to link to VSTS in order to create a Devops infrastructure.
To do so we need to add a custom domain in the Azure tenant's AD, but this is impossible because the domain is already listed in another AD (the one used by our Office365 tenant).
So now we need to use a separate domain, and change all users in VSTS???
Please remove this barrier....
15 votesWe didn’t see a reply on your specific AD setup. Please feel free to add more detail so we can understand the request more thoroughly.
-
Add internal dns name for loadbalancer
Is it possible to add the swicth "--internal-dns-name <Name>" for an internal loadbalancer ?
This is possible for an NIC today, please add this to loadbalancer12 votesHi there – thanks so much for the feedback.
Curious to know about your use case for this? This helps us plan and prioritize better.Looking forward to hearing from you.
– Anavi N [MSFT]
-
Delay load balancer rolling health threshold until first pass.
We would like to implement an application-specific https load balancer probe for rolling upgrades. This always fails initial deployment because none of the VMs in the scale set have the application installed yet. It would be nice if the rolling upgrade threshold could be ignored until it passes for the first time.
11 votesthank you for the feedback. how would you want this to work? do you want to be able to configure how we detect it the first time, automatically probe up until first time probed up, something else?
- Don't see your idea?