Introduction

• Understand core Application Gateway capabilities: SSL offloading, end-to-end TLS, path-based routing, host-based routing, and integration with Azure Web Application Firewall (WAF).
• Learn the traffic lifecycle inside Application Gateway: listeners, rules, HTTP settings, backend pools, and health probes — and how they work together to process user requests.
• Compare and choose the appropriate SKU (Standard, Standard_v2, WAF, WAF_v2) by evaluating scale, features, performance, and security trade-offs.
• Plan for production: high availability, autoscaling, network topology, TLS/certificate strategies, monitoring, and integration with other Azure networking services.

​

Core concepts and primary components

​

How traffic flows through Application Gateway (end-to-end)

1. DNS resolves the public IP or FQDN of the Application Gateway.
2. The client initiates an HTTP/HTTPS request to the gateway IP/FQDN.
3. Listener on the gateway accepts the connection (binds to IP, port, protocol).
4. Listener matches a rule (basic or path-based) that decides which backend pool to use.
5. HTTP settings define how the gateway connects to the backend (protocol, port, affinity, timeout).
6. Gateway performs a health probe against backend targets; only healthy targets receive traffic.
7. If WAF is enabled, the request is inspected against WAF rules before being forwarded.
8. Gateway forwards the request to a chosen backend target and relays the backend response to the client.

Client: GET https://www.contoso.com/images/logo.png
Listener: HTTPS on port 443
Rule: Path-based /images/* -> backend pool 'image-servers'
HTTP settings: Use HTTP to backend on port 8080 (TLS offloaded at gateway)

​

Choosing the right SKU: Standard vs Standard_v2 vs WAF vs WAF_v2

• You need managed WAF protections (OWASP rules, custom rules).
• You want autoscaling, faster updates, and improved performance telemetry.
• You require zone-redundant, highly available architecture.

​

Real-world deployment considerations

• High availability and redundancy
  • Deploy across availability zones (when supported) and use multiple backend instances.
  • Consider Standard_v2/WAF_v2 for built-in autoscaling and zone redundancy.
• Network topology
  • Application Gateway must be deployed in a virtual network subnet dedicated to the gateway.
  • Integrate with Azure Front Door or Azure CDN for global traffic routing or static content distribution.
• TLS and certificate management
  • Decide whether to offload TLS at the gateway (simpler) or use end-to-end TLS for strict security.
  • Use Key Vault to centrally manage certificates and integrate with automation.
• Health probes and resiliency
  • Configure custom probes and sensitivity settings to avoid routing to unhealthy instances.
• Security and WAF tuning
  • Use a staged approach to WAF rules: Detection mode first, then Prevention after tuning.
  • Monitor false positives and create custom rules when needed.
• Monitoring and logging
  • Enable diagnostics logging, metrics, and Azure Monitor alerts for latency, throughput, and WAF events.
  • Centralize logs with Log Analytics or SIEM for analysis.
• Cost and scaling patterns
  • Evaluate traffic patterns; autoscaling (v2 SKUs) reduces operational overhead for variable traffic loads.

​

Quick conceptual example: HTTP setting JSON (illustrative)

{
  "name": "appGatewayBackendHttpSettings",
  "port": 8080,
  "protocol": "Http",
  "cookieBasedAffinity": "Disabled",
  "pickHostNameFromBackendAddress": false,
  "probe": {
    "name": "appGatewayProbe"
  }
}

​

Summary

​

Links and references

• Azure Application Gateway documentation
• Azure Web Application Firewall (WAF)
• Azure networking architecture center
• Azure Monitor for Application Gateway metrics and diagnostics