Skip to main content
Azure Application Gateway Azure Application Gateway is a Layer 7 (application-layer) load balancer in Microsoft Azure designed to manage HTTP, HTTPS, HTTP/2, and WebSocket traffic. It routes requests to backend pools and can optionally include a Web Application Firewall (WAF) to protect against common web exploits. Application Gateway enables advanced, HTTP-aware routing and delivery features that are essential for modern web applications. Key application-layer features:
  • Path-based routing (route requests to different backends based on URL path).
  • Host-based routing (serve multiple sites behind a single gateway using host headers).
  • URL redirection and rewrite.
  • SSL/TLS termination (offload TLS at the gateway) and end-to-end TLS options.
  • HTTP header and cookie rewrite rules.
  • Custom error pages and response manipulation.
  • Web Application Firewall (WAF) integration for protection against OWASP top threats.
Azure Application Gateway operates at Layer 7 (the application layer), enabling routing decisions based on HTTP attributes such as path, host, and headers. In contrast, Azure Load Balancer operates at Layer 4 (transport layer) and routes purely on IP and port.
Why use Application Gateway?
  • Fine-grained control over HTTP(S) traffic.
  • Support for App Service, VMs, VM scale sets, and external IP-based backends.
  • SSL offload and header/content manipulation for modern web scenarios.
  • Integration with WAF for protection and compliance.
Comparison: Layer 4 vs Layer 7 Supported backend targets Traffic workflow (request flow)
  1. User request
    A client (typically a browser) sends an HTTP/HTTPS request for a resource.
  2. Arrival at Application Gateway
    The request reaches the Application Gateway public (or internal) frontend IP where listeners are bound.
  3. Listener interception
    A listener configured on the gateway accepts connections on a specific IP, port, protocol, and optional host name. Listeners define how the gateway receives incoming traffic.
  4. Routing rules evaluation
    The gateway matches the incoming request against routing rules. Rules can be simple (forward to a backend) or advanced (path-based, host-based, redirects, or rewrite directives).
  5. HTTP settings applied
    Once a rule matches, the gateway applies HTTP settings that control communication with backend servers—these include:
    • Backend protocol (HTTP/HTTPS)
    • Backend port
    • Timeout values
    • Cookie-based affinity (session stickiness)
    • Header or cookie rewrite rules
  6. Forward to backend pool
    The gateway forwards the request to the selected backend pool, which is a named collection of backend targets (VMs, VMSS instances, App Service, or IPs).
  7. Load balancing at backend
    Requests are distributed across backend instances (round-robin by default). You can enable cookie-based affinity to keep subsequent requests from the same client routed to the same backend instance.
  8. Response processing and return
    The backend returns a response to the Application Gateway. The gateway can inspect or modify the response (for example, rewrite headers or replace error pages) before returning it to the client.
A simplified architecture diagram of an Application Gateway showing a Layer 7 load balancer, routing/features, and backend pools. It illustrates request flow from a browser through an HTTP/HTTPS listener and rules to a backend pool containing VMs, VMSS, and servers.
Core components and configuration overview Configuration tips
  • Use path-based routing for microservices to map URL paths to specific backend pools.
  • Use host-based routing to host multiple domains behind a single gateway.
  • Enable WAF in prevention mode to block suspicious requests; start in detection mode to tune rules.
  • Use custom probes to check application-specific health endpoints (e.g., /healthz) instead of relying on TCP-only probes.
  • Offload TLS at the gateway when you want to reduce CPU load on backend servers; use end-to-end TLS if backend encryption is required.
Now that you’re familiar with the request flow, the following sections cover the key components and step-by-step configuration options for Application Gateway, including listener and rule setup, backend pool management, HTTP settings, health probes, SSL certificates, and WAF policy configuration. Links and references

Watch Video