The myth of Azure Application Gateways – Part 1

5db46fc5-d9c1-44ae-a0f6-4ae1d2301395 Azure Application Gateways is a layer 7 reverse proxy service offered as a PaaS to general public. It supports SSL offloading, which means you can terminate your SSL connection at the Application Gateway and connect to the backend server using HTTP traffic or initiate a new SSL connection to your backend service.

This is all well and good, simple and painless if you have a single backend server with a single website. The complexity of the solution increases as the backend start leveraging more of the IIS functionalities such as Windows/NTLM authentication, SNI and host headers or various SSL certificates used for each sub-site (if you have multiple sites running on the same IIS server).

Before even starting to look at designing your Azure Application Gateway, there are few guidelines you will need to follow:

You should have an empty default site.
If using both HTTP/HTTPS protocols on any of the sub-sites, the default website should be listening on both 80 and 443.
In the case of HTTPS the default site will need to be loaded with a single SSL certificate that will primarily be used by the Application Gateway to authenticate against the server.
Not running SNI on default website.
If you are running NTLM or Windows authentication on any of the sites (except form based authentication) then you will need a site/page that allow anonymous authentication to be used for Application Gateway custom probe.
Use IP address for the backend pool rather than FQDN.

The above will save you a lot of hassle while implementing and configuring your Application Gateway to work with your backend web server.

Microsoft have fixed few issues we were experiencing recently with Application Gateways around SSL and custom probes.

There are two ways available to deploy an Application Gateway, Powershell or JSON template. The latter is preferable to ensure consistency at each deployment. This article is in two parts, in this article I will be using Powershell to deploy an Application Gateway.

Prerequisites:

SSL private key in PFX format for all sites using SSL
SSL public key in CER format for default site
IP address of the backend web server
Front and backend listening port
Site/page with anonymous access if requiring authentication

Powershell code below would deploy an Application Gateway listening on two ports (80,443). The backend consists of four sites with SNI and host headers enabled, two sites run under port 80, one of them require basic authentication. Another two sites run under port 443 bound with self-signed SSL cert for testing, one of the sites has basic authentication turned on. This would test the four common scenarios of a typical deployment.

Login-AzureRmAccount
Get-AzureRmSubscription | Select Subscription* | out-gridview -Title "Select your Azure Subscription" -OutputMode Single | Select-AzureRmSubscription 

$ApplicationGWName = "ApplicationGatewayName"
$AppGatwayPIPName = "ApplicationGatewayPublicIPName"
$vnetName = 'vNETName'
$VNetResourceGroup = 'vNETResourceGroup'
$AppGWSubnetName = 'ApplicationGatewaySubnetName'
$ResouceGroupName = "ApplicationGatewayResourceGroupName"
$Location = "UK South"
$BackendIPaddresses =  "BackendServerIP"

New-AzureRmResourceGroup -Name $ResouceGroupName -Location $Location

#Prompt for Certificate password
$SecurePassword = Read-Host -AsSecureString  "Enter Certificate password"
$BSTR = [System.Runtime.InteropServices.Marshal]::SecureStringToBSTR($SecurePassword)
$UnsecurePassword = [System.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)

#Retrive Virtual Network and Application Gateway information
$vnet = Get-AzureRmvirtualNetwork -Name $VnetName -ResourceGroupName $VNetResourceGroup
$gwSubnet = Get-AzureRmVirtualNetworkSubnetConfig -Name $AppGWSubnetName -VirtualNetwork $vnet

#Create Public IP address for Application Gateway
$publicip = New-AzureRmPublicIpAddress -ResourceGroupName $ResouceGroupName -Name $AppGatwayPIPName -Location $Location -AllocationMethod Dynamic
#$publicip = Get-AzureRmPublicIpAddress -Name $AppGatwayPIPName -ResourceGroupName $ResouceGroupName

#Create an application gateway IP configuration, this setting configures what subnet the application gateway uses
$gipconfig = New-AzureRmApplicationGatewayIPConfiguration -Name 'appGatewayIpConfig' -SubnetId $gwSubnet.Id -Verbose

#Create a front-end IP configuration, this setting maps the public ip address to the front-end of the application gateway
$fipconfig = New-AzureRmApplicationGatewayFrontendIPConfig -Name 'appGatewayFrontendIP' -PublicIPAddress $publicip

#Configure the back-end IP address pool with the IP addresses of the backend web servers
$pool = New-AzureRmApplicationGatewayBackendAddressPool -Name 'appGatewayBackendPool' -BackendIPAddresses $BackendIPaddresses

#Configure the front-end IP port for the public IP endpoint
$fp = New-AzureRmApplicationGatewayFrontendPort -Name 'appGatewayFrontendPorthttps' -Port 443
$fp1 = New-AzureRmApplicationGatewayFrontendPort -Name 'appGatewayFrontendPorthttp' -Port 80

#Configure the certificate for the application gateway
$cert = New-AzureRmApplicationGatewaySslCertificate -Name wildcard -CertificateFile '.\selfsignedcert.pfx'

#Create the HTTPS listener for the application gateway. Assign the front-end ip configuration, port, and ssl certificate to use
$listener1 = New-AzureRmApplicationGatewayHttpListener -Name authHTTPS -Protocol Https -FrontendIPConfiguration $fipconfig -FrontendPort $fp `
                                                       -HostName "auth.simplesite.com" -RequireServerNameIndication true -SslCertificate $cert

$listener2 = New-AzureRmApplicationGatewayHttpListener -Name noauthHTTPS -Protocol Https -FrontendIPConfiguration $fipconfig -FrontendPort $fp `
                                                       -HostName "noauth.simplesite.com" -RequireServerNameIndication true -SslCertificate $cert

$listener3 = New-AzureRmApplicationGatewayHttpListener -Name authHTTP -Protocol Http -FrontendIPConfiguration $fipconfig `
                                                       -FrontendPort $fp1 -HostName "auth.simplesite.com"

$listener4 = New-AzureRmApplicationGatewayHttpListener -Name noauthHTTP -Protocol Http -FrontendIPConfiguration $fipconfig `
                                                       -FrontendPort $fp1 -HostName "noauth.simplesite.com"

#Upload the certificate to be used on the ssl enabled backend pool resources - authentication certificate
$authcert = New-AzureRmApplicationGatewayAuthenticationCertificate -Name 'sanauthcert' -CertificateFile '.\publickey.cer'

#Configure the application gateway back-end http settings. Assign the certificate uploaded in the preceding command to the http settings
$poolSetting1 = New-AzureRmApplicationGatewayBackendHttpSettings -Name 'wildcard' -Port 443 -Protocol Https `
                                                                 -CookieBasedAffinity Enabled -AuthenticationCertificates $authcert

$poolSetting2 = New-AzureRmApplicationGatewayBackendHttpSettings -Name 'unsecured' -Port 80 -Protocol Http -CookieBasedAffinity Enabled

#Create a load balancer routing rule, Basic Round Robin
$rule1 = New-AzureRmApplicationGatewayRequestRoutingRule -Name 'authHTTPrule' -RuleType basic -BackendHttpSettings $poolSetting2 `
                                                         -HttpListener $listener3 -BackendAddressPool $pool
$rule2 = New-AzureRmApplicationGatewayRequestRoutingRule -Name 'noauthHTTPrule' -RuleType basic -BackendHttpSettings $poolSetting2 `
                                                         -HttpListener $listener4 -BackendAddressPool $pool
$rule3 = New-AzureRmApplicationGatewayRequestRoutingRule -Name 'authHTTPSrule' -RuleType basic -BackendHttpSettings $poolSetting1 `
                                                         -HttpListener $listener1 -BackendAddressPool $pool
$rule4 = New-AzureRmApplicationGatewayRequestRoutingRule -Name 'noauthHTTPSrule' -RuleType basic -BackendHttpSettings $poolSetting1 `
                                                         -HttpListener $listener2 -BackendAddressPool $pool

#Configure the instance size of the application gateway
$sku = New-AzureRmApplicationGatewaySku -Name Standard_Small -Tier Standard -Capacity 1

#Create the Application Gateway
$appgw = New-AzureRmApplicationGateway `
                -Name $ApplicationGWName `
                -SslCertificates $cert `
                -ResourceGroupName $ResouceGroupName `
                -Location $Location `
                -BackendAddressPools $pool `
                -BackendHttpSettingsCollection $poolSetting1,$poolSetting2 `
                -FrontendIpConfigurations $fipconfig `
                -GatewayIpConfigurations $gipconfig `
                -FrontendPorts $fp,$fp1 `
                -HttpListeners $listener1,$listener2,$listener3,$listener4 `
                -RequestRoutingRules $rule1,$rule2,$rule3,$rule4 `
                -Sku $sku `
                -AuthenticationCertificates $authcert `
                -Verbose

To be continued …..

This entry was posted on 14 November, 2016, 2:06 pm and is filed under Azure, Poweshell. You can follow any responses to this entry through RSS 2.0. You can leave a response, or trackback from your own site.

#1 by Eugene Rosenfeld [MVP, Technology Advisor] on 26 August, 2017 - 7:14 am

Awesome post and code! One typo – line 7 is missing the closing string single quote.

- #2 by Sam on 26 August, 2017 - 11:00 am
  
  Thank you Eugene, corrected.

SysCloud.dev