You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
description: Learn how to restrict access to Application Gateway
5
5
services: application-gateway
6
6
author: mbender-ms
7
7
ms.service: azure-application-gateway
8
8
ms.topic: how-to
9
-
ms.date: 4/15/2025
9
+
ms.date: 8/11/2025
10
10
ms.author: mbender
11
11
#Customer intent: As an administrator, I want to evaluate Azure Private Application Gateway
12
12
# Customer intent: "As a cloud administrator, I want to configure a Private Application Gateway with enhanced network controls, so that I can improve security and restrict data egress while managing inbound and outbound traffic effectively."
@@ -33,19 +33,17 @@ Application Gateway v2 can now address each of these items to further eliminate
33
33
34
34
Each of these features can be configured independently. For example, a public IP address can be used to allow traffic inbound from the Internet and you can define a **_Deny All_** outbound rule in the network security group configuration to prevent data exfiltration.
35
35
36
-
## Onboard to public preview
36
+
## Onboard to the feature
37
37
38
-
The functionality of the new controls of private IP frontend configuration, control over NSG rules, and control over route tables, are currently in public preview. To join the public preview, you can opt in to the experience using the Azure portal, PowerShell, CLI, or REST API.
38
+
The functionality of the new controls of private IP frontend configuration, control over NSG rules, and control over route tables, are generally available and supported in production. To join enable the feature, you must opt in to the experience using the Azure portal, PowerShell, CLI, or REST API.
39
39
40
-
When you join the preview, all new Application Gateways provision with the ability to define any combination of the NSG, Route Table, or private IP configuration features. If you wish to opt out from the new functionality and return to the current generally available functionality of Application Gateway, you can do so by [unregistering from the preview](#unregister-from-the-preview).
40
+
When enrolled, all new Application Gateways provision with the ability to define any combination of the NSG, Route Table, or private IP configuration features. If you wish to opt out from the new functionality and return to the current generally available functionality of Application Gateway, you can do so by [unregistering from the feature](#unregister-the-feature).
41
41
42
-
For more information about preview features, see [Set up preview features in Azure subscription](../azure-resource-manager/management/preview-features.md)
43
-
44
-
## Register to the preview
42
+
## Register the feature
45
43
46
44
# [Azure portal](#tab/portal)
47
45
48
-
Use the following steps to enroll into the public preview for the enhanced Application Gateway network controls via the Azure portal:
46
+
Use the following steps to enroll into the feature for the enhanced Application Gateway network controls via the Azure portal:
49
47
50
48
1. Sign in to the [Azure portal](https://portal.azure.com/).
51
49
2. In the search box, enter _subscriptions_ and select **Subscriptions**.
@@ -58,9 +56,9 @@ Use the following steps to enroll into the public preview for the enhanced Appli
58
56
59
57
4. From the left menu, under **Settings** select **Preview features**.
60
58
61
-
:::image type="content" source="../azure-resource-manager/management/media/preview-features/preview-features-menu.png" alt-text="Screenshot of the Azure preview features menu.":::
59
+
:::image type="content" source="../azure-resource-manager/management/media/preview-features/preview-features-menu.png" alt-text="Screenshot of the Azure features menu.":::
62
60
63
-
5. You see a list of available preview features and your current registration status.
61
+
5. You see a list of available features and your current registration status.
64
62
65
63
:::image type="content" source="../azure-resource-manager/management/media/preview-features/preview-features-list.png" alt-text="Screenshot of the Azure portal list of preview features.":::
66
64
@@ -70,7 +68,7 @@ Use the following steps to enroll into the public preview for the enhanced Appli
70
68
71
69
# [Azure PowerShell](#tab/powershell)
72
70
73
-
To enroll into the public preview for the enhanced Application Gateway network controls via Azure PowerShell, the following commands can be referenced:
71
+
To enroll into the feature for the enhanced Application Gateway network controls via Azure PowerShell, the following commands can be referenced:
To enroll into the public preview for the enhanced Application Gateway network controls via Azure CLI, the following commands can be referenced:
86
+
To enroll into the feature for the enhanced Application Gateway network controls via Azure CLI, the following commands can be referenced:
89
87
90
88
```azurecli
91
89
az feature register --name EnableApplicationGatewayNetworkIsolation --namespace Microsoft.Network
@@ -105,13 +103,11 @@ A list of all Azure CLI references for Private Link Configuration on Application
105
103
>[!Note]
106
104
>Feature registration may take up to 30 minutes to transition from Registering to Registered status.
107
105
108
-
For more information about preview features, see [Set up preview features in Azure subscription](../azure-resource-manager/management/preview-features.md)
109
-
110
-
## Unregister from the preview
106
+
## Unregister the feature
111
107
112
108
# [Azure portal](#tab/portal)
113
109
114
-
To opt out of the public preview for the enhanced Application Gateway network controls via Portal, use the following steps:
110
+
To opt out of the feature for the enhanced Application Gateway network controls via Portal, use the following steps:
115
111
116
112
1. Sign in to the [Azure portal](https://portal.azure.com/).
117
113
2. In the search box, enter _subscriptions_ and select **Subscriptions**.
@@ -124,19 +120,19 @@ To opt out of the public preview for the enhanced Application Gateway network co
124
120
125
121
4. From the left menu, under **Settings** select **Preview features**.
126
122
127
-
:::image type="content" source="../azure-resource-manager/management/media/preview-features/preview-features-menu.png" alt-text="Screenshot of the Azure preview features menu.":::
123
+
:::image type="content" source="../azure-resource-manager/management/media/preview-features/preview-features-menu.png" alt-text="Screenshot of the Azure features menu.":::
128
124
129
-
5. You see a list of available preview features and your current registration status.
125
+
5. You see a list of available features and your current registration status.
130
126
131
-
:::image type="content" source="../azure-resource-manager/management/media/preview-features/preview-features-list.png" alt-text="Screenshot of the Azure portal list of preview features.":::
127
+
:::image type="content" source="../azure-resource-manager/management/media/preview-features/preview-features-list.png" alt-text="Screenshot of the Azure portal list of features.":::
132
128
133
129
6. From **Preview features** type into the filter box **EnableApplicationGatewayNetworkIsolation**, check the feature, and click **Unregister**.
134
130
135
-
:::image type="content" source="../azure-resource-manager/management/media/preview-features/filter.png" alt-text="Screenshot of the Azure portal filter preview features.":::
131
+
:::image type="content" source="../azure-resource-manager/management/media/preview-features/filter.png" alt-text="Screenshot of the Azure portal filter features.":::
136
132
137
133
# [Azure PowerShell](#tab/powershell)
138
134
139
-
To opt out of the public preview for the enhanced Application Gateway network controls via Azure PowerShell, the following commands can be referenced:
135
+
To opt out of the feature for the enhanced Application Gateway network controls via Azure PowerShell, the following commands can be referenced:
To opt out of the public preview for the enhanced Application Gateway network controls via Azure CLI, the following commands can be referenced:
150
+
To opt out of the feature for the enhanced Application Gateway network controls via Azure CLI, the following commands can be referenced:
155
151
156
152
```azurecli
157
153
az feature unregister --name EnableApplicationGatewayNetworkIsolation --namespace Microsoft.Network
@@ -170,7 +166,7 @@ A list of all Azure CLI references for Private Link Configuration on Application
170
166
171
167
## Configuration of network controls
172
168
173
-
After registration into the public preview, configuration of NSG, Route Table, and private IP address frontend configuration can be performed using any methods. For example: REST API, ARM Template, Bicep deployment, Terraform, PowerShell, CLI, or Portal. No API or command changes are introduced with this public preview.
169
+
After registering the feature, configuration of NSG, Route Table, and private IP address frontend configuration can be performed using any methods. For example: REST API, ARM Template, Bicep deployment, Terraform, PowerShell, CLI, or Portal.
174
170
175
171
## Resource Changes
176
172
@@ -313,7 +309,7 @@ Result:
313
309
314
310
In the current offering of Application Gateway, association of a route table with a rule (or creation of rule) defined as 0.0.0.0/0 with a next hop as virtual appliance is unsupported to ensure proper management of Application Gateway.
315
311
316
-
After registration of the public preview feature, the ability to forward traffic to a virtual appliance is now possible via definition of a route table rule that defines 0.0.0.0/0 with a next hop to Virtual Appliance.
312
+
After registration of the feature, the ability to forward traffic to a virtual appliance is now possible via definition of a route table rule that defines 0.0.0.0/0 with a next hop to Virtual Appliance.
317
313
318
314
Forced Tunneling or learning of 0.0.0.0/0 route through BGP advertising does not affect Application Gateway health, and is honored for traffic flow. This scenario can be applicable when using VPN, ExpressRoute, Route Server, or Virtual WAN.
319
315
@@ -346,7 +342,7 @@ To create a route table and associate it to the Application Gateway subnet:
346
342
347
343
## Limitations / Known Issues
348
344
349
-
While in public preview, the following limitations are known.
345
+
The following limitations apply:
350
346
351
347
### Private link configuration
352
348
@@ -375,13 +371,6 @@ If a subnet shares Application Gateway v2 deployments that were created both pri
375
371
- If a gateway deployed prior to enablement of the new functionality exists in the subnet, you might see errors such as: `For routes associated to subnet containing Application Gateway V2, please ensure '0.0.0.0/0' uses Next Hop Type as 'Internet'` when adding route table entries.
376
372
- When adding network security group rules to the subnet, you might see: `Failed to create security rule 'DenyAnyCustomAnyOutbound'. Error: Network security group \<NSG-name\> blocks outgoing Internet traffic on subnet \<AppGWSubnetId\>, associated with Application Gateway \<AppGWResourceId\>. This isn't permitted for Application Gateways that have fast update enabled or have V2 Sku.`
377
373
378
-
### Unknown Backend Health status
379
-
380
-
If backend health is _Unknown_, you may see the following error:
381
-
+ The backend health status could not be retrieved. This happens when an NSG/UDR/Firewall on the application gateway subnet is blocking traffic on ports 65503-65534 if there is v1 SKU, and ports 65200-65535 if there is v2 SKU or if the FQDN configured in the backend pool could not be resolved to an IP address. To learn more visit - https://aka.ms/UnknownBackendHealth.
382
-
383
-
This error can be ignored and will be clarified in a future release.
384
-
385
374
## Next steps
386
375
387
376
- See [Azure security baseline for Application Gateway](/security/benchmark/azure/baselines/application-gateway-security-baseline) for more security best practices.
Copy file name to clipboardExpand all lines: articles/application-gateway/overview-v2.md
+1-2Lines changed: 1 addition & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -118,10 +118,9 @@ This section describes features and limitations of the v2 SKU that differ from t
118
118
|--|--|
119
119
|Mixing Standard_v2 and Standard Application Gateway on the same subnet|Not supported|
120
120
|User-Defined Route (UDR) on Application Gateway subnet|For information about supported scenarios, see [Application Gateway configuration overview](configuration-infrastructure.md#supported-user-defined-routes).|
121
-
|NSG for Inbound port range| - 65200 to 65535 for Standard_v2 SKU<br>- 65503 to 65534 for Standard SKU.<br>Not required for v2 SKUs in public preview[Learn more](application-gateway-private-deployment.md).<br>For more information, see the [FAQ](application-gateway-faq.yml#are-network-security-groups-supported-on-the-application-gateway-subnet).|
121
+
|NSG for Inbound port range| - 65200 to 65535 for Standard_v2 SKU<br>- 65503 to 65534 for Standard SKU.<br>Not required for v2 SKUs in private deployment[Learn more](application-gateway-private-deployment.md).<br>For more information, see the [FAQ](application-gateway-faq.yml#are-network-security-groups-supported-on-the-application-gateway-subnet).|
122
122
|Performance logs in Azure diagnostics|Not supported.<br>Azure metrics should be used.|
123
123
|FIPS mode|Currently not supported.|
124
-
|Private frontend configuration only mode|Currently in public preview [Learn more](application-gateway-private-deployment.md).|
125
124
|Path based rule encoding |Not supported.<br> V2 decodes paths before routing. For example, V2 treats `/abc%2Fdef` the same as `/abc/def`. |
126
125
|Chunked file transfer |In the Standard_V2 configuration, turn off request buffering to support chunked file transfer. <br> In WAF_V2, turning off request buffering isn't possible because it has to look at the entire request to detect and block any threats. Therefore, the suggested alternative is to create a path rule for the affected URL and attach a disabled WAF policy to that path rule.|
127
126
|Cookie Affinity |Current V2 doesn't support appending the domain in session affinity Set-Cookie, which means that the cookie can't be used by client for the subdomains.|
![prmerger-automator[bot]](https://avatars.githubusercontent.com/u/22479449?v=4&size=40){kind=avatar}
0 commit comments