rough draft complete

dlepow · dlepow · commit 374dd444bec9 · 2022-08-23T16:47:25.000-07:00
diff --git a/articles/api-management/front-door-api-management.md b/articles/api-management/front-door-api-management.md
@@ -1,6 +1,6 @@
 ---
-title: Deploy Azure Front Door in front of Azure API Management
-description: Learn how to front your API Management instance with an instance of Azure Front Door.
+title: Create Azure Front Door in front of Azure API Management
+description: Learn how to front your API Management instance with Azure Front Door Standard/Premium to provide global HTTPS load balancing, TLS offloading, dynamic request acceleration and other capabilities.
 services: api-management
 author: dlepow
 
@@ -9,23 +9,19 @@ ms.topic: how-to
 ms.date: 08/22/2022
 ms.author: danlep
 ---
-# Create Front Door in front of Azure API Management
+# Use Front Door Standard in front of Azure API Management
 
-Ref: https://techcommunity.microsoft.com/t5/azure-paas-blog/integrate-azure-front-door-with-azure-api-management/ba-p/2654925
+Azure Front Door is a modern application delivery network platform providing a secure, scalable content delivery network (CDN), dynamic site acceleration, and global HTTP(s) load balancing for your global web applications. When used in front of API Management, Front Door is useful for TLS offloading, end-to-end TLS, load balancing, response caching of GET requests, a web application firewall, among other capabilities. For a full list of supported features, see [What is Azure Front Door?](../frontdoor/front-door-overview.md). 
 
-Azure Front Door is a modern application delivery network platform providing a secure, scalable content delivery network (CDN), dynamic site acceleration, and global HTTP(s) load balancing for your global web applications.
+This article shows how to:
 
-Azure Front Door supports ... and offers always-on availability, low latency, SSL offload, health probes, etc. etc. For a full list of supported features, see [What is Azure Front Door?](../frontdoor/front-door-overview.md). 
-
-This article provides detailed steps to set up Azure Front Door Standard/Premium in front of the API gateway of a publicly accessible Azure API Management instance. It also shows the steps to restrict API Management to accept API traffic only from Azure Front Door. You can configure Front Door in this scenario with either:
-
-- A non-networked API Management instance
-- An API Management instance injected in a virtual network in [external mode](api-management-using-with.vnet.md) (currently supported only in the Developer and Premium service tiers)
+* Set up Azure Front Door Standard/Premium in front of a publicly accessible Azure API Management instance: either non-networked, or injected in a virtual network in [external mode](api-management-using-with-vnet.md). 
+* Restrict API Management to accept API traffic only from Azure Front Door. 
 
 ## Prerequisites
 
-* An API Management instance. The instance must be in the same subscription you use for your Azure Front Door profile. If you choose to use a network-injected instance, it must be deployed in an external VNet. 
-* The instance's gateway endpoint can be configured with a [custom domain](). However,if you are going to route traffic using HTTPS via port 443, only certificates from valid certificate authorities can be used at the backend (origin) with Front Door. Certificates from internal CAs or self-signed certificates aren't allowed.
+* An API Management instance. 
+    * If you choose to use a network-injected instance, it must be deployed in an external VNet. (Virtual network injection is supported in the Developer or Premium service tier.) 
 * Import one or more APIs to your API Management instance to confirm routing through Front Door.
 
 ## Configure Azure Front Door 
@@ -34,7 +30,7 @@ This article provides detailed steps to set up Azure Front Door Standard/Premium
 
 For steps to create an Azure Front Door Standard/Premium profile, see [Quickstart: Create an Azure Front Door profile - Azure portal](../frontdoor/create-front-door-portal.md). For this article, you may choose a Front Door Standard profile. For a comparison of Front Door Standard and Front Door Premium, see [Tier comparison](../frontdoor/standard-premium/tier-comparison.md).
 
-Configure the following settings that are specific to using your API Management instance as a Front Door origin. For an explanation of other settings, see the Front Door quickstart. 
+Configure the following settings that are specific to using the gateway endpoint of your API Management instance as a Front Door origin. For an explanation of other settings, see the Front Door quickstart. 
 
 |Setting     |Value  |
 |---------|---------|
@@ -47,7 +43,7 @@ Configure the following settings that are specific to using your API Management
 
 ### Update default origin group
 
-After the profile is created, update the default origin group that was created to include an API Management health probe.
+After the profile is created, update the default origin group to include an API Management health probe.
 
 1. In the [portal](https://portal.azure.com), go to your Front Door profile.
 1. In the left menu, under **Settings** select **Origin groups** > **default-origin-group**.
@@ -64,56 +60,56 @@ After the profile is created, update the default origin group that was created t
 
 :::image type="content" source="media/front-door-api-management/update-origin-group.png" alt-text="Screenshot of updating the default origin group in the portal.":::
 
+### Update default route 
 
-### Update default route [is this needed?]
-
-Update the default route that is configured in the profile.
+We recommend updating the default route that is configured in the profile to use HTTPS as the forwarding protocol.
 
 1. In the [portal](https://portal.azure.com), go to your Front Door profile.
 1. In the left menu, under **Settings** select **Origin groups**.
 1. Expand **default-origin-group**.
 1. In the context menu (**...**) of **default-rout**, select **Configure route**.
-1. Set **Forwarding protocol** to **Match incoming request** and then select **Update**.
+1. Set **Accepted protocols** to **HTTP and HTTPS**.
+1. Enable **Redirect all traffic to use HTTPS**.
+1. Set **Forwarding protocol** to **HTTPS only** and then select **Update**.
 
 
 ### Test the configuration
 
-Test the Front Door profile configuration by calling an API hosted by API Management. First call the API directly through the API Management gateway to ensure that that the API is reachable. Then, call the API through Front Door. To test, you can use a command line client such as `curl` for the calls, or a tool such as [Postman](https://www.getpostman.com).
+Test the Front Door profile configuration by calling an API hosted by API Management. First, call the API directly through the API Management gateway to ensure that the API is reachable. Then, call the API through Front Door. To test, you can use a command line client such as `curl` for the calls, or a tool such as [Postman](https://www.getpostman.com).
 
 ### Call an API directly through API Management
 
-In the following example, an operation in the Demo Conference API hosted by an API Management instance is called directly using Postman. The instance's hostname is in the `azure-api.net` domain. In this example, a valid subscription key is passed using a request header. A successful response shows `200 OK` and returns the expected data:
+In the following example, an operation in the Demo Conference API hosted by an API Management instance is called directly using Postman. The instance's hostname here is in the default `azure-api.net` domain. In this example, a valid subscription key is passed using a request header. A successful response shows `200 OK` and returns the expected data:
 
 :::image type="content" source="media/front-door-api-management/test-api-management-gateway.png" alt-text="Screenshot showing calling API Management endpoint directly using Postman.":::
 
 ### Call an API directly through Front Door
 
-
-In the following example, the same operation in the Demo Conference API is called using the Front Door endpoint configured for your instance. You can find the Front Door endpoint's hostname on the **Properties** page of your Front Door profile in the portal. The hostname is the `azurefd.net` domain. Again, a successful response shows `200 OK` and returns the expected data:
+In the following example, the same operation in the Demo Conference API is called using the Front Door endpoint configured for your instance. The endpoint's hostname is in the `azurefd.net` domain, and it's shown in the portal on the **Properties** page of your Front Door profile. Again, a successful response shows `200 OK` and returns the expected data:
 
 :::image type="content" source="media/front-door-api-management/test-front-door-gateway.png" alt-text="Screenshot showing calling Front Door endpoint using Postman.":::
 
-
 ## Restrict incoming traffic to API Management instance
 
-
-You can configure API Management policies so that the API Management accepts traffic only from Azure Front Door. You can accomplish this restriction using one or both of the [following methods](../frontdoor/front-door-faq.md#how-do-i-lock-down-the-access-to-my-backend-to-only-azure-front-door-):
+Use API Management policies to ensure that your API Management instance accepts traffic only from Azure Front Door. You can accomplish this restriction using one or both of the [following methods](../frontdoor/front-door-faq.yml#how-do-i-lock-down-the-access-to-my-backend-to-only-azure-front-door-):
 
 1. Restrict incoming IP addresses to your API Management instances
 1. Restrict traffic based on value of the `X-Azure-FDID` header
-d
 
 ### Restrict incoming IP addresses
 
-You can configure the [ip-filter](/api-management-access-restriction-policies.md#CheckHTTPHeader) policy to filter incoming requests based on the following Azure infrastructure IP addresses:
-    *
-    *
+You can configure an inbound [ip-filter](/api-management-access-restriction-policies.md#CheckHTTPHeader) policy in API Management to allow only Front Door-related traffic, which includes:
 
+* **Front Door's backend IP address space** - Allow IP addresses corresponding to the *AzureFrontDoor.Backend* section in [Azure IP Ranges and Service Tags](https://www.microsoft.com/download/details.aspx?id=56519).
 
+    > [!NOTE]
+    > If your API Management instance is deployed in an external virtual network, accomplish the same restriction instead by adding an inbound network security group rule in the subnet used for your API Management instance. Configure the rule to allow HTTPS traffic from source service tag *AzureFrontDoor.Backend* on port 443. 
+
+* **Azure infrastructure services** - Allow IP addresses 168.63.129.16 and 169.254.169.254. 
 
 ### Check Front Door header
 
-You can configure the [check-header](/api-management-access-restriction-policies.md#CheckHTTPHeader) policy to filter incoming requests based on the `X-Azure-FDID` HTTP request header. Azure Front Door sends this header to API Management with its unique Front Door ID. You can find the **Front Door ID** value on the **Overview** page of the Front Door profile in the portal.
+You can configure the [check-header](/api-management-access-restriction-policies.md#CheckHTTPHeader) policy to filter incoming requests based on the `X-Azure-FDID` HTTP request header. Azure Front Door sends this header to API Management with its unique Front Door ID. Find the **Front Door ID** value on the **Overview** page of the Front Door profile in the portal.
 
 In the following policy example, the Front Door ID is specified using a [named value](api-management-howto-properties.md) named `FrontDoorId`. 
 
@@ -123,58 +119,26 @@ In the following policy example, the Front Door ID is specified using a [named v
 </check-header>
 ```
 
-Requests that are not accompanied by a valid `X-Azure-FDID` header return a `403 Forbidden` response.
-
-Restrict Inbound IP
-
-Restrict Inbound IP to accept traffic from Azure Front Door's backend IP address space and Azure's infrastructure services only.
-
- 
-
-External Virtual Network Type APIM
-
-For APIM instance deployed as external VNet mode, we can simply restrict the incoming IP using inbound rule in the network security groups of your APIM subnet.
-
-* Allow service tag **AzureFrontDoor.Backend** in inbound rule for port 443. (Is it also needed for port 80?)
-* Also allow incoming traffic from Azure's basic infrastructure services through virtualized host IP addresses: 168.63.129.16 and 169.254.169.254
-* If your APIM service isn’t deployed into Vnet (None for the Virtual Network type), then there’s nowhere you can put the inbound rule in. But you can still leverage APIM IP restriction policy to achieve this goal. See policy doc here: https://docs.microsoft.com/en-us/azure/api-management/api-management-access-restriction-policies#Res.... 
-
-Allow Azure Front Door Backend Ips. Refer AzureFrontDoor.Backend section in Azure IP Ranges and Service Tags for Front Door's IPv4 backend IP address range.
-
-### Check Front Door header
-
-```xml
-<check-header name="X-Azure-FDID" failed-check-httpcode="403" failed-check-error-message="Invalid request." ignore-case="false">
-            <value>{{FrontDoorId}}</value>
-        </check-header>
-```
-
-
+Requests that aren't accompanied by a valid `X-Azure-FDID` header return a `403 Forbidden` response.
 
 ## (Optional) Configure Front Door for developer portal
-\\
 
+Optionally, configure the API Management instance's developer portal as an endpoint in the Front Door profile. 
 
-## Next steps
-
-To automate deployments, see the following Quickstart Templates:
-
-* [Front Door Standard/Premium with API Management origin](https://azure.microsoft.com/resources/templates/front-door-standard-premium-api-management-external/)
-
+* To add an endpoint and configure a route, see [Configure and endpoint with Front Door manager](../frontdoor/how-to-configure-endpoints.md).
 
+* When adding the route, add an origin group and origin settings to represent the developer portal:
 
-============
+  * **Origin type** - Select **Custom**
+  * **Host name** - Enter the developer portal's hostname, for example, *myapim*.developer.azure-api.net 
 
+For more information and details about settings, see [How to configure an origin for Azure Front Door](../frontdoor/how-to-configure-origin.md#create-a-new-origin-group).
 
+> [!NOTE]
+> If you've configured an Azure AD or Azure AD B2C identity provider for the developer portal, you need to update the corresponding app registration with an additional redirect URL to Front Door. In the app registration, supply the URL for the developer portal endpoint configured in your Front Door profile.
 
-* Backend pool - API Management service
-* Health probe settings to gatway: - Path `/status-0123456789abcdef`, HTTPS, GET method, 30 sec interval
-* Health probe settings to developer portal ?
-* Routing rules 
-    * Gateway - HTTPS only? Match incoming requests?
-
-    * Developer portal
-
-* Considerations for multi-region - regional origins?
+## Next steps
 
+* To automate deployments of Front Door with API Management, see the following example Quickstart template: [Front Door Standard/Premium with API Management origin](https://azure.microsoft.com/resources/templates/front-door-standard-premium-api-management-external/)\
 
+* Optionally deploy Web Application Firewall (WAF) on Azure Front Door to protect the API Management instance from malicious attacks. For more information, see [Azure Web Application Firewall on Azure Front Door](../web-application-firewall/afds/afds-overview.md).
