Skip to content

Commit 544425f

Browse files
duongauduongau
committed
review edits
1 parent 5be7ae8 commit 544425f

File tree

1 file changed

+168
-156
lines changed

1 file changed

+168
-156
lines changed

‎articles/frontdoor/how-to-enable-private-link-application-gateway.md

Lines changed: 168 additions & 156 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
---
2-
title: 'Connect Azure Front Door Premium to an application gateway origin with Private Link (preview)'
2+
title: 'Connect Azure Front Door Premium to an Application Gateway origin with Private Link (Preview)'
33
titleSuffix: Azure Private Link
44
description: Learn how to connect your Azure Front Door Premium to an application gateway privately.
55
services: frontdoor
@@ -11,101 +11,103 @@ ms.author: duau
1111
zone_pivot_groups: front-door-dev-exp-ps-cli
1212
---
1313

14-
# Connect Azure Front Door Premium to an application gateway with Private Link
15-
This article will guide you through how to configure Azure Front Door Premium tier to connect to your application gateway privately using the Azure Private Link service.
14+
# Connect Azure Front Door Premium to an Application Gateway with Private Link (Preview)
1615

17-
::: zone pivot="front-door-cli"
16+
This article guides you through the steps to configure Azure Front Door Premium to connect privately to your application gateway using Azure Private Link.
1817

19-
## Prerequisites - CLI
18+
::: zone pivot="front-door-cli"
2019

2120
[!INCLUDE [azure-cli-prepare-your-environment](~/reusable-content/azure-cli/azure-cli-prepare-your-environment.md)]
2221

22+
Prerequisites:
2323
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
24-
- Have a functioning Azure Front Door Premium profile and an endpoint. For more information on how to create an Azure Front Door profile, see [Create a Front Door - CLI](create-front-door-cli.md).
25-
- Have a functioning Azure Application Gateway. For more information on how to create an Application Gateway, see [Direct web traffic with Azure Application Gateway - Azure CLI](/articles/application-gateway/quick-create-cli.md).
24+
- A functioning Azure Front Door Premium profile and endpoint. See [Create a Front Door - CLI](create-front-door-cli.md).
25+
- A functioning Azure Application Gateway. See [Direct web traffic with Azure Application Gateway - Azure CLI](/articles/application-gateway/quick-create-cli.md).
26+
27+
## Enable Private Link on the Application Gateway
28+
29+
Follow the steps in [Configure Azure Application Gateway Private Link](/articles/application-gateway/private-link-configure.md), skipping the last step of creating a private endpoint.
30+
31+
## Create Origin Group and Origin on Azure Front Door
32+
33+
1. Create an origin group:
34+
```azurecli-interactive
35+
az afd origin-group create \
36+
--resource-group myRGFD \
37+
--origin-group-name og \
38+
--profile-name contosoafd \
39+
--probe-request-type GET \
40+
--probe-protocol Http \
41+
--probe-interval-in-seconds 60 \
42+
--probe-path / \
43+
--sample-size 4 \
44+
--successful-samples-required 3 \
45+
--additional-latency-in-milliseconds 50
46+
```
47+
48+
1. Add your application gateway as an origin:
49+
```azurecli-interactive
50+
az afd origin create \
51+
--enabled-state Enabled \
52+
--resource-group myRGFD \
53+
--origin-group-name og \
54+
--origin-name appgwog \
55+
--profile-name contosoafd \
56+
--host-name 10.0.0.4 \
57+
--origin-host-header 10.0.0.4 \
58+
--http-port 80 \
59+
--https-port 443 \
60+
--priority 1 \
61+
--weight 500 \
62+
--enable-private-link true \
63+
--private-link-location centralus \
64+
--private-link-request-message 'AFD Private Link request.' \
65+
--private-link-resource /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myRGAG/providers/Microsoft.Network/applicationGateways/myAppGateway \
66+
--private-link-sub-resource-type appGwPublicFrontendIp
67+
```
2668
27-
## Enable Private Link on Application Gateway
28-
Follow the steps in [Configure Azure Application Gateway Private Link](/articles/application-gateway/private-link-configure.md). Skip the last step of creating a private endpoint.
29-
30-
## Create origin group and origin on Azure Front Door
31-
32-
1. Run [az afd origin-group create](/cli/azure/afd/origin-group#az-afd-origin-group-create) to create an origin group.
33-
34-
```azurecli-interactive
35-
az afd origin-group create \
36-
--resource-group myRGFD \
37-
--origin-group-name og \
38-
--profile-name contosoafd \
39-
--probe-request-type GET \
40-
--probe-protocol Http \
41-
--probe-interval-in-seconds 60 \
42-
--probe-path / \
43-
--sample-size 4 \
44-
--successful-samples-required 3 \
45-
--additional-latency-in-milliseconds 50
46-
```
47-
2. Run [az afd origin create](/cli/azure/afd/origin#az-afd-origin-create) to add your application gateway as an origin to your origin group.
48-
49-
```azurecli-interactive
50-
az afd origin create \
51-
--enabled-state Enabled \
52-
--resource-group myRGFD \
53-
--origin-group-name og \
54-
--origin-name appgwog \
55-
--profile-name Hari \
56-
--host-name x.x.x.x \
57-
--origin-host-header x.x.x.x \
58-
--http-port 80 \
59-
--https-port 443 \
60-
--priority 1 \
61-
--weight 500 \
62-
--enable-private-link true \
63-
--private-link-location centralus \
64-
--private-link-request-message 'AFD Private Link request.' \
65-
--private-link-resource /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myRGAG/providers/Microsoft.Network/applicationGateways/myAppGateway \
66-
--private-link-sub-resource-type appGwPublicFrontendIp
67-
```
6869
> [!NOTE]
69-
> `SharedPrivateLinkResourceGroupId` is the same as the Application Gateway frontend IP configuration. This value may be different for different frontend IP configurations.
70+
> `SharedPrivateLinkResourceGroupId` is the same as the Application Gateway frontend IP configuration. This value may vary for different frontend IP configurations.
7071
71-
## Approve Private Endpoint Connection
72+
## Approve the Private Endpoint Connection
7273
73-
1. Run [az network private-endpoint-connection list](/cli/azure/network/private-endpoint-connection#az-network-private-endpoint-connection-list) to list the private endpoint connections. Note down the 'Resource ID' of the private endpoint connection available for your application gateway, in the first line of your output.
74+
1. List the private endpoint connections:
7475
75-
```azurecli-interactive
76+
```azurecli-interactive
7677
az network private-endpoint-connection list --name myAppGateway --resource-group myRGAG --type Microsoft.Network/applicationgateways
78+
```
7779
78-
```
80+
1. Approve the private endpoint connection:
7981
80-
2. Run [az network private-endpoint-connection approve](/cli/azure/network/private-endpoint-connection#az-network-private-endpoint-connection-approve) to approve the private endpoint connection.
82+
```azurecli-interactive
83+
az network private-endpoint-connection approve --id /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myRGAG/providers/Microsoft.Network/applicationGateways/myAppGateway/privateEndpointConnections/aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb.bbbbbbbb-1111-2222-3333-cccccccccccc
84+
```
8185
82-
```azurecli-interactive
83-
az network private-endpoint-connection approve --id /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myRGAG/providers/Microsoft.Network/applicationGateways/myAppGateway/privateEndpointConnections/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx
86+
## Complete Azure Front Door Setup
87+
88+
Add a route to map the endpoint to the origin group:
89+
```azurecli-interactive
90+
az afd route create \
91+
--resource-group myRGFD \
92+
--profile-name contosoafd \
93+
--endpoint-name contosofrontend \
94+
--forwarding-protocol MatchRequest \
95+
--route-name route \
96+
--route-name route \
97+
--https-redirect Enabled \
98+
--origin-group og \
99+
--supported-protocols Http Https \
100+
--link-to-default-domain Enabled
101+
```
102+
103+
Your Azure Front Door profile is now fully functional after completing the final step.
84104
85-
```
86-
## Complete Azure Front Door setup
87-
Add a route to map the endpoint that you created earlier to the origin group. This route forwards requests from the endpoint to your origin group. Run [az afd route create](/cli/azure/afd/route#az-afd-route-create) to map your endpoint to the origin group.
88-
89-
```azurecli-interactive
90-
az afd route create \
91-
--resource-group myRGFD \
92-
--profile-name contosoafd \
93-
--endpoint-name contosofrontend \
94-
--forwarding-protocol MatchRequest \
95-
--route-name route \
96-
--https-redirect Enabled \
97-
--origin-group og \
98-
--supported-protocols Http Https \
99-
--link-to-default-domain Enabled
100-
```
101-
Your Front Door profile has become fully functional with the last step.
102105
::: zone-end
103106
104107
::: zone pivot="front-door-ps"
105108
106-
## Prerequisites - PowerShell
107109
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
108-
- Azure PowerShell installed locally or Azure Cloud Shell
110+
- Azure PowerShell installed locally or Azure Cloud Shell.
109111
110112
[!INCLUDE [updated-for-az](~/reusable-content/ce-skilling/azure/includes/updated-for-az.md)]
111113
@@ -114,101 +116,111 @@ Your Front Door profile has become fully functional with the last step.
114116
- Have a functioning Azure Application Gateway. For more information on how to create an Application Gateway, see [Direct web traffic with Azure Application Gateway using Azure PowerShell](/articles/application-gateway/quick-create-powershell.md)
115117
116118
## Enable Private Link on Application Gateway
117-
1. Follow the steps in [Configure Azure Application Gateway Private Link](/articles/application-gateway/private-link-configure.md). Skip the last step of creating a private endpoint.
118-
119-
## Create origin group and origin on Azure Front Door
120-
1. Use [New-AzFrontDoorCdnOriginGroupHealthProbeSettingObject](/powershell/module/az.cdn/new-azfrontdoorcdnorigingrouphealthprobesettingobject) and [New-AzFrontDoorCdnOriginGroupLoadBalancingSettingObject](/powershell/module/az.cdn/new-azfrontdoorcdnorigingrouploadbalancingsettingobject) to create in-memory objects for storing health probe and load balancing settings. Run [New-AzFrontDoorCdnOriginGroup](/powershell/module/az.cdn/new-azfrontdoorcdnorigingroup) to create an origin group that will contain your application gateway.
121-
122-
```azurepowershell-interactive
123-
# Create health probe settings
124-
125-
$HealthProbeSetting = New-AzFrontDoorCdnOriginGroupHealthProbeSettingObject `
126-
-ProbeIntervalInSecond 60 `
127-
-ProbePath "/" `
128-
-ProbeRequestType GET `
129-
-ProbeProtocol Http
130119
131-
# Create load balancing settings
120+
1. Follow the instructions in [Configure Azure Application Gateway Private Link](/articles/application-gateway/private-link-configure.md), but don't complete the final step of creating a private endpoint.
121+
122+
1. Use [New-AzFrontDoorCdnOriginGroupHealthProbeSettingObject](/powershell/module/az.cdn/new-azfrontdoorcdnorigingrouphealthprobesettingobject) to create an in-memory object for storing health probe settings.
123+
124+
```azurepowershell-interactive
125+
# Create health probe settings
126+
127+
$HealthProbeSetting = New-AzFrontDoorCdnOriginGroupHealthProbeSettingObject `
128+
-ProbeIntervalInSecond 60 `
129+
-ProbePath "/" `
130+
-ProbeRequestType GET `
131+
-ProbeProtocol Http
132+
```
133+
134+
1. Use [New-AzFrontDoorCdnOriginGroupLoadBalancingSettingObject](/powershell/module/az.cdn/new-azfrontdoorcdnorigingrouploadbalancingsettingobject) to create an in-memory object for storing load balancing settings.
135+
136+
```azurepowershell-interactive
137+
# Create load balancing settings
138+
139+
$LoadBalancingSetting = New-AzFrontDoorCdnOriginGroupLoadBalancingSettingObject `
140+
-AdditionalLatencyInMillisecond 50 `
141+
-SampleSize 4 `
142+
-SuccessfulSamplesRequired 3
143+
```
144+
145+
1. Run [New-AzFrontDoorCdnOriginGroup](/powershell/module/az.cdn/new-azfrontdoorcdnorigingroup) to create an origin group that contains your application gateway.
146+
147+
```azurepowershell-interactive
148+
# Create origin group
149+
150+
$originpool = New-AzFrontDoorCdnOriginGroup `
151+
-OriginGroupName og `
152+
-ProfileName contosoAFD `
153+
-ResourceGroupName myRGFD `
154+
-HealthProbeSetting $HealthProbeSetting `
155+
-LoadBalancingSetting $LoadBalancingSetting
156+
```
157+
158+
1. Use the [New-AzFrontDoorCdnOrigin](/powershell/module/az.cdn/new-azfrontdoorcdnorigin) command to add your application gateway to the origin group.
159+
160+
> [!NOTE]
161+
> 'SharedPrivateLinkResourceGroupId' is the same as the Application Gateway frontend IP configuration. This value may be different for different frontend IP configurations.
162+
163+
```azurepowershell-interactive
164+
New-AzFrontDoorCdnOrigin `
165+
-OriginGroupName og `
166+
-OriginName appgatewayorigin `
167+
-ProfileName contosoAFD `
168+
-ResourceGroupName myRGFD `
169+
-HostName 10.0.0.4 `
170+
-HttpPort 80 `
171+
-HttpsPort 443 `
172+
-OriginHostHeader 10.0.0.4 `
173+
-Priority 1 `
174+
-PrivateLinkId /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myRGAG/providers/Microsoft.Network/applicationGateways/myAppGateway `
175+
-SharedPrivateLinkResourceGroupId appGwPublicFrontendIp `
176+
-SharedPrivateLinkResourcePrivateLinkLocation CentralUS `
177+
-SharedPrivateLinkResourceRequestMessage 'AFD Private Link request' `
178+
-Weight 1000 `
179+
```
132180
133-
$LoadBalancingSetting = New-AzFrontDoorCdnOriginGroupLoadBalancingSettingObject `
134-
-AdditionalLatencyInMillisecond 50 `
135-
-SampleSize 4 `
136-
-SuccessfulSamplesRequired 3
137-
138-
# Create origin group
139-
140-
$originpool = New-AzFrontDoorCdnOriginGroup `
141-
-OriginGroupName og `
142-
-ProfileName contosoAFD `
143-
-ResourceGroupName myRGFD `
144-
-HealthProbeSetting $HealthProbeSetting `
145-
-LoadBalancingSetting $LoadBalancingSetting
146-
```
147-
2. Run [New-AzFrontDoorCdnOrigin](/powershell/module/az.cdn/new-azfrontdoorcdnorigin) to add your application gateway to your origin group.
148-
149-
> [!NOTE]
150-
> 'SharedPrivateLinkResourceGroupId' is the same as the Application Gateway frontend IP configuration. This value may be different for different frontend IP configurations.
151-
152-
```azurepowershell-interactive
153-
New-AzFrontDoorCdnOrigin `
154-
-OriginGroupName og `
155-
-OriginName appgatewayorigin `
156-
-ProfileName contosoAFD `
157-
-ResourceGroupName myRGFD `
158-
-HostName x.x.x.x `
159-
-HttpPort 80 `
160-
-HttpsPort 443 `
161-
-OriginHostHeader x.x.x.x `
162-
-Priority 1 `
163-
-PrivateLinkId /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/myRGAG/providers/Microsoft.Network/applicationGateways/myAppGateway `
164-
-SharedPrivateLinkResourceGroupId appGwPublicFrontendIp `
165-
-SharedPrivateLinkResourcePrivateLinkLocation CentralUS `
166-
-SharedPrivateLinkResourceRequestMessage 'AFD Private Link request' `
167-
-Weight 1000 `
168-
```
169181
## Approve the private endpoint
170-
1. Run [Get-AzPrivateEndpointConnection](/powershell/module/az.network/get-azprivateendpointconnection) to get the connection name of the private endpoint connection to be approved.
171182
172-
```azurepowershell-interactive
173-
Get-AzPrivateEndpointConnection -ResourceGroupName myRGAG -ServiceName myAppGateway -PrivateLinkResourceType Microsoft.Network/applicationgateways
183+
1. Run [Get-AzPrivateEndpointConnection](/powershell/module/az.network/get-azprivateendpointconnection) to retrieve the connection name of the private endpoint connection that needs approval.
174184
175-
```
176-
2. Run [Get-AzPrivateEndpointConnection](/powershell/module/az.network/get-azprivateendpointconnection) to approve the private endpoint connection. The value for the field 'Name' should be the value you received in the previous step.
185+
```azurepowershell-interactive
186+
Get-AzPrivateEndpointConnection -ResourceGroupName myRGAG -ServiceName myAppGateway -PrivateLinkResourceType Microsoft.Network/applicationgateways
187+
```
177188
178-
```azurepowershell-interactive
189+
2. Run [Get-AzPrivateEndpointConnection](/powershell/module/az.network/get-azprivateendpointconnection) to retrieve the private endpoint connection details. Use the *Name* value from the output in the next step for approving the connection.
179190
180-
Approve-AzPrivateEndpointConnection -Name xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx -ResourceGroupName myRGAG -ServiceName myAppGateway -PrivateLinkResourceType Microsoft.Network/applicationgateways
181-
182-
```
191+
```azurepowershell-interactive
192+
Approve-AzPrivateEndpointConnection -Name aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb.bbbbbbbb-1111-2222-3333-cccccccccccc -ResourceGroupName myRGAG -ServiceName myAppGateway -PrivateLinkResourceType Microsoft.Network/applicationgateways
193+
```
183194
184195
## Complete Azure Front Door setup
185-
1. Run [New-AzFrontDoorCdnRoute](/powershell/module/az.cdn/new-azfrontdoorcdnroute) to map your endpoint to the origin group. This route forwards requests from the endpoint to your origin group.
186-
187196
188-
```azurepowershell-interactive
189-
# Create a route to map the endpoint to the origin group
190-
191-
$Route = New-AzFrontDoorCdnRoute `
192-
-EndpointName contosofrontend `
193-
-Name defaultroute `
194-
-ProfileName contosoAFD `
195-
-ResourceGroupName myRGFD `
196-
-ForwardingProtocol MatchRequest `
197-
-HttpsRedirect Enabled `
198-
-LinkToDefaultDomain Enabled `
199-
-OriginGroupId og `
200-
-SupportedProtocol Http,Https
201-
```
202-
Your Front Door profile has become fully functional with the last step.
197+
1. Use the [New-AzFrontDoorCdnRoute](/powershell/module/az.cdn/new-azfrontdoorcdnroute) command to create a route that maps your endpoint to the origin group. This route forwards requests from the endpoint to your origin group.
198+
199+
```azurepowershell-interactive
200+
# Create a route to map the endpoint to the origin group
201+
202+
$Route = New-AzFrontDoorCdnRoute `
203+
-EndpointName contosofrontend `
204+
-Name defaultroute `
205+
-ProfileName contosoAFD `
206+
-ResourceGroupName myRGFD `
207+
-ForwardingProtocol MatchRequest `
208+
-HttpsRedirect Enabled `
209+
-LinkToDefaultDomain Enabled `
210+
-OriginGroupId og `
211+
-SupportedProtocol Http,Https
212+
```
213+
Your Azure Front Door profile is now fully functional after completing the final step.
203214
204215
::: zone-end
205216
206-
## Commonly seen mistakes
207-
The following are the commonly seen mistakes while configuring an application gateway origin with private link enabled.
208-
1. Private link configuration was not set in advance to the Front Door creation steps.
209-
2. Adding the application gateway origin with privatelink to an existing origin group with public origins. Front door doesn't allow public and private origins in the same origin group.
210-
3. Wrong Application frontend IP configuration name is passed as the value for GroupId.
217+
## Common mistakes to avoid
218+
219+
The following are common mistakes when configuring an application gateway origin with Private Link enabled:
211220
221+
1. Not configuring Private Link before starting the Azure Front Door creation steps.
222+
2. Adding the Azure Application Gateway origin with Private Link to an existing origin group that contains public origins. Front Door doesn't allow mixing public and private origins in the same origin group.
223+
3. Providing an incorrect Azure Application Gateway frontend IP configuration name as the value for `GroupId`.
212224
213225
## Next steps
214226

0 commit comments

Comments
 (0)