Merge pull request #192019 from vhorne/ag-behealth-trouble

add secured Virtual hub scenario: Issue 88484

Author: PRMerger-2

articles/application-gateway/application-gateway-backend-health-troubleshooting.md

@@ -5,7 +5,7 @@ services: application-gateway
 author: vhorne
 ms.service: application-gateway
 ms.topic: troubleshooting
-ms.date: 06/09/2020
+ms.date: 03/17/2022
 ms.author: victorh 
 ms.custom: devx-track-azurepowershell
 ---
@@ -480,6 +480,19 @@ This behavior can occur for one or more of the following reasons:
 
 1.	To verify that Application Gateway is healthy and running, go to the **Resource Health** option in the portal and verify that the state is **Healthy**. If you see an **Unhealthy** or **Degraded** state, [contact support](https://azure.microsoft.com/support/options/).
 
+1. If Internet and private traffic are going though an Azure Firewall hosted in a secured Virtual hub (using Azure Virtual WAN Hub):
+
+   a. To ensure the application gateway can send traffic directly to the Internet, configure the following user defined route:
+   
+   Address prefix: 0.0.0.0/0<br>
+   Next hop: Internet
+
+   b. To ensure the application gateway can send traffic to the backend pool via an Azure Firewall in the Virtual WAN hub, configure the following user defined route:
+   
+   Address Prefix: Backend pool subnet<br>
+   Next hop: Azure Firewall private IP address
+
+
 ## Next steps
 
 Learn more about [Application Gateway diagnostics and logging](./application-gateway-diagnostics.md).