Skip to content

Commit a861729

Browse files
duongauduongau
committed
fix private link toc entry
1 parent 44b43c4 commit a861729

File tree

2 files changed

+102
-101
lines changed

2 files changed

+102
-101
lines changed

‎articles/frontdoor/TOC.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -322,7 +322,7 @@
322322
href: standard-premium/how-to-enable-private-link-web-app.md
323323
- name: Azure CLI
324324
href: standard-premium/how-to-enable-private-link-web-app-cli.md
325-
- name: Connect to an pplication aateway
325+
- name: Connect to an application gateway
326326
href: how-to-enable-private-link-application-gateway.md
327327
- name: Monitor and reports
328328
items:

‎articles/frontdoor/how-to-enable-private-link-application-gateway.md

Lines changed: 101 additions & 100 deletions
Original file line numberDiff line numberDiff line change
@@ -1,128 +1,37 @@
11
---
22
title: 'Connect Azure Front Door Premium to an Azure Application Gateway origin with Private Link (Preview)'
33
titleSuffix: Azure Private Link
4-
description: Learn how to connect your Azure Front Door Premium to an application gateway privately.
4+
description: Learn how to connect your Azure Front Door Premium to an Azure Application Gateway privately.
55
services: frontdoor
66
author: duongau
77
ms.service: azure-frontdoor
88
ms.topic: how-to
99
ms.date: 09/20/2024
1010
ms.author: duau
1111
zone_pivot_groups: front-door-dev-exp-ps-cli
12+
ms.custom: ai-usage
1213
---
1314

1415
# Connect Azure Front Door Premium to an Azure Application Gateway with Private Link (Preview)
1516

1617
This article guides you through the steps to configure an Azure Front Door Premium to connect privately to your Azure Application Gateway using Azure Private Link.
1718

18-
::: zone pivot="front-door-cli"
19-
20-
[!INCLUDE[azure-cli-prepare-your-environment](~/reusable-content/azure-cli/azure-cli-prepare-your-environment.md)]
21-
22-
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
23-
24-
- A functioning Azure Front Door Premium profile and endpoint. See [Create a Front Door - CLI](create-front-door-cli.md).
25-
26-
- A functioning Azure Application Gateway. See [Direct web traffic with Azure Application Gateway - Azure CLI](../application-gateway/quick-create-cli.md).
27-
28-
## Enable private connectivity to Azure Application Gateway
29-
30-
Follow the steps in [Configure Azure Application Gateway Private Link](../application-gateway/private-link-configure.md), skipping the last step of creating a private endpoint.
31-
32-
## Create an origin group and add the application gateway as an origin
33-
34-
1. Create an origin group:
35-
36-
```azurecli-interactive
37-
az afd origin-group create \
38-
--resource-group myRGFD \
39-
--origin-group-name og \
40-
--profile-name contosoafd \
41-
--probe-request-type GET \
42-
--probe-protocol Http \
43-
--probe-interval-in-seconds 60 \
44-
--probe-path / \
45-
--sample-size 4 \
46-
--successful-samples-required 3 \
47-
--additional-latency-in-milliseconds 50
48-
```
49-
50-
1. Add your application gateway as an origin:
51-
52-
```azurecli-interactive
53-
az afd origin create \
54-
--enabled-state Enabled \
55-
--resource-group myRGFD \
56-
--origin-group-name og \
57-
--origin-name appgwog \
58-
--profile-name contosoafd \
59-
--host-name 10.0.0.4 \
60-
--origin-host-header 10.0.0.4 \
61-
--http-port 80 \
62-
--https-port 443 \
63-
--priority 1 \
64-
--weight 500 \
65-
--enable-private-link true \
66-
--private-link-location centralus \
67-
--private-link-request-message 'AFD Private Link request.' \
68-
--private-link-resource /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myRGAG/providers/Microsoft.Network/applicationGateways/myAppGateway \
69-
--private-link-sub-resource-type appGwPublicFrontendIp
70-
```
71-
72-
> [!NOTE]
73-
> `SharedPrivateLinkResourceGroupId` is the same as the Application Gateway frontend IP configuration. This value may vary for different frontend IP configurations.
74-
75-
## Approve the private endpoint connection
76-
77-
1. Retrieve the list of private endpoint connections:
78-
79-
```azurecli-interactive
80-
az network private-endpoint-connection list --name myAppGateway --resource-group myRGAG --type Microsoft.Network/applicationgateways
81-
```
82-
83-
1. Approve the private endpoint connection:
84-
85-
86-
```azurecli-interactive
87-
az network private-endpoint-connection approve --id /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myRGAG/providers/Microsoft.Network/applicationGateways/myAppGateway/privateEndpointConnections/aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb.bbbbbbbb-1111-2222-3333-cccccccccccc
88-
```
89-
90-
1. Add a route to map the endpoint to the origin group:
91-
92-
```azurecli-interactive
93-
az afd route create \
94-
--resource-group myRGFD \
95-
--profile-name contosoafd \
96-
--endpoint-name contosofrontend \
97-
--forwarding-protocol MatchRequest \
98-
--route-name route \
99-
--route-name route \
100-
--https-redirect Enabled \
101-
--origin-group og \
102-
--supported-protocols Http Https \
103-
--link-to-default-domain Enabled
104-
```
105-
106-
Your Azure Front Door profile is now fully functional after completing the final step.
107-
108-
::: zone-end
109-
11019
::: zone pivot="front-door-ps"
11120

11221
## Prerequisites
11322

11423
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
24+
11525
- Azure PowerShell installed locally or Azure Cloud Shell.
11626

11727
[!INCLUDE [updated-for-az](~/reusable-content/ce-skilling/azure/includes/updated-for-az.md)]
11828

11929
[!INCLUDE [cloud-shell-try-it.md](~/reusable-content/ce-skilling/azure/includes/cloud-shell-try-it.md)]
120-
- - Have a functioning Azure Application Gateway. For more information on how to create an Application Gateway, see [Direct web traffic with Azure Application Gateway using Azure PowerShell](../application-gateway/quick-create-powershell.md)
121-
12230

123-
Add a route to map the endpoint to the origin group:
31+
- Have a functioning Azure Application Gateway. For more information on how to create an Application Gateway, see [Direct web traffic with Azure Application Gateway using Azure PowerShell](../application-gateway/quick-create-powershell.md)
12432

12533
- Have a functioning Azure Front Door Premium profile and an endpoint. For more information on how to create an Azure Front Door profile, see [Create a Front Door - PowerShell](create-front-door-powershell.md).
34+
12635
- Have a functioning Azure Application Gateway. For more information on how to create an Application Gateway, see [Direct web traffic with Azure Application Gateway using Azure PowerShell](../application-gateway/quick-create-powershell.md)
12736

12837
## Enable private connectivity to Azure Application Gateway
@@ -169,9 +78,6 @@ Add a route to map the endpoint to the origin group:
16978
17079
1. Use the [New-AzFrontDoorCdnOrigin](/powershell/module/az.cdn/new-azfrontdoorcdnorigin) command to add your application gateway to the origin group.
17180
172-
> [!NOTE]
173-
> 'SharedPrivateLinkResourceGroupId' is the same as the Application Gateway frontend IP configuration. This value may be different for different frontend IP configurations.
174-
17581
```azurepowershell-interactive
17682
New-AzFrontDoorCdnOrigin `
17783
-OriginGroupName og `
@@ -190,6 +96,9 @@ Add a route to map the endpoint to the origin group:
19096
-Weight 1000 `
19197
```
19298
99+
> [!NOTE]
100+
> 'SharedPrivateLinkResourceGroupId' is the same as the Application Gateway frontend IP configuration. This value may be different for different frontend IP configurations.
101+
193102
## Approve the private endpoint
194103
195104
1. Run [Get-AzPrivateEndpointConnection](/powershell/module/az.network/get-azprivateendpointconnection) to retrieve the connection name of the private endpoint connection that needs approval.
@@ -201,7 +110,7 @@ Add a route to map the endpoint to the origin group:
201110
2. Run [Get-AzPrivateEndpointConnection](/powershell/module/az.network/get-azprivateendpointconnection) to retrieve the private endpoint connection details. Use the *Name* value from the output in the next step for approving the connection.
202111
203112
```azurepowershell-interactive
204-
Approve-AzPrivateEndpointConnection -Name aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb.bbbbbbbb-1111-2222-3333-cccccccccccc -ResourceGroupName myRGAG -ServiceName myAppGateway -PrivateLinkResourceType Microsoft.Network/applicationgateways
113+
Get-AzPrivateEndpointConnection -Name aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb.bbbbbbbb-1111-2222-3333-cccccccccccc -ResourceGroupName myRGAG -ServiceName myAppGateway -PrivateLinkResourceType Microsoft.Network/applicationgateways
205114
```
206115
207116
## Complete Azure Front Door setup
@@ -226,6 +135,98 @@ Add a route to map the endpoint to the origin group:
226135
227136
::: zone-end
228137
138+
::: zone pivot="front-door-cli"
139+
140+
[!INCLUDE[azure-cli-prepare-your-environment](~/reusable-content/azure-cli/azure-cli-prepare-your-environment.md)]
141+
142+
- An Azure account with an active subscription. [Create an account for free](https://azure.microsoft.com/free/?WT.mc_id=A261C142F).
143+
144+
- A functioning Azure Front Door Premium profile and endpoint. See [Create a Front Door - CLI](create-front-door-cli.md).
145+
146+
- A functioning Azure Application Gateway. See [Direct web traffic with Azure Application Gateway - Azure CLI](../application-gateway/quick-create-cli.md).
147+
148+
## Enable private connectivity to Azure Application Gateway
149+
150+
Follow the steps in [Configure Azure Application Gateway Private Link](../application-gateway/private-link-configure.md), skipping the last step of creating a private endpoint.
151+
152+
## Create an origin group and add the application gateway as an origin
153+
154+
1. Run [az afd origin-group create](/cli/azure/afd/origin-group#az-afd-origin-group-create) to create an origin group.
155+
156+
```azurecli-interactive
157+
az afd origin-group create \
158+
--resource-group myRGFD \
159+
--origin-group-name og \
160+
--profile-name contosoafd \
161+
--probe-request-type GET \
162+
--probe-protocol Http \
163+
--probe-interval-in-seconds 60 \
164+
--probe-path / \
165+
--sample-size 4 \
166+
--successful-samples-required 3 \
167+
--additional-latency-in-milliseconds 50
168+
```
169+
170+
1. Run [az afd origin create](/cli/azure/afd/origin#az-afd-origin-create) to add an application gateway as an origin to the origin group.
171+
172+
```azurecli-interactive
173+
az afd origin create \
174+
--enabled-state Enabled \
175+
--resource-group myRGFD \
176+
--origin-group-name og \
177+
--origin-name appgwog \
178+
--profile-name contosoafd \
179+
--host-name 10.0.0.4 \
180+
--origin-host-header 10.0.0.4 \
181+
--http-port 80 \
182+
--https-port 443 \
183+
--priority 1 \
184+
--weight 500 \
185+
--enable-private-link true \
186+
--private-link-location centralus \
187+
--private-link-request-message 'AFD Private Link request.' \
188+
--private-link-resource /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myRGAG/providers/Microsoft.Network/applicationGateways/myAppGateway \
189+
--private-link-sub-resource-type appGwPublicFrontendIp
190+
```
191+
192+
> [!NOTE]
193+
> `SharedPrivateLinkResourceGroupId` is the same as the Application Gateway frontend IP configuration. This value may be different for different frontend IP configurations.
194+
195+
## Approve the private endpoint connection
196+
197+
1. Retrieve the list of private endpoint connections:
198+
199+
```azurecli-interactive
200+
az network private-endpoint-connection list --name myAppGateway --resource-group myRGAG --type Microsoft.Network/applicationgateways
201+
```
202+
203+
1. Approve the private endpoint connection:
204+
205+
206+
```azurecli-interactive
207+
az network private-endpoint-connection approve --id /subscriptions/aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e/resourceGroups/myRGAG/providers/Microsoft.Network/applicationGateways/myAppGateway/privateEndpointConnections/aaaaaaaa-0000-1111-2222-bbbbbbbbbbbb.bbbbbbbb-1111-2222-3333-cccccccccccc
208+
```
209+
210+
1. Add a route to map the endpoint to the origin group:
211+
212+
```azurecli-interactive
213+
az afd route create \
214+
--resource-group myRGFD \
215+
--profile-name contosoafd \
216+
--endpoint-name contosofrontend \
217+
--forwarding-protocol MatchRequest \
218+
--route-name route \
219+
--route-name route \
220+
--https-redirect Enabled \
221+
--origin-group og \
222+
--supported-protocols Http Https \
223+
--link-to-default-domain Enabled
224+
```
225+
226+
Your Azure Front Door profile is now fully functional after completing the final step.
227+
228+
::: zone-end
229+
229230
## Common mistakes to avoid
230231
231232
The following are common mistakes when configuring an application gateway origin with Private Link enabled:

0 commit comments

Comments
 (0)