You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Azure Operational Excellence documentation is an organized collection of service specific guidance in the context of targeted workflow operations. Each service specific operational excellence guidance set is grounded in the [Azure Well-Architected Framework (WAF) principles for Operational Excellence](/azure/well-architected/operational-excellence/principles), and designed based on the [Cloud Adoption Framework (CAF)](/azure/cloud-adoption-framework/) architecture.
15
14
16
15
Currently in preview, the Operational Excellence documentation set contains the following service-specific content:
17
16
18
17
-[Service region relocation](./overview-relocation.md). The region relocation documentation is designed to provide service-specific relocation guidance, so that you can move your services from one region to another safely and with confidence, in accordance with the following Well-architected Framework (WAF) principles:
18
+
19
19
-[Deploy with confidence](/azure/well-architected/operational-excellence/principles#deploy-with-confidence)
Each service-specific guide is derived from [Relocate cloud workloads](/azure/cloud-adoption-framework/relocate/) in the Cloud Adoption Framework for Azure.
This article covers the recommended approach, guidelines, and practices to relocate Application Gateway and WAF between Azure regions.
16
+
This article covers the recommended approach, guidelines, and practices to relocate Application Gateway and WAF between Azure regions.
17
17
18
18
>[!IMPORTANT]
19
-
>The redeployment steps in this document apply only to the application gateway itself and not the backend services to which the application gateway rules are routing traffic.
19
+
>The redeployment steps in this document apply only to the application gateway itself and not the backend services to which the application gateway rules are routing traffic.
20
20
21
21
## Prerequisites
22
22
23
23
- Verify that your Azure subscription allows you to create Application Gateway SKUs in the target region.
24
24
25
25
- Plan your relocation strategy with an understanding of all services that are required for your Application Gateway. For the services that are in scope of the relocation, you must select the appropriate relocation strategy.
26
-
- Ensure that the Application Gateway subnet at the target location has enough address space to accommodate the number of instances required to serve your maximum expected traffic.
27
26
27
+
- Ensure that the Application Gateway subnet at the target location has enough address space to accommodate the number of instances required to serve your maximum expected traffic.
28
+
28
29
- For Application Gateway's deployment, you must consider and plan the setup of the following sub-resources:
- Ensure that the Application Gateway subnet at the target location has enough address space to accommodate the number of instances required to serve your maximum expected traffic.
- Ensure that the Application Gateway subnet at the target location has enough address space to accommodate the number of instances required to serve your maximum expected traffic.
37
39
38
40
## Redeploy
39
41
40
-
To relocate Application Gateway and optional WAF, you must create a separate Application Gateway deployment with a new public IP address at the target location. Workloads are then migrated from the source Application Gateway setup to the new one. Since you're changing the public IP address, changes to DNS configuration, virtual networks, and subnets are also required.
42
+
To relocate Application Gateway and optional WAF, you must create a separate Application Gateway deployment with a new public IP address at the target location. Workloads are then migrated from the source Application Gateway setup to the new one. Since you're changing the public IP address, changes to DNS configuration, virtual networks, and subnets are also required.
41
43
42
44
If you only want to relocate in order to gain availability zones support, see [Migrate Application Gateway and WAF to availability zone support](../reliability/migrate-app-gateway-v2.md).
43
45
@@ -53,7 +55,7 @@ If you only want to relocate in order to gain availability zones support, see [M
53
55
54
56
1. Create an Application Gateway and configure a new Frontend Public IP Address for the virtual network:
55
57
- Without WAF: [Create an application gateway](../application-gateway/quick-create-portal.md#create-an-application-gateway).
56
-
- With WAF: [Create an application gateway with a Web Application Firewall](../web-application-firewall/ag/application-gateway-web-application-firewall-portal.md)
58
+
- With WAF: [Create an application gateway with a Web Application Firewall](../web-application-firewall/ag/application-gateway-web-application-firewall-portal.md).
57
59
58
60
1. If you have a WAF config or custom rules-only WAF Policy, [transition it to to a full WAF policy](../web-application-firewall/ag/migrate-policy.md).
59
61
@@ -62,24 +64,21 @@ If you only want to relocate in order to gain availability zones support, see [M
62
64
1. Verify that the Application Gateway and WAF are working as intended.
63
65
64
66
1. Migrate your configuration to the new public IP address.
65
-
1. Switch Public and Private endpoints in order to point to the new application gateway.
67
+
1. Switch Public and Private endpoints in order to point to the new application gateway.
66
68
1. Migrate your DNS configuration to the new Public- and/or Private IP address.
67
69
1. Update endpoints in consumer applications/services. Consumer application/services updates are usually done by means of a properties change and redeployment. However, perform this method whenever a new hostname is used in respect to deployment in the old region.
68
70
69
71
1. Delete the source Application Gateway and WAF resources.
70
72
71
73
## Relocate certificates for Premium TLS Termination (Application Gateway v2)
72
74
73
-
74
75
The certificates for TLS termination can be supplied in two ways:
75
76
76
77
-*Upload.* Provide an TLS/SSL certificate by directly uploading it to your Application Gateway.
77
78
78
-
-*Key Vault reference.* Provide a reference to an existing Key Vault certificate when you create a HTTPS/TLS-enabled listener. For more information on downloading a certificate, see [Relocate Key Vault to another region](./relocation-key-vault.md).
79
+
-*Key Vault reference.* Provide a reference to an existing Key Vault certificate when you create a HTTPS/TLS-enabled listener. For more information on downloading a certificate, see [Relocate Key Vault to another region](./relocation-key-vault.md).
79
80
80
81
>[!WARNING]
81
82
>References to Key Vaults in other Azure subscriptions are supported, but must be configured via ARM template, Azure PowerShell, CLI, Bicep, etc. Cross-subscription key vault configuration is not supported by Application Gateway via Azure portal.
82
83
83
-
84
-
Follow the documented procedure to enable [TLS termination with Key Vault certificates](/azure/application-gateway/key-vault-certs#configure-your-key-vault) for your relocated Application Gateway.
85
-
84
+
Follow the documented procedure to enable [TLS termination with Key Vault certificates](/azure/application-gateway/key-vault-certs#configure-your-key-vault) for your relocated Application Gateway.
0 commit comments