Azure - Application Gateway falling into failed state not allowing configuration changes

Did you ever got the error while doing any changes in Azure Application gateway which goes into failed state ? if yes then you are landed in correct blog post.

here in this post i will try to share the solution for same issue i faced in past.But before that lets try to understand what is Azure AG (application gateway). Below diagram will help you to understand what is Application gateway.

In simpler words, Application gateway consists of Load balancer (a device who decide where to send the traffic based on the configuration done on it, although that is completely different topic to discuss) and acts as WAF (Web Application Firewall - which monitors the incoming traffic based on the application behavior hosted on back-end servers)
  • LB where considered as Network device (sometimes it might be software not just physical device and works at Network Layer of OSI model
  • WAF considered as kind of Software and works at Application Layer of OSI model 

Issue: Application Gateway falling into failed state not allowing configuration changes & Back-end health status show as unknown

Possible Solution: 

  • Check if you have proper rules in place at Application Gateway NSG which allows communication with the Gateway manager, which is used for control plane communication

 This rule will not affect the health status of the back-end devices but the Application Gateway will work correctly even without it. This rule allows control plane data from the Gateway Manager which include information about the back-end health.
  •  Thus, if this rule is missing, there will be no information on the Gateway manager regarding some App GW options and functionalities. One of them is the health status of the back-end. This means the application gateway will not work, but the health of the back-end in the Azure control platform will be unknown and we can see a report of unknown status (even if it is Ok).

  • Additionally, it turns out that if the communication with the Gateway manager is blocked it may end up with Application Gateway in failed state. This is why its recommended not to apply NSG on the Application Gateway sub-net.
  • When the proper rule is in place it should always display Healthy or Unhealthy status as well as not causing Failed State anymore. do note that the lack of communication with the Gateway manager may cause different kind of issues
  • Rule can be applied as per the documentation mentioned over here

Linuxforeveryone started with the focus of solving linux related issues a sys admin faces everyday. So as System Admin whatever i learn through my experience i try to write it down for rest of opensource community.

If you appreciate what you have read or this blog writeup helped you can considering buying me COFFEE, this will help me keep writing and helping community further.