Azure - Application Gateway without public IP

0
votes

I'm trying to deploy my application on Azure. Currently, I have an application gateway deployed in one subnet s1, and in the backend pool I have Linux VMs. As per the requirement, I cannot use any public ip so, I'm using only private ip on Application Gateway. Since we need the internet connection at the time of deploying application, I tried attaching NSG to the Application Gateway's subnet with inbound "Internet" allowed. When I attached the NSG to application gateway subnet, the backend health showed as unhealthy with error:

"Cannot connect to server. Check whether any NSG/UDR/Firewall is blocking access to server. Check if application is running on correct port."

I tried to add rules specified in MSFT's document https://docs.microsoft.com/en-us/azure/application-gateway/configuration-overview#allow-application-gateway-access-to-a-few-source-ips but its not helpful. So my questions are:

  1. Is there anything more I need to add to NSG on application gateway's subnet.
  2. Is it a good strategy to allow internet access using the inbound rule on NSG? (Inbound rule -> service tag -> Internet). Is there any other way I can have internet access just at the time of deployment? PS: I'm not allowed to use public IP at all.

Many thanks!

1
azureazure-application-gateway

1 Answers

1
votes

You can deploy Application Gateway with Public IP and Private IP. All you need to do is to create the listener with the private Frontend IP and leave the Public IP as such.

Since Public IP is not attached with any of the listener, no one will be able to access your site from Internet via Public IP of your Application Gateway.

When AppGW needs to initiate outbound to Internet, it uses that Public IP.

Note: You cannot have only Private IP as Frontend in V2 deployment and you can deploy Application Gateway with only Private Frontend IP in V1 SKU.