Azure Application Gateway

What is Application Gateway?

Application Gateway is a web traffic load balancer that enables you to manage traffic to your web applications. It is an Application Delivery Controller (ADC) as a service — handling SSL offloading, URL routing, health monitoring, and security in one place.

SKUs

Key Components

Frontend IP

The public or private IP that clients connect to. Application Gateway must be deployed in its own subnet (no other resources in that subnet).

Listeners

A listener accepts incoming connection requests. It defines: protocol (HTTP/HTTPS), port, frontend IP, and optionally hostname. You create one listener per website/port combination.

Routing Rules

Maps a listener to a backend pool and HTTP settings. Two types:

• Basic — All traffic from the listener goes to one backend pool
• Path-based — Different URL paths go to different backend pools

Backend Pools

Groups of backend servers — VMs, VM Scale Sets, App Services, or IP/FQDN addresses. Multiple backend pools can exist for different purposes.

HTTP Settings

Defines how Application Gateway connects to backend servers: protocol, port, cookie-based affinity, connection timeout, and health probe.

URL Path-Based Routing

One of Application Gateway's most powerful features — route different URL paths to different backend pools:

www.contoso.com/api/*     → API backend pool (API servers)
www.contoso.com/images/*  → Images backend pool (image servers)
www.contoso.com/*         → Default backend pool (web servers)

This is extremely useful for microservices architectures where different services handle different URL paths — all behind a single frontend IP.

Multi-Site Hosting

Application Gateway can host multiple websites on the same gateway using hostname-based routing:

www.contoso.com    → Contoso backend pool
www.fabrikam.com   → Fabrikam backend pool

Both domains point to the same Application Gateway IP. The gateway inspects the HTTP Host header to route to the correct backend.

SSL Termination

Application Gateway can handle SSL/TLS so your backend servers don't have to:

SSL Termination (Offloading)

Client → HTTPS → App Gateway (decrypt) → HTTP → Backend
Backend servers receive unencrypted HTTP — simpler, lower CPU load on backends.

End-to-End SSL

Client → HTTPS → App Gateway (decrypt, inspect) → HTTPS → Backend
Re-encrypts traffic to backends. Required for compliance scenarios where data must be encrypted in transit throughout.

Web Application Firewall (WAF)

The WAF v2 SKU includes a Web Application Firewall that protects against common web vulnerabilities in the OWASP (Open Web Application Security Project) Core Rule Set:

• SQL Injection
• Cross-Site Scripting (XSS)
• Command Injection
• HTTP Request Smuggling
• HTTP Response Splitting
• Remote File Inclusion

WAF Modes

Autoscaling

Application Gateway v2 supports autoscaling — it automatically adds or removes capacity based on traffic load. You set a minimum and maximum instance count. Azure handles the rest — no manual scaling needed during traffic spikes.

• Minimum instances: 0 (for dev/test — scales to zero when idle)
• Maximum instances: up to 125
• Scales in ~1–2 minutes

App Gateway vs Load Balancer