Azure Application Gateway Overview

What layer 7 load balancing means

A standard load balancer works at layer 4 of the OSI model. It sees IP addresses and ports. It knows that a packet came from 203.0.113.10 on port 55000 and is going to port 443. That is all it knows.

Application Gateway works at layer 7. It decrypts HTTPS traffic (SSL termination), reads the actual HTTP request, and makes routing decisions based on:

- URL path: /api/* routes to one backend pool, /images/* routes to another.

- Hostname: app1.example.com routes to pool A, app2.example.com routes to pool B.

- HTTP headers and cookies: Session affinity based on a cookie keeps a user on the same backend.

This makes Application Gateway ideal for running multiple applications behind a single endpoint, or for routing API traffic separately from static content.

Core components

Listener: Accepts incoming connections. You define the protocol (HTTP or HTTPS), port, and optionally the hostname. A multi-site listener accepts connections for a specific hostname.

Backend pool: A set of backend targets — VMs, VM scale sets, IP addresses, FQDNs, or App Service instances.

HTTP settings: Defines how Application Gateway connects to backends — port, protocol, cookie-based affinity, connection draining timeout, and health probe settings.

Request routing rule: Links a listener to a backend pool through HTTP settings. Can be Basic (all traffic to one pool) or Path-based (routes to different pools based on URL path).

Health probe: Periodic checks against backend targets. Unhealthy backends are removed from rotation.

WAF policy: Optional Web Application Firewall rules that inspect and block malicious requests (OWASP rule sets, custom rules).

SKUs and tiers

Always use v2 SKUs. The v1 SKUs are deprecated and will be retired. For any internet-facing application, use WAF v2.

Deploying Application Gateway with the CLI

Application Gateway requires its own subnet. Create it first:

# Create the Application Gateway subnet (minimum /26, recommended /24)
az network vnet subnet create \
  --name snet-appgw \
  --resource-group rg-prod-networking \
  --vnet-name vnet-prod-eastus-001 \
  --address-prefixes 10.0.0.0/24

# Create a public IP for the Application Gateway
az network public-ip create \
  --name pip-appgw-prod \
  --resource-group rg-prod-networking \
  --location eastus \
  --sku Standard \
  --allocation-method Static \
  --zone 1 2 3

Create a WAF v2 Application Gateway with autoscaling:

az network application-gateway create \
  --name agw-prod-eastus \
  --resource-group rg-prod-compute \
  --location eastus \
  --sku WAF_v2 \
  --capacity 2 \
  --vnet-name vnet-prod-eastus-001 \
  --subnet snet-appgw \
  --public-ip-address pip-appgw-prod \
  --frontend-port 443 \
  --http-settings-port 80 \
  --http-settings-protocol Http \
  --routing-rule-type Basic \
  --priority 1000 \
  --servers 10.0.2.10 10.0.2.11

Enable autoscaling so Application Gateway scales with demand:

az network application-gateway update \
  --name agw-prod-eastus \
  --resource-group rg-prod-compute \
  --set autoscaleConfiguration='{"minCapacity": 1, "maxCapacity": 10}'

Add a path-based routing rule to send /api/* to a different backend pool:

# Create the API backend pool
az network application-gateway address-pool create \
  --gateway-name agw-prod-eastus \
  --resource-group rg-prod-compute \
  --name be-api-servers \
  --servers 10.0.2.20 10.0.2.21

# Create the URL path map
az network application-gateway url-path-map create \
  --gateway-name agw-prod-eastus \
  --resource-group rg-prod-compute \
  --name urlmap-main \
  --paths /api/* \
  --address-pool be-api-servers \
  --http-settings appGatewayBackendHttpSettings \
  --default-address-pool appGatewayBackendPool \
  --default-http-settings appGatewayBackendHttpSettings

WAF policies

The WAF component runs OWASP Core Rule Set rules that block common attacks: SQL injection, cross-site scripting, remote code execution, and more. You configure it through WAF policies that can be attached to an Application Gateway or individual listeners.

# Create a WAF policy in Prevention mode
az network application-gateway waf-policy create \
  --name waf-policy-prod \
  --resource-group rg-prod-compute \
  --location eastus

# Set the policy to Prevention mode (Detection mode only logs, does not block)
az network application-gateway waf-policy policy-setting update \
  --policy-name waf-policy-prod \
  --resource-group rg-prod-compute \
  --mode Prevention \
  --state Enabled \
  --request-body-check true \
  --max-request-body-size-kb 128