HTTP Load Balancer Setup in Azure

How the pieces connect

An Application Gateway routes traffic through a pipeline of components. Understanding how they connect makes the setup feel logical rather than arbitrary:

Traffic flow for HTTPS:

Internet user → Public IP → HTTPS Listener (port 443) → Routing rule → Backend pool → HTTP Settings → Backend VM:80

The listener accepts the incoming connection. The routing rule decides which backend pool to send traffic to. The HTTP settings define how Application Gateway connects to the backend. The backend pool contains the actual servers.

For HTTP-to-HTTPS redirect:

Internet user → Public IP → HTTP Listener (port 80) → Routing rule → Redirect to HTTPS Listener

What you need before starting

Before creating the Application Gateway, make sure you have:

1. A VNet with an Application Gateway subnet (minimum /26, recommended /24). The subnet cannot contain any other resources.

2. A Standard SKU public IP address (static allocation).

3. Backend VMs or services in a separate subnet within the same VNet (or reachable via peering).

4. An SSL certificate if you are terminating HTTPS at the gateway (PFX format with private key, or a Key Vault certificate reference).

Create the prerequisites:

# Create resource group
az group create --name rg-web-prod --location eastus

# Create VNet and Application Gateway subnet
az network vnet create \
  --name vnet-web-prod \
  --resource-group rg-web-prod \
  --location eastus \
  --address-prefixes 10.1.0.0/16

az network vnet subnet create \
  --name snet-appgw \
  --resource-group rg-web-prod \
  --vnet-name vnet-web-prod \
  --address-prefixes 10.1.0.0/24

az network vnet subnet create \
  --name snet-backends \
  --resource-group rg-web-prod \
  --vnet-name vnet-web-prod \
  --address-prefixes 10.1.1.0/24

# Create static public IP
az network public-ip create \
  --name pip-appgw \
  --resource-group rg-web-prod \
  --sku Standard \
  --allocation-method Static \
  --zone 1 2 3

Step 1: Create the Application Gateway

The initial create command sets up the gateway with one frontend, one backend pool, one HTTP setting, one listener, and one rule. You can modify all of these afterward.

az network application-gateway create \
  --name agw-web-prod \
  --resource-group rg-web-prod \
  --location eastus \
  --sku Standard_v2 \
  --capacity 2 \
  --vnet-name vnet-web-prod \
  --subnet snet-appgw \
  --public-ip-address pip-appgw \
  --frontend-port 80 \
  --http-settings-port 80 \
  --http-settings-protocol Http \
  --routing-rule-type Basic \
  --priority 100 \
  --servers 10.1.1.10 10.1.1.11

This creates a basic HTTP load balancer. Traffic on port 80 goes to the two backend VMs. Next, add HTTPS support.

Step 2: Add HTTPS termination

Upload your SSL certificate (PFX format) and configure an HTTPS listener:

# Add the SSL certificate to the gateway
az network application-gateway ssl-cert create \
  --gateway-name agw-web-prod \
  --resource-group rg-web-prod \
  --name cert-myapp \
  --cert-file /path/to/certificate.pfx \
  --cert-password "your-pfx-password"

# Add HTTPS frontend port
az network application-gateway frontend-port create \
  --gateway-name agw-web-prod \
  --resource-group rg-web-prod \
  --name port-443 \
  --port 443

# Create HTTPS listener
az network application-gateway http-listener create \
  --gateway-name agw-web-prod \
  --resource-group rg-web-prod \
  --name listener-https \
  --frontend-ip appGatewayFrontendIP \
  --frontend-port port-443 \
  --ssl-cert cert-myapp

# Create a routing rule for HTTPS traffic
az network application-gateway rule create \
  --gateway-name agw-web-prod \
  --resource-group rg-web-prod \
  --name rule-https \
  --http-listener listener-https \
  --rule-type Basic \
  --address-pool appGatewayBackendPool \
  --http-settings appGatewayBackendHttpSettings \
  --priority 90

Step 3: Redirect HTTP to HTTPS

Now configure the HTTP listener to redirect to HTTPS instead of serving traffic:

# Create the redirect configuration
az network application-gateway redirect-config create \
  --gateway-name agw-web-prod \
  --resource-group rg-web-prod \
  --name redirect-http-to-https \
  --type Permanent \
  --target-listener listener-https \
  --include-path true \
  --include-query-string true

# Update the HTTP routing rule to use the redirect
az network application-gateway rule create \
  --gateway-name agw-web-prod \
  --resource-group rg-web-prod \
  --name rule-http-redirect \
  --http-listener appGatewayHttpListener \
  --rule-type Basic \
  --redirect-config redirect-http-to-https \
  --priority 100

Step 4: Configure HTTP health probes

Replace the default TCP probe with an HTTP health check that verifies your application responds correctly:

# Create a custom HTTP health probe
az network application-gateway probe create \
  --gateway-name agw-web-prod \
  --resource-group rg-web-prod \
  --name probe-http-health \
  --protocol Http \
  --host-name-from-http-settings true \
  --path /health \
  --interval 30 \
  --threshold 3 \
  --timeout 30

# Update HTTP settings to use the custom probe
az network application-gateway http-settings update \
  --gateway-name agw-web-prod \
  --resource-group rg-web-prod \
  --name appGatewayBackendHttpSettings \
  --probe probe-http-health \
  --connection-draining-timeout 30

Verifying the setup

Check the backend health to confirm all VMs are passing health probes:

az network application-gateway show-backend-health \
  --name agw-web-prod \
  --resource-group rg-web-prod \
  --output table

Get the public IP address of the Application Gateway to test it:

az network public-ip show \
  --name pip-appgw \
  --resource-group rg-web-prod \
  --query "ipAddress" \
  --output tsv