Azure Front Door
An Azure service that provides a cloud content delivery network with threat protection.
627 questions
Azure Front Door(Standard) forwards IPV6 instead of IPv4 in the X-Forwarded-For header
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(131.20000000000002, 18%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EBS%3C/text%3E%3C/svg%3E)
Babloo Singh
5
Reputation points
We have a functionality where the admin can restrict users from accessing the apps who don't belong to a specific IP/IP range. Our applications were deployed behind a Application Gateway and it used to work fine with the X-Forwarded-For header giving the IPV4 address We recently implemented Azure Front Door and the X-Forwarded-For header gives the IPV6 instead of the IPV4. We still have the AG configured. We are using Azure Front Door Standard, is there a way to make AFD forward IPV4 instead? We couldn't find any settings/configs related to this on the Azure portal.
{count} vote
-
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(134.4, 59%, 23%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3ECM%3C/text%3E%3C/svg%3E)
ChaitanyaNaykodi-MSFT 24,656 Reputation points Microsoft Employee2024-01-25T03:51:53.9266667+00:00 @Babloo Singh
Thank you for reaching out. I understand that you recently implemented Azure Front Door and the X-Forwarded-For header which gives the IPV6 instead of the IPV4. This issue is specific to the client environment. As Azure Front Door supports Dual Stack this is expected behavior for clients using only IPv6 or Dual stack IP addresses. In most of the client environments using dual stack, IPv6 addresses are preferred for communication.Currently disabling IPv6 functionality for a specific Azure Front Door endpoint is not supported by design.
I think the work-around in this case will be set DNS for Azure FrontDoor Domain/Custom Domain in such a way that it only resolves to IPv4 address as If a dual-stacked device queries the name of a destination and DNS gives it an IPv4 address (a DNS A Record), it sends IPv4 packets. If DNS responds with an IPv6 address (a DNS AAAA Record), it sends IPv6 packets.
I currently validating with the team internally, if this will work if an alias record (A record) is added for the FrontDoor domain as it will always resolve to an IPv4 address, and a Dual Stack client will use IPv4 address to connect.
Meanwhile regarding your observation regarding Application Gateway. The observation might be because dual stack support for Application Gateway is currently in preview. Currently you can’t upgrade existing IPv4 only Application Gateways to dual stack (IPv4 and IPv6) Application Gateways. Please let me know if you have any questions. Thank you!
Sign in to comment