going with the application gateway in fornt of azure firewall does it lose the benefit of l7 load balancing

Mohammad Nemer 0 Reputation points
2024-09-23T06:26:52.93+00:00

I have an Azure firewall in a hub and spoke architecture, and one of the spokes contains my web servers, for HTTPS filtering I have an application gateway with the WAF feature and l7 load balancing. I have a requirement to keep centralized security management. Does placing the application GW in front of the Azure firewall cause the layer 7 load balancing feature to be lost? If the non-HTTPS traffic hits app GW and is then forwarded to Azure FW then it is forwarded back to app GW to keep l7 load balancing capabilities, does that add latency that Azure FW can't handle? What is the best practice in this case while keeping centralized security management?

Azure Firewall
Azure Firewall
An Azure network security service that is used to protect Azure Virtual Network resources.
660 questions
Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
1,063 questions
Azure Web Application Firewall
Azure Load Balancer
Azure Load Balancer
An Azure service that delivers high availability and network performance to applications.
434 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. KapilAnanth-MSFT 44,921 Reputation points Microsoft Employee
    2024-09-23T10:20:18.8833333+00:00

    @Mohammad Nemer ,

    Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

    I understand that you are trying to configure Application Gateway before Firewall set up.

    To address your queries,

    #1. Does placing the application GW in front of the Azure firewall cause the layer 7 load balancing feature to be lost?

    • The Load Balancing will happen without any issues.
    • From App Gateway perspective, the backends are still the VMs
    • You are using the UDR to force the traffic to route via AzFW before the backend VMs.

    #2. If the non-HTTPS traffic hits app GW and is then forwarded to Azure FW then it is forwarded back to app GW to keep l7 load balancing capabilities, does that add latency that Azure FW can't handle?

    • I doubt you will be able to achieve such an architecture design.
    • Moreover, in this scenario, non-HTTPS/HTTP traffic would not hit the App Gateway to begin with, see : Summarized Table
      • User's image

    Please review the workflow,

    • In step 2,
    • User's image

    Please let us know if we can be of any further assistance here.

    Thanks,

    Kapil

    Please Accept an answer if correct.

    Original posters help the community find answers faster by identifying the correct answer.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.