Azure Application Gateway
What it is
Azure Application Gateway is a Layer 7 (HTTP/HTTPS) load balancer that routes web traffic based on URL paths, hosts, and headers — offering SSL/TLS termination, cookie-based session affinity, and an optional Web Application Firewall (WAF).
Why it exists
Web applications need content-aware routing (e.g. /api/* to one pool, /static/* to another), offload of SSL/HTTP processing, and protection from web exploits (OWASP) — capabilities a Layer-4 Load Balancer can’t give. App Gateway handles them at the application layer.
Key ideas
- Layer 7 features: URL path-based routing, multi-site (host-based) routing, SSL/TLS termination & end-to-end encryption, session affinity (cookie) , autoscaling.
- WAF v2 SKU — web application firewall protecting against OWASP Top 10; blocks SQLi/XSS via managed rule sets.
- Components: listener (protocol/host/path), routing rules → backend pool (VMs, VMSS, App Service, on-prem), health probes (HTTP).
- SKUs: WAF_v2 / Standard_v2 (autoscaling, zone redundancy); older v1 tiers exist.
- Deploys in a dedicated subnet for the gateway’s NICs; requires a public/internal IP frontend.
- AGIC (Application Gateway Ingress Controller) integrates with AKS.
How it fits
[Internet]
│ HTTPS → SSL offload + WAF
▼
[App Gateway frontend]
│ URL-path rules
├── /api/* → backend pool A (VMs)
└── /* → backend pool B (App Service)
Diagrams courtesy of Microsoft Learn / Azure docs: application-gateway/overview
Exam notes
- L7 (HTTP/HTTPS) routing vs Load Balancer L4 (TCP/UDP) — memorize.
- WAF protects web apps (SQLi/XSS) — only on the WAF SKU.
- SSL offload and cookie session affinity are App Gateway strengths.
- Needs a dedicated subnet; uses listeners → rules → backend pools.
Related
Home · load-balancer · traffic-manager · azure-front-door · vnet · subnet
📘 Source: Microsoft Learn — Application Gateway