Azure Application Gateway
What it is
Azure Application Gateway is a regional Layer 7 load balancer for web traffic. It examines HTTP(S) request details—such as the host name and URL path—to choose a backend. It can also terminate TLS, keep a user on the same backend with cookie affinity, and integrate with a Web Application Firewall (WAF).
Why it exists
A web application may need /api to go to one backend and /images to another. A Layer 4 Load Balancer sees addresses and ports; Application Gateway can use the web request itself to make that decision.
Key ideas
- A listener receives a web request. A routing rule maps it to a backend pool; health probes prevent the gateway from sending requests to an unhealthy backend.
- It supports path-based routing, multiple-site/host routing, redirects, URL and header rewrites, TLS termination, end-to-end TLS, and cookie-based affinity.
- Current SKUs are Standard_v2 and WAF_v2. WAF_v2 adds web-attack protection using managed and custom rules. WAF reduces common HTTP(S) attack exposure; it does not replace secure application code or identity authorization.
- A gateway requires its own dedicated virtual-network subnet. It can expose a public or internal frontend, according to the design.
- Autoscaling, zone redundancy, connection draining, and Application Gateway Ingress Controller integration for AKS are available capabilities of the current platform. Choose and test them against workload requirements.
How it fits
[Internet]
│ HTTPS → SSL offload + WAF
▼
[App Gateway frontend]
│ URL-path rules
├── /api/* → backend pool A (VMs)
└── /* → backend pool B (App Service)
Diagrams courtesy of Microsoft Learn / Azure docs: application-gateway/overview
Northwind example
Northwind uses Application Gateway in its production region. A listener receives orders.northwind.example; a path rule sends /api/ to the ordering API and /images/ to the image service. Health probes remove a failed API instance from rotation. Maya enables WAF rules and investigates their logs before blocking a legitimate partner request with an overbroad custom rule.
Application Gateway versus other delivery services
| Requirement | Start by considering |
|---|---|
| Regional, HTTP(S), path or host routing to web backends | Application Gateway |
| Global edge delivery and routing for internet-facing web content | [[azure-front-door |
| Regional TCP or UDP load balancing | [[load-balancer |
| DNS-based global routing without HTTP request processing | [[traffic-manager |
Common confusion
- WAF is an optional security capability on the WAF_v2 SKU; it is not the same thing as Application Gateway itself.
- Application Gateway v1 retired on 2026-04-28. Design and migrate with the v2 family rather than using v1 guidance.
- A healthy HTTP probe does not prove every authenticated customer journey works. Pair it with application telemetry and suitable end-to-end tests.
Related
Home · load-balancer · traffic-manager · azure-front-door · vnet · subnet
Sources and re-audit
- Microsoft Learn — What is Azure Application Gateway?, checked 2026-09-16.