Prerequisites
All droplets must be within an Azure Resource Group, configured with a valid name and location.
The App Gateway must be in its own subnet.
You will need either a self-signed SSL certificate or a signed SSL certificate to configure the App Gateway in this tutorial.
Example Topology
This tutorial takes you through creating a basic network infrastructure, with a single Azure Virtual Machine and Azure SQL Server with an Azure App Gateway.
The configuration of the App Gateway includes configuring HTTP to HTTPS redirect.
The purpose of this tutorial is to demonstrate configuring Azure App Gateway. Please reach out if you would like further information.
Configure the Network Infrastructure
First, we will drag, drop & configure our Azure Resource Group and then build our initial network infrastructure to connect our Azure App Gateway.
Drag & drop an Azure Resource Group onto your blueprint
On the Properties Panel set the Name and Location for Resource Group A
Drag & drop an Azure Virtual Network into Resource Group A
Set the Name for your Virtual Network and set the Address Space to 10.0.0.0/16
Drag & drop an Azure Subnet into your Virtual Network (this will automatically add an NSG)
Delete the NSG from Subnet A
Set the Name for your Subnet A and set the address prefix to 10.0.1.0/24
Drag & drop a second Azure Subnet into your Virtual Network (this will automatically add an NSG)
Set the Name for Subnet B and set the address prefix to 10.0.2.0/24
Set the Name for the NSG
Drag & drop an Azure Virtual Machine into the Subnet
Set the Name for the Virtual Machine
Under 'Storage Profile' set the OS Disk Name for the Virtual Machine
Under 'Network Interfaces' set the Network Interface Card Name for the Virtual Machine
On the Network Interface Card click 'Add new IP Configurations'
On the IP Configuration set the 'Private IP Address' to 10.0.2.10
Set the 'Private IP Allocation' to 'Static'
Set the 'Private IP Address Version' to IPv4
Under 'OS Profile' set the Computer Name, Admin Username and Password secret parameter for the Virtual Machine
Add the App Gateway & Create IP Configurations & Frontend Port
Now we can add our App Gateway and configure the IP configurations and frontend ports.
Drag & drop an Azure Application Gateway into the dock of Subnet A
Set the Name property of the Application Gateway
Select SKU and set Name to Standard_Medium from the dropdown
Set 'Tier' to 'Standard'
Set 'Capacity' to 2
Select 'Frontend IP Configurations' from the properties tree
Click 'Add new Frontend IP Configuration'
Set the Name of the Frontend IP Configuration e.g. myAGIPConfig
Click 'Add new Public IP Address'
Set the Name of the Public IP Address e.g. myAGPublicIPAddress
Set 'Public IP Allocation Method' to 'Dynamic'
Set 'IP Address Version' to 'IPv4'
Set the SKU property to 'Basic'
Select 'Frontend Ports' from the property tree and click 'Add new Frontend Port'
Set the Name property for the Frontend Port e.g. httpsPort
Set the Port property to 443
Create App Gateway Backend Pool & Settings
The next step is to configure our backend pools. Backend pools route requests to backend servers which serve the request. Click here for more information on App Gateway components.
Select Backend Address Pool from the properties tree
Click 'Add new Backend Address Pool'
Set the Name of the Backend Address Pool
Click 'Add new Backend Address'
Set the 'IP Address' to 10.0.2.10 (the IP of your Azure Virtual Machine)
Select 'Backend HTTP Settings Collection' from the property tree
Click 'Add new Backend HTTP Settings Collection'
Set the Name property of the Backend HTTP Settings Collection
Set the 'Port' to 80
Set 'Protocol' to Http from the dropdown menu
Set 'Cookie Based Affinity' to 'Enabled'
Set 'Request Timeout' to 120
Configure the SSL Certificate
To secure the traffic on the App Gateway we need to configure the SSL certificate. To complete this part of the tutorial you will need either a self-signed base64 encoded certificate or a commercial, signed certificate.
Select 'SSL Certificates' from the property tree
Click 'Add new SSL Certificate'
Select the new SSL Certificate and set the Name property
Paste the certificate's base-64 encoded data into the 'Data' field
Set the Secret Parameter of the SSL Certificate 'Password' property
Create the Default HTTPS (443) Listener and Rule
Now we need to configure the default listener and rule. A listener is required to enable the application gateway to route traffic appropriately to the backend pool. In this example, you create a basic listener that listens for HTTPS traffic at the root URL.
Select HTTP Listeners from the properties tree
Click 'Add new HTTP Listener'
Set the Name of the 'HTTP Listener' e.g. httpsListener
Set the Frontend IP Configuration to the Frontend IP configuration created earlier
Set the Frontend Port to the HTTPS frontend port created earlier
Set the Protocol to Https from the dropdown menu
Set the SSL Certificate property to the SSL Certificate configured earlier
Select 'Request Routing Rules' from the property tree
Click 'Add new Request Routing Rule'
Set the Name of the rule e.g. rule1
Set the 'Rule Type' to Basic
Set the 'Backend Address Pool' to the Backend Address Pool configured earlier
Set the 'Backend HTTP Settings' to the Backend HTTP Settings Collection
Set the 'HTTP Listener' to the HTTPS that was listener that was just configured
Add a Listener and Redirection Rule for HTTP (80) Traffic
We now need to setup the configuration for HTTP redirection to HTTPS.
Select 'Frontend Ports' from the property tree and click 'Add new Frontend Port'
Set the Name property for the Frontend Port e.g. httpPort
Set the Port property to 80
Select HTTP Listeners from the property tree
Click Add new HTTP Listener
Set the Name of the 'HTTP Listener' e.g. httpListener
Set the Frontend IP Configuration to the Frontend IP configuration created earlier
Set the Frontend Port to the HTTP port that was just configured
Set the Protocol to Http from the dropdown menu
Select 'Redirect Configurations' from the property tree
Click 'Add new Redirect Configuration'
Set the Name property e.g. httpToHttps
Set 'Redirect Type' to permanent from the dropdown menu
Set 'Target Listener' to the HTTPS Listener created earlier
Set 'Include Path' to 'True'
Set 'Include Query String' to 'True'
Select 'Request Routing Rules' from the property tree
Click 'Add new Request Routing Rule'
Set the Name of the rule e.g. rule2
Set the 'Rule Type' to Basic
Set the 'HTTP Listener' to the HTTP listener just created e.g. httpListener
Set the 'Redirect Configuration' to the Redirect Configuration e.g. httpToHttps
That's it. You've now configured an internet facing Azure Application Gateway set to accept HTTPS traffic on port 443 and forward it to your backend Azure Virtual Machine. You also configured HTTP on port 80 to redirect to HTTPS.
Optional: Configure an Azure SQL Server Backend
An additional step is to configure an Azure SQL Server for use with the Azure Virtual Machine. This is a common topology for web applications that require a SQL database backend.
Drag & drop an Azure SQL instance into Resource Group A
Set the name of the Azure SQL Server (this can only be lowercase, numbers, and hyphens)
Set the Administrator Login Name
Set the Secret Parameter for the Administrator Login Password
Select 'Databases' and create a new database by clicking 'Add new Database'
Set the name for the database, e.g. mydatabase (this can only be lowercase, numbers, and hyphens)
Set the 'Edition' property to Basic (the 'Edition' property is the main influence on the cost of deploying Azure SQL Server. Unless you have any specific requirements we recommend using the Basic edition)