How to configure an application gateway to use private listeners

Hello Dave Laws,

We kindly request you to verify that the private listener is correctly configured to use the private frontend IP address. The listener must be explicitly associated with the correct frontend IP configuration to function as expected.

Refer: https://learn.microsoft.com/en-us/azure/application-gateway/configuration-listeners#frontend-ip-address

Since your NSG rules allow traffic to both public and private frontend IPs, it's still important to double-check that port TCP 443 is explicitly allowed from the relevant sources to the private IP address.

Additionally, please verify the backend health status via the Azure Portal:

1. Navigate to your "Application Gateway Backend health" under the Monitoring section.
2. Select the backend pool associated with the private listener.
3. Check for any unhealthy indicators, such as timeouts, DNS resolution failures, or SSL handshake errors
4. https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-backend-health-troubleshooting#how-to-check-backend-health

Also, please note that using the same port (e.g., 443) for both public and private listeners is supported, provided that they are configured on different frontend IP configurations. For more information, please refer the below documents:

Refer: https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-faq#can-i-use-the-same-port-for-both-public-facing-and-private-facing-listeners

https://learn.microsoft.com/en-us/azure/application-gateway/configuration-listeners#frontend-port

To assist further, we kindly request you to share the following information:

• A summary of your NSG rules, especially those affecting the subnet or NIC of the Application Gateway.
• Confirmation that the private listener setup aligns with the documentation linked above.
• Any specific error messages or symptoms observed when accessing the private listener (e.g., connection timeout, SSL errors, etc.).

I hope this information help! Please let us know if you have any further queries.

I have a same issue able to access the External Site (y.com) with the external IP but not the internal site (x.com) with internal IP ,DNS works . Can help me with suggestions

Hi G Sree Vidya,

FYI - sri is my colleague, so the info he posted above describes the scenario we are trying to solve.

@Dave Laws

As I can see, the backend is currently responding only over HTTP on port 80, not HTTPS. Both the internal and external listeners are configured to use HTTP backend settings, which matches the backend configuration.

Could you please try the following approaches and confirm?

1. Access the site using http://help.osuf.org instead of https://help.osuf.org, since the internal listener is not configured with HTTPS backend settings.
   OR
2. Configure Application Gateway to redirect HTTP to HTTPS This way, users still access the site securely, but your backend setup remains unchanged.

Follow the Add a routing rule with a redirection configuration for more information.

If you're still unable to resolve the issue, please provide the requested details in the private chat so we can connect offline for further troubleshooting.

I hope this helps to resolve your query.

If the above is unclear and/or you are unsure about something, add a comment below.

Hello Venkat V,

We're doing SSL offload on the application gateway, so the traffic is HTTPS to the external and internal listeners and then HTTP to the servers. Let us know if there is a better way to do that.