Advanced Container Apps Networking: VNet Integration and Centralized Firewall Traffic Logging
Azure community, I recently documented a networking scenario relevant to Azure Container Apps environments where you need to control and inspect application traffic using a third-party network virtual appliance. The article walks through a practical deployment pattern: • Integrate your Azure Container Apps environment with a Virtual Network. • Configure user-defined routes (UDRs) so that traffic from your container workloads is directed toward a firewall appliance before reaching external networks or backend services. • Verify actual traffic paths using firewall logs to confirm that routing policies are effective. This pattern is helpful for organizations that must enforce advanced filtering, logging, or compliance checks on container egress/ingress traffic, going beyond what native Azure networking controls provide. It also complements Azure Firewall and NSG controls by introducing a dedicated next-generation firewall within your VNet. If you’re working with network control, security perimeters, or hybrid network architectures involving containerized workloads on Azure, you might find it useful. Read the full article on my blog
Azure Virtual Hub to on-prem connectivity
Hi All, we are seeing some different behavior from Azure environment, we have Virtual WAN and Vhub Setup of centralized network, traffic flow from Azure to on-prem as below - Azure VM - Virtual Hub- VPN - On-prem router - destination VM. the actual problem is we are trying to connect port 53,636,389 AD ports to destination server. but could see only port 3389 is getting success response when we do telnet to destination server. All Nsg are in place and internal routing also appears to be correct. when we checked with our internal network team they were saying traffic is not coming from Azure itself as they could only see response for port 3389 for other ports there is no traffic seen. at this point we are unsure where the traffic is blocking even. On-prem firewall shows all ports to the Azure Ip addrr is allowed. at this point unsure where we can check further on this. can some one help on this, appreciate for response..
Azure API on Application Gateway
Hi I have created a application gateway and some backend pools for that. I have added some Virtual machines and Virtual machines Scale Sets for backend pool. I'm trying to run a API where it gets the response of all the Application Gateways. In that response i'm getting response of backend pool but where i'm not seeing any details of Virtual Machine and Virtualmachine Scale Set. Here is the response i got on running the api { "value": [ { "name": "AppGateWay", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay", "etag": "W/\"b3422d5e-f4c2-4b16-8241-9195571478b6\"", "type": "Microsoft.Network/applicationGateways", "location": "eastus", "tags": { "Name": "AppGateway", "Tag": "VirimaApptag", "Tag4": "VTag", "VirimaTestTag": "AppGateway" }, "properties": { "provisioningState": "Succeeded", "resourceGuid": "7e7b5f02-8386-4858-85e4-b97953ec26b2", "sku": { "name": "Standard_v2", "tier": "Standard_v2" }, "operationalState": "Running", "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/gatewayIPConfigurations/appGatewayIpConfig", "etag": "W/\"b3422d5e-f4c2-4b16-8241-9195571478b6\"", "properties": { "provisioningState": "Succeeded", "subnet": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/virtualNetworks/VirtualNetworkAppGateway/subnets/default" } }, "type": "Microsoft.Network/applicationGateways/gatewayIPConfigurations" } ], "sslCertificates": [], "trustedRootCertificates": [], "frontendIPConfigurations": [ { "name": "appGwPublicFrontendIp", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/frontendIPConfigurations/appGwPublicFrontendIp", "etag": "W/\"b3422d5e-f4c2-4b16-8241-9195571478b6\"", "type": "Microsoft.Network/applicationGateways/frontendIPConfigurations", "properties": { "provisioningState": "Succeeded", "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/publicIPAddresses/AppGateWayPublicIP" }, "httpListeners": [ { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/httpListeners/HttP" } ] } } ], "frontendPorts": [ { "name": "port_80", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/frontendPorts/port_80", "etag": "W/\"b3422d5e-f4c2-4b16-8241-9195571478b6\"", "properties": { "provisioningState": "Succeeded", "port": 80, "httpListeners": [ { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/httpListeners/HttP" } ] }, "type": "Microsoft.Network/applicationGateways/frontendPorts" }, { "name": "port_8080", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/frontendPorts/port_8080", "etag": "W/\"b3422d5e-f4c2-4b16-8241-9195571478b6\"", "properties": { "provisioningState": "Succeeded", "port": 8080 }, "type": "Microsoft.Network/applicationGateways/frontendPorts" } ], "backendAddressPools": [ { "name": "AppGateWayBackendPool", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/backendAddressPools/AppGateWayBackendPool", "etag": "W/\"b3422d5e-f4c2-4b16-8241-9195571478b6\"", "properties": { "provisioningState": "Succeeded", "backendIPConfigurations": [ { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/networkInterfaces/vmwebapp599/ipConfigurations/ipconfig1" } ], "backendAddresses": [ { "fqdn": "http://www.virima.com" }, { "fqdn": "virimawebapp.azurewebsites.net" }, { "ipAddress": "192.168.48.123" } ], "requestRoutingRules": [ { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/requestRoutingRules/AppGatewayRoutingRule" } ] }, "type": "Microsoft.Network/applicationGateways/backendAddressPools" } ], "backendHttpSettingsCollection": [ { "name": "HTTPSettings", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/backendHttpSettingsCollection/HTTPSettings", "etag": "W/\"b3422d5e-f4c2-4b16-8241-9195571478b6\"", "properties": { "provisioningState": "Succeeded", "port": 80, "protocol": "Http", "cookieBasedAffinity": "Disabled", "hostName": null, "pickHostNameFromBackendAddress": false, "affinityCookieName": "ApplicationGatewayAffinity", "path": null, "requestTimeout": 20, "requestRoutingRules": [ { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/requestRoutingRules/AppGatewayRoutingRule" } ] }, "type": "Microsoft.Network/applicationGateways/backendHttpSettingsCollection" } ], "httpListeners": [ { "name": "HttP", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/httpListeners/HttP", "etag": "W/\"b3422d5e-f4c2-4b16-8241-9195571478b6\"", "properties": { "provisioningState": "Succeeded", "frontendIPConfiguration": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/frontendIPConfigurations/appGwPublicFrontendIp" }, "frontendPort": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/frontendPorts/port_80" }, "protocol": "Http", "requireServerNameIndication": false, "requestRoutingRules": [ { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/requestRoutingRules/AppGatewayRoutingRule" } ] }, "type": "Microsoft.Network/applicationGateways/httpListeners" } ], "urlPathMaps": [], "requestRoutingRules": [ { "name": "AppGatewayRoutingRule", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/requestRoutingRules/AppGatewayRoutingRule", "etag": "W/\"b3422d5e-f4c2-4b16-8241-9195571478b6\"", "properties": { "provisioningState": "Succeeded", "ruleType": "Basic", "httpListener": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/httpListeners/HttP" }, "backendAddressPool": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/backendAddressPools/AppGateWayBackendPool" }, "backendHttpSettings": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/AppGateWay/backendHttpSettingsCollection/HTTPSettings" } }, "type": "Microsoft.Network/applicationGateways/requestRoutingRules" } ], "probes": [], "redirectConfigurations": [], "enableHttp2": false } }, { "name": "ApplicationGateway05", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05", "etag": "W/\"5199771f-af4e-4b13-a2be-e64b63805a2c\"", "type": "Microsoft.Network/applicationGateways", "location": "centralindia", "tags": { "ITowner": "Virima" }, "properties": { "provisioningState": "Succeeded", "resourceGuid": "fd231a90-ca94-4ba3-9c19-4e0f2d359ba0", "sku": { "name": "Standard_v2", "tier": "Standard_v2" }, "operationalState": "Stopped", "gatewayIPConfigurations": [ { "name": "appGatewayIpConfig", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/gatewayIPConfigurations/appGatewayIpConfig", "etag": "W/\"5199771f-af4e-4b13-a2be-e64b63805a2c\"", "properties": { "provisioningState": "Succeeded", "subnet": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/virtualNetworks/virimavitualnetwork/subnets/default" } }, "type": "Microsoft.Network/applicationGateways/gatewayIPConfigurations" } ], "sslCertificates": [], "trustedRootCertificates": [], "frontendIPConfigurations": [ { "name": "appGwPublicFrontendIp", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/frontendIPConfigurations/appGwPublicFrontendIp", "etag": "W/\"5199771f-af4e-4b13-a2be-e64b63805a2c\"", "type": "Microsoft.Network/applicationGateways/frontendIPConfigurations", "properties": { "provisioningState": "Succeeded", "privateIPAllocationMethod": "Dynamic", "publicIPAddress": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/publicIPAddresses/virimaipaddress" }, "httpListeners": [ { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/httpListeners/listener01" } ] } } ], "frontendPorts": [ { "name": "port_80", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/frontendPorts/port_80", "etag": "W/\"5199771f-af4e-4b13-a2be-e64b63805a2c\"", "properties": { "provisioningState": "Succeeded", "port": 80, "httpListeners": [ { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/httpListeners/listener01" } ] }, "type": "Microsoft.Network/applicationGateways/frontendPorts" } ], "backendAddressPools": [ { "name": "backendpool", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/backendAddressPools/backendpool", "etag": "W/\"5199771f-af4e-4b13-a2be-e64b63805a2c\"", "properties": { "provisioningState": "Succeeded", "backendAddresses": [] }, "type": "Microsoft.Network/applicationGateways/backendAddressPools" }, { "name": "Vm", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/backendAddressPools/Vm", "etag": "W/\"5199771f-af4e-4b13-a2be-e64b63805a2c\"", "properties": { "provisioningState": "Succeeded", "backendAddresses": [], "requestRoutingRules": [ { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/requestRoutingRules/routingrule01" } ] }, "type": "Microsoft.Network/applicationGateways/backendAddressPools" } ], "backendHttpSettingsCollection": [ { "name": "http", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/backendHttpSettingsCollection/http", "etag": "W/\"5199771f-af4e-4b13-a2be-e64b63805a2c\"", "properties": { "provisioningState": "Succeeded", "port": 80, "protocol": "Http", "cookieBasedAffinity": "Disabled", "pickHostNameFromBackendAddress": false, "requestTimeout": 20, "requestRoutingRules": [ { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/requestRoutingRules/routingrule01" } ] }, "type": "Microsoft.Network/applicationGateways/backendHttpSettingsCollection" } ], "httpListeners": [ { "name": "listener01", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/httpListeners/listener01", "etag": "W/\"5199771f-af4e-4b13-a2be-e64b63805a2c\"", "properties": { "provisioningState": "Succeeded", "frontendIPConfiguration": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/frontendIPConfigurations/appGwPublicFrontendIp" }, "frontendPort": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/frontendPorts/port_80" }, "protocol": "Http", "requireServerNameIndication": false, "requestRoutingRules": [ { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/requestRoutingRules/routingrule01" } ] }, "type": "Microsoft.Network/applicationGateways/httpListeners" } ], "urlPathMaps": [], "requestRoutingRules": [ { "name": "routingrule01", "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/requestRoutingRules/routingrule01", "etag": "W/\"5199771f-af4e-4b13-a2be-e64b63805a2c\"", "properties": { "provisioningState": "Succeeded", "ruleType": "Basic", "httpListener": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/httpListeners/listener01" }, "backendAddressPool": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/backendAddressPools/Vm" }, "backendHttpSettings": { "id": "/subscriptions/ba2c2197-9ca0-4859-b088-e8b987b9dbe7/resourceGroups/Virima/providers/Microsoft.Network/applicationGateways/ApplicationGateway05/backendHttpSettingsCollection/http" } }, "type": "Microsoft.Network/applicationGateways/requestRoutingRules" } ], "probes": [], "redirectConfigurations": [], "enableHttp2": false } } ] } The api I ran to get this response is https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Network/applicationGateways?api-version=2020-05-01 Can someone help me how to get the details of all the backendpools of application gateway including VM and VMSS.
Hosting a Windows or Linux DHCP server in Azure for servicing remote sites or DHCP as a Service
I believe currently it is not possible to host a Windows or Linux DHCP server in Azure for servicing/managing IP address allocation to remote sites on a WAN. Does anyone know of a work around or 'DHCP as a Service' offering that is cloud based?
