I am using the Azure Load Balancer with Azure service fabric to host multiple self host web applications, I'd like to create a rule that allows me to route based on the users URL request.
So for example if a user navigates to :
http:// domain.com/Site1 then the rule would route to:
http:// domain.com**:8181**/Site1 within the cluster
if the user navigates to:
http:// domain.com/Site2 then the rule would route to:
http:// domain.com**:8282**/Site2 within the cluster
Is this possible with azure service fabric/load balancer?
The Azure Load Balancer only forwards traffic it receives on a port to a node in your cluster on another port (can be the same port or a different internal port). It operates on Layer 4 (TCP, UDP) so it doesn't know anything about HTTP or URLs (although it does allow HTTP probes).
Here are a couple options for multiple web sites:
If you want your web sites hosted internally on different ports (8181 and 8282), then you'll need something else to do URL routing. Azure Traffic Manager or Azure Application Gateway are possible options that would run outside your cluster. Your Azure Load Balancer would need to open a port for each web site, but the benefit is this way you can run your web sites on dedicated nodes and the ALB would automatically route traffic to the appropriate nodes based on which ports are open.
Alternatively, you can set up your own stateless routing service that runs inside your cluster.
Or you can skip routing altogether and just host all of your websites on port 80/443. As long as you're using an http.sys-based web host, which includes Katana, ASP.NET Core 1 WebListener, or anything you build on HttpListener, you can use the same port for all your websites and let the underlying http server route according to either a URL path or hostname, both of which are supported.
Related
I am creating an application gateway and that will be a single point of entry for my multi tenant application. That means I will have multiple application request on this application gateway and then I need to redirect to backend pool. If I will have one application A deployed in app service A then it will listen at port 80 of app gateway. Similar if I have another application, I can expose it using similar way on different port. How can I achieve it. I tried creating multiple rules but not working.
If I read your question correctly, you want multiple app services, each on a potentially different port, to be served by a single application gateway. And it sounds possible you might want to make requests to that application gateway on different port. Sound right?
If so, then what you need to do is something along these lines:
Set up a backend pool for each app service.
Set up an HTTP setting for each backend pool, specifying port, session affinity, protocol, etc. - This will be the port that your App Service takes requests on.
Create a front end IP configuration to expose a public and/or private IP address
Create a listener for each app service, and port that you want to support. This will be the port you want the client requests to use. You can do two listeners per service to allow 80 & 443 (HTTP & HTTPS) traffic, for example.
Create a rule to connect each listener to its backend pool and HTTP setting combination
Optional - set up health probes that target monitoring endpoints based on an URL and a specific HTTP setting entry
I'm having an issue with hosting multiple .NET websites on Windows Server/IIS and Azure Application Gateway.
We host multiple sites on a single Azure Windows VM running IIS, sitting behind Azure Application Gateway WAFv2. The VM is connected to App Gateway using a backend pool configured to point to the private IP of the VM, with the VNets peering configured between the App Gateway and VM VNets.
When I stop the default website in IIS, ALL websites then return a '502 Bad Gateway' error from Azure Application Gateway, and the backend health status changes to 'Unhealthy' for the backend pool where the VM resides.
Can anyone tell me why stopping the Default site would cause Application Gateway to error for all sites?
EDIT:
Screenshot of IIS bindings as requested
EDIT 2: Apparently I can't answer my own question, however after working through this with our CSP I have the answer. By default the App Gateway Backend Health check looks at the default IIS site. If you stop that then the Backend Health Check fails and goes Unhealthy. At this point APP Gateway will no longer even ATTEMPT to route any requests, regardless of URL to that backend pool.
If the application gateway has no VMs or virtual machine scale set configured in the back-end address pool, it can’t route any customer request and sends a bad gateway error.
Following the below command to show back-end address pool JSON result.
Get-AzApplicationGateway -Name "SampleGateway" -ResourceGroupName "ExampleResourceGroup"
Here is an official guideline for troubleshooting the 502 error.
https://learn.microsoft.com/en-us/azure/application-gateway/application-gateway-troubleshooting-502#overview
Also, here is a simple troubleshooter.
https://support.microsoft.com/en-us/help/4504111/azure-application-gateway-with-bad-gateway-502-errors
If I were to try and troubleshoot this, I would likely start with a brand new "test" instance of IIS and set up a reverse proxy on port 80 whose only job is to listen to incoming requests to port 80. Those requests would then be forwarded by your reverse proxy to your actual websites bound to different ports (e.g. 81, 82, 83, etc).
The idea here is to have all of your websites running on different ports such that when you stop one of your sites, the others continue to run without a problem.
Given your setup with up to 40 sites hosted in a single instance of IIS, I would only attempt this type of troubleshooting with a brand new "test" instance of IIS.
Create a brand new "test" instance of IIS.
Create a reverse proxy. To do this, create a new site and name it (e.g. rev-proxy) and give it a binding of port 80.
Deploy one actual site (e.g. myfirstsite). Give it a port binding of something other than 80 (e.g. 81).
Double click your rev-proxy site and add a URL Rewrite -> Inbound Rules -> Blank rule. See attached picture. Add a rule such that when a user requests "myfirstsite" that request is forwarded onto port 81. Use the "Test Pattern" button to test your pattern. The image is only a suggestion and your pattern should correspond to the URL your users are using to request your site and not necessarily to the name you give your site in IIS.
An example of a reverse proxy with a URL Rewrite
Found the answer to this after many months of messing about!
With Azure Application Gateway, the default health probes for each backend pool ping and look for a response on the configured IP address or FQDN in the backend pool itself.
In my case this is set to the local IP address of the Virtual machine (when I configured this 18-24 months ago I recall our Azure CSP telling me there was a bug with using the FQDN in the backend pool configuration).
This means, that when the Health Probe is attempting to communicate with the VM, the Default Website in IIS is the only thing configured to respond to any requests on this IP address.
If you stop the Default Site, the Health Probe gets no response to it's requests a the Backend Pool status goes to Unhealthy as you would expect.
The really interesting thing here is that as soon as the Backend Pool Health Probe status goes Unhealthy, Azure Application Gateway ceases to even attempt to route any traffic to the affected backend pool. Instead it immediately reports the 502 Bad gateway error, and will continue to do so until the Health Probe status is corrected and goes back to healthy!
I have multiple sites hosted on the same machine in Azure on different ports:
foobar.com:8000
foobar.com:8001
foobar.com:8002
etc
I would like to address these by subdomain using a reverse proxy;
aaaa.mysite.com ----> foobar.com:8000
bbbb.mysite.com ----> foobar.com:8001
cccc.mysite.com ----> foobar.com:8002
Is it possible to do this in Application Gateway? It only seems to cater for different paths (not subdomains) and doesn't allow ports to be specified for backends.
Is there another Azure feature that allows for this (e.g. Front Door)?
As your requirement to address them by subdomains in APP GW, you could use multi-site hosting.
There are three common mechanisms for enabling multiple site hosting
on the same infrastructure.
Host multiple web applications each on a unique IP address. Use host
name to host multiple web applications on the same IP address. Use
different ports to host multiple web applications on the same IP
address.
For example, you want aaaa.mysite.com ----> foobar.com:8000. The main configuration will be like this: create a multi-site listener, use frontend port 80 and hostname aaaa.mysite.com in this multi-site listener. HTTP setting should specify the port 8000. Make sure the listener is listening on port 80 and HTTP setting configure your custom port for your backend websites.
In this case, you will create 3 Listeners with on same port 80,and specify the hostnames and create 3 HTTP settings, and create rules with corresponding Listener and HTTP settings and backend pool.
The Azure front door also has URL-based routing and Multiple-site hosting ability. Refer to this document.
Update
Backend pools
Create one backend pool and set your Azure VM as the backend in the backend pool.
Listeners
Click multi-site to create a multi-site listener then save it. You need three listeners for your host name.
Type the subdomains as the host name
Health probes
Add a health probe and checkbox pick host name from backend http settings.
HTTP settings
Add three HTTP settings and specify the custom port on each of HTTP settings.
Rules
Add three basic rules with corresponding Listener and HTTP settings and backend pool.
I have a use case where my cluster has 3 VMs working as head node in HPC Pack and a bunch of other VMs working as compute nodes.
So basically, after creating this cluster, i must install a special HCP client, from this client, i type the DNS name of each of VMs to access the HPC management interface.
For example: https://head-node-1.azure.com
Of course, if i access this DNS from Chrome, i only see IIS page.
I wants to create a load balancer with its DNS name. Let's say https://load-balancer.azure.com
So from my client, every time i access load balancer DNS name, i can see the management interface, not IIS page.
How can i do that?
Not sure I'm understanding you correctly. Basically, Azure Application Gateway supports URL path-based routing rules.
Actually, Application Gateway supports web-based traffic load balancing. [Azure load balancer][2] supports stream-based traffic. If you want to listen to the protocol HTTP or HTTPS, you can use Application Gateway. Per your description, you could not access HPC management interface from web explorer, you could use a 4 layer load balancing based on TCP/UDP.
So you could create a public-facing load balancing and add the head node VMs as the backend pools. Create a health probe and load balancing rules to specify the ports you want to listen for your HPC management interface on the each of VMs.
Hope this helps, let me know if you have any concerns.
I deployed an app on Service Fabric and there's an HTTP listener spawned inside. How can I configure the listening URL in relation to app/cluster?
More precisely, is there any way to build this URL inside the app by retrieving some environment/role parameter ?
Suppose my cluster is called "test", then it will be available at: test.northeurope.cloudapp.azure.com. If I have an app called "Sample" for which I configured an endpoint called "SampleTypeEndpoint" inside ServiceManifest.xml, what would be the complete URL my app would listen to?
The endpoints you configure in ServiceManifest.xml right now fulfill two purposes:
Allow Service Fabric to provide a unique port from an application port range, if you don't need a well-known port.
When opening a web server that uses http.sys, allow Service Fabric to set up URL ACLs for a random port or a well-known port (80, 443, etc) and certificate ACLs for HTTPS.
That's basically it. The actual address on which you open a listener is up to you to determine. Typically, you open a listener on the node IP and use a NAT for ingress traffic on a domain name. In Azure, the NAT is the Azure Load Balancer which is automatically configured to accept traffic on your cluster's VIP as well as the .region.cloudapp.azure.com domain.
Here's a more thorough overview of how this works on Service Fabric cluster in Azure: https://azure.microsoft.com/en-us/documentation/articles/service-fabric-connect-and-communicate-with-services/