My health probe fails with a 403 as soon as I apply whitelisting to the App Service configured in the backend pool (I whitelist the IP that's assigned to the application gateway. IP is a standard tier and static.
Has anyone else been seeing this issue before? I was under the impression that I could whitelist the public IP assigned to the application gateway on the App Service so access is only possible from the Application Gateway endpoint.
The health probe is successful when I remove the whitelisting. So I'm sure it has something to do with that.
According to the document,
If the backend pool:
Is a public endpoint, the application gateway uses its frontend public IP to reach the server. If there isn't a frontend public IP address, one is assigned for the outbound external connectivity.
Contains an internally resolvable FQDN or a private IP address, the application gateway routes the request to the backend server by using its instance private IP addresses.
Contains an external endpoint or an externally resolvable FQDN, the application gateway routes the request to the backend server by using its frontend public IP address. The DNS resolution is based on a private DNS zone or custom DNS server, if configured, or it uses the default Azure-provided DNS. If there isn't a frontend public IP address, one is assigned for the outbound external connectivity.
Thus, you may use an internally resolvable FQDN or a private IP address of the backend app service in the backend pool.
In this case, you could change to use the default Azure app service hostname like webappname.azurewebsites.net or whitelist the internal app gateway subnet (where the application gateway instance private IP address) in the access restrictions of app service.