Search code examples
azureazure-web-app-servicecertificateazure-application-gatewayapp-service-environment

How to add an app service to Azure Gateway having an ASE

I have a new app service to deploy to an existing Azure App Gateway which already manages some app services. After copying the configuration of those others applications, I found that the new app service is unreachable from external calls while all others are and I'm struggling to find out why. The custom certificate and custom domain binded to the app service seems fine : enter image description here

I can see in the backend pool the new app rule : enter image description here

the http setting is set, the same way as the other applications, with the certificates of the ASE : enter image description here

The new listener appears in the Frontend Ip configuration: enter image description here

The listener is set and linked to its rule and hostname: enter image description here

the rule is set : enter image description here

The probe is set as well and the Health Check gives me a green status for the app. I can see in App Insights of the app service the pings from the health probe succeeding, so the gateway can communicate with the app.

But when I try from an outside source (postman or browser) I get an Error: getaddrinfo ENOTFOUND.

Did I miss a step? Does that mean that the domain has not been set correctly? Something else? (sorry, probably too many screenshots)

Thanks for any help

Solution

  • • You may not be able to access the app service from outside source or internet because you need to have DNS entries for your ASE (Application Service Environment) so that the deployment task can reach it; but if you have an internal only ASE, those entries aren't created in public DNS, and Microsoft doesn't manage private DNS. Thus, Microsoft proposes creating the DNS entries in your internal DNS zone as below: -

      Create Zone {ASE Name}.appserviceenvironment.net
  Type: Primary Zone
  Store the zone in AD: True
  Zone Replication: To all DNS servers in the domain
  Zone Name: {ASE Name}.appserviceenvironment.net
  Allow only secure updates: true

  Create A Record under {ASE Name}.appserviceenvironment.net
  Name: *
  IP: {ASE's Private IP}

  Create Child Zone under {ASE Name}.appserviceenvironment.net
  Name: scm

    • Please check whether the FQDN for the app service is present or not and the IP mapped to the ASE alone won't work since all apps on the ASE will have the same IP as we need for hostname resolution. Since you have an application gateway in front of the app service, and you have multiple app services hosted behind the same application gateway which are resolved to FQDN. And this fails since the application gateway can’t resolve FQDN to an IP, so the DNS needs to be updated.

    I would also suggest you to please go through the below documentation link for detailed information on DNS configuration regarding the ASE deployed: -

    https://learn.microsoft.com/en-us/azure/app-service/environment/create-ilb-ase#dns-configuration