Forum Discussion
CirrusAzure application gateway as backend pool of F5 VS
Hi All,
I am facing an issue with the below setup and need some guidance.
Architecture:
Internet Client → F5 VIP → Azure Application Gateway (Internal IP) → Backend Application
The requirement is to publish the application through F5, where the backend pool member is the internal IP address of an Azure Application Gateway.
Issue:
If I configure the F5 pool health monitor as TCP, the pool member becomes UP.
If I configure the health monitor as HTTP or HTTPS, the pool member remains DOWN.
Accessing the Azure Application Gateway directly (using its internal IP and required hostname) works successfully.
The issue only happens when traffic passes through F5.
SSL/TLS Configuration:
SSL certificate is configured on F5 VIP.
The same application certificate is also configured on Azure Application Gateway listener.
Hostname used by the application
We have already tried server SNI configuration on F5 and multiple SSL profile settings, but the issue is not resolved.
Troubleshooting already performed:
Verified Azure Application Gateway backend configuration.
Confirmed Application Gateway listener and certificate are working when accessed directly.
Tested F5 TCP health monitor successfully.
Tested HTTP/HTTPS monitors from F5, but they fail.
Raised a case with F5, and they advised checking from the Azure Application Gateway side.
Appreciate your support.
Issue has been resolved after adding a route for F5 Self IP in application gateway subnet route table in azure . The return traffic was not reaching to F5 . All good now.
Thanks team.
5 Replies
Hello Sanal_Babu
the most obvious question is why do you need the Application Gateway?
Do you have any logs from the failing monitor?
Did you tried a curl? and if so what was the curl command and what response did you got?
- zamroni777
MVP
big ip is application layer oriented.
work with the app team.
get a successful "curl -vk https..." then configure the monitor accordingly Hi,
If u Conatact with F5 Support that means,
you Took Packet capture for a client and F5 Support confirmed that F5 BIGIP delivers traffic from Client and forward it to "Azure Application Gateway".
Did you try to remove monitors and take Packet capture and see if F5 BIGIP forward traffic to this "Azure Application Gateway" pool or not, and what is the response if you receive from it.
Also have you tested "curl -vvvk http/s://<Azure Application Gateway>" have you received any output ?thanks
- Melissa_C
Moderator
Hello Sanal_Babu
I see you got some responses and would like to encourage you to provide an update if they assisted or if you need further help.
Sanal_BabuIssue has been resolved after adding a route for F5 Self IP in application gateway subnet route table in azure . The return traffic was not reaching to F5 . All good now.
Thanks team.
