Microsoft Azure Front Door is a content delivery network (CDN) service that offers application layer load balancing features. On the other hand, Azure cross-region Load Balancer serves as a global network layer load balancer. Lastly, Azure Traffic Manager operates as a domain name service (DNS)-based solution for distributing traffic.

Cross-region load balancer

Azure cross-region Load Balancer is designed to efficiently handle layer-4 traffic with minimal latency. It offers geo-proximity routing, ensuring that traffic from various locations is directed to the closest regional deployment. Moreover, the load balancer automatically handles failover, redirecting traffic to healthy regional deployments if any of them become unhealthy. Users benefit from a static globally anycast IP address, eliminating concerns about IP address changes.

Azure Front Door

Azure Front Door is a highly effective solution for achieving accelerated and resilient web application performance on a global scale, ensuring optimal delivery of both static and dynamic content. Here are the key features and benefits:

• Static Content: Leveraging Azure Front Door’s extensive network of 185 global edge points of presence (PoP) locations, static content can be efficiently served to clients. By utilizing the Anycast protocol, client requests are directed to the nearest edge location, ensuring high performance and resilience.
• Dynamic Content: Azure Front Door offers various traffic acceleration features. Traffic from clients to Azure Front Door PoPs is optimized through Anycast routing. For dynamic workloads, connections between edge PoPs and the customer’s origin are optimized using split TCP. This approach terminates the TCP connection at the nearest edge PoP and utilizes long-lived connections over Microsoft’s global private wide area network (WAN), reducing round-trip-time (RTT). In case of multiregional origin deployments, Azure Front Door employs health probes to fetch content from the least latent origin.
• SSL Offload and Layer 7 Routing: Azure Front Door supports SSL offload, enhancing performance. It is highly optimized for HTTP and web-based applications, providing layer 7 routing capabilities. Customers can utilize business routing and advanced routing within Azure Front Door, allowing for features such as routing requests based on client device type (e.g., mobile or desktop versions). Other features include path-based routing, fast failover, caching, and more.
• Integration and Security: Azure Front Door seamlessly integrates with other Azure services, such as DNS, Web App, and Storage, providing end-to-end solutions for application management. Additionally, it offers built-in support for various security products, enabling customers to protect their web applications with layer 3, 4, and 7 DDoS mitigation and Azure Web Application Firewall.

Use Azure Front Door to create powerful web applications by leveraging the integration of multiple Azure services while ensuring performance, scalability, and security.

Azure Traffic Manager

Azure Traffic Manager is a DNS-based traffic load balancer. It offers the flexibility to incorporate on-premises servers into the backend, enabling support for scenarios such as burst-to-cloud, failover-to-cloud, and migrate-to-cloud. It provides automatic failover and multi-region support, ensuring that traffic is served with minimal latency. DNS name resolution is fast, and results are cached to enhance performance. The speed of the initial DNS lookup depends on the client’s DNS servers for name resolution, typically completing within approximately 50 ms. The lookup results are cached according to the DNS time-to-live (TTL), with the default TTL for Traffic Manager set at 300 seconds (around five minutes). Additionally, Azure Traffic Manager offers geographic routing capabilities, allowing users to direct traffic to the appropriate backend instance based on the geographical location, thus assisting with geofencing requirements.

Synopsis table

References:

• Cross-region load balancer (preview) – Azure Load Balancer | Microsoft Learn
• Azure Traffic Manager | Microsoft Learn
• Azure Front Door | Microsoft Learn

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Global Distribution Solutions appeared first on Apostolidis Cloud Corner.

Azure Front Door Rules Engine is a new feature that gives you more control in how you define and enforce what content gets served from where. Rules Engine allows you to specify how HTTP requests are handled from the AFD. Different combinations of match conditions and actions give you fine-grained control over which users get which content and make the possible scenarios that you can accomplish with Rules Engine endless.

For example, you can use a match condition to:

• Filter requests based on a specific IP address, country, or region.
• Filter requests by header information.
• Filter requests from mobile devices or desktop devices.

The following match conditions are available to use in Front Door Rules engine:

• Device type
• Post argument
• Query string
• Remote address
• Request body
• Request header
• Request method
• Request protocol
• Request URL
• Request file extension
• Request file name
• Request path
• Standard operator list

How Rules Engine Works

The Rules Engine applies the routing roules at the Edge. Once the request is received from the AFD edge location, the Rules Engine routes it first through the WAF rules and right after it applies the route configuration. In the next picture, the Rules Engine desides if the request will redirected to the mobile site or it will be forwarded to the desktop site.

How to create a rules engine and add a rule

We will create a rule to redirect the requests to the Desktop or to the Mobile site, based on the clients device type.

Go to the Front Door, and select the “Rules engine configuration” at the Settings section. Press “+ Add” to create a rules engine.

Type a name for the Rules engine, and a name for the first rule. Once you press the “+Add a condition” a drop down menu will open with all the available condition types.

For our example I selected the “Device type” condition and I selected that the request is Equal to Mobile.

Then press the “+ Add an action” to view the available actions.

for our example I selected to forward the request to the /mobile.html, where is the mobile site.

Finally, you need to Associate the routing rule, by selecting the three dots at the right of the rule.

and select the front door that you want this rule to be applied.

References:
https://docs.microsoft.com/en-us/azure/frontdoor/front-door-rules-engine-match-conditions
https://docs.microsoft.com/en-us/azure/frontdoor/front-door-rules-engine-actions

You can find more AFD posts at my blog, like create an Azure Front Door to scale and secure our web apps, Azure Front Door add custom domain & certificate and we use Web Application Firewall (WAF) rules to protect our web apps.

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Front Door | Rules Engine appeared first on Apostolidis Cloud Corner.

Thank you all who attented my presentation at Sunday’s 29/3/2020 virtual Greek MVPs in Actions event.

My presentation was about the Azure Front Door Service and how you can use it to accelerate and protect your web applications.

You can view my presentation here

And you can see my video at my Youtube channel

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Greek MVPs in Action | Accelerate your web applications with Azure Front Door appeared first on Apostolidis Cloud Corner.

This is my third Azure Front Door Post. Already we created an Azure Front Door to scale and secure our web apps, and we used Web Application Firewall (WAF) rules to protect our web apps. At this post we will see how to add a custom domain name and our certificate to the Azure Front Door.

Azure Front Door provides ssl certificates and management for the .azurefd.net domain. But in most cases we will need to add our custom domain name and of cource our certificate.

To add a custom domain name and our certificate we need:

• The public certificate in PFX format
• Register the Azure Front Door Service Principal
• An Azure Key Vault
• Access to the Public DNS of our custom domain

Azure Key Vault

Azure Front Door imports custom certifiated only from Azure key Vault. So we need to create a Key Vault and provide access to the Azure Front Door Service Principal. First register the Azure Front Door Service Principal using this script: (I prefer cloud Shell)

New-AzADServicePrincipal -ApplicationId "ad0e1c7e-6d38-4ba4-9efd-0bc77ba9f037"

Result:

Then search the Marketplace and create a key Vault

At the first page fill the name and region and go to the Next Page, Access Policy and press “+ Add Access Policy” to add a new access policy. At the certificate permissions select the get secret & get & list certificates and authorities. For principal select the “Microsoft.Azure.Frontdoor” and add.

Next at the Network Connectivity method select all networks, or if you select selected networks remember to allow the Azure Front Door Bckend IP Range, 147.243.0.0/16. For updated IP range check the https://www.microsoft.com/download/details.aspx?id=56519

Once the Key Vault is ready, open it, go to Certificatess -> Generate/Import

Slect Import and upload your certificate.

Edit the Front Door

Once the certificate is uploaded successfully, go to the Azure Front Door designer. At the Frontend/domains press the + to add the custom domain

Write your custom host name and the form will inform you to create a CNAME to point to the front door. You need to do this first to proceed.

After that enable the Custom Domain HTTPS and select use my own certificate

Select the KeyVault, the certificate and the version and press add adn then Save.

The process will start, it will check the certificate and it will import it to the Front Door.

Now, since we have the SSL termination at the Azure Front Door, we can forward the request unencripted to our backend, this is called SSL Offload. To do this update routing rule to accept HTTPS only requests, select for frontends the custom domain and for backend forwarding protocol HTTP only

Then go to the Web App and turn off the HTTPs Only.

We can now check our web app at the custom domain: https://myapp.funniest.gr

Don’t forget, we have locked our backend web apps with access restriction to allow only the Front Doors backend IP range 147.243.0.0/16

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Azure Front Door add custom domain & certificate appeared first on Apostolidis Cloud Corner.

Create the WAF Rule

From the Azure Marketplace search for WAF and create a Web Application Firewall

At the “Create a WAF policy” wizard select “Global WAF (Front Door) for policy, provide the subscription and resource group, give a name for the policy and select if you want it to be created enabled or disabled.

At the next step select if the policy will prevent the action or just detect and report it. You can change this later too. You can provide a Redirect URL for rules that support redirection. The default status code is 403 but we can change it to e.g. 404. We can also add a custom response body.

The next step is the rule. We can select one or more predefined rule sets and then customize at will.

To customize, expand the rule set and select a rule. You can enable / disable the rule and you can change the action to Allow, Block, Lod or Redirect.

WAF Custom Rule

The next step is the custom rules. There’s a lot to customise here. First are the rule type settings. Select status of the rule, enabled or disabled. Select the Rule type between Match and Rate limit. If you select rate limit you will be prompt to set rate limit and threshold. The final rule tupe setting is to set the priority of the rule.

Next is the Conditions (If this) and the action (then that).
The condition can be Geolocation, IP address, Size or String. After selecting the Match Type the rest options are altered accordingly.

The action can be Allow traffic, Deny traffic, Log traffic only or Redirect traffic

For the demo I created a rule that will Deny all traffic from The Netherlands, because I can test it from an Azure VM located at the West Europe Region.

The next step is to associate the rule to the Front Door. After that assign Tags if needed and create the rule.

Once the Rule is ready, a “Front Door WAF policy” resource will be at the selected Resource Group.

Inside the Front Door, at the Web application firewall section, you can review the assigned rules.

The below diagram shows the current setup. The user cannot access the Azure Web Apps directly, only through the Front Door and the requests are filtered by WAF rules.

Test 1

From an Azure VM at West Europe Region, I tried to access the Front Door’s URL and we can see my custom 403 body text!

Test 2

From my Computer I tested a typical SQL Injection attack from https://www.owasp.org/index.php/Testing_for_SQL_Injection_(OTG-INPVAL-005) . Again my custom 403 page!

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Use Web Application Firewall (WAF) Rules with the Front Door to protect your app appeared first on Apostolidis Cloud Corner.

There is a big buzz out there about Azure Front Door.  Is it a Load Balancer? A CDN? A Traffic Manager? A Web Application Firewall ? A Reverse Proxy? An Application Gateway?

So, what is Azure Front Door?

Azure Front Door actually is all the above and more. It is a global service, that routes web traffic based on performance and availability. A Layer 7 multi-region load balancer with Web Application Firewall (WAF) capabilities, DDoS protection & CDN.

Azure Front Door is the entry point, the edge, of all Microsoft’s WAN. All Microsoft services, like Office 365 & Bing, are using Azure Front Door.

The services that Azure Front door provides are:

• Accelerate application performance
• Increase application availability with smart health probes
• URL-based routing
• Multi-site hosting
• URL redirection
• Session affinity
• SSL termination
• Custom Domain & certificate management
• Security via custom WAF rules
• DDoS protection
• URL rewrite
• IPv6 and HTTP/2 support

At Azure Front Door documentation there is a paragraph that can help to understand the difference between Azure Front Door and other publishing / load balancing Azure solutions and where to use each.

Azure provides a suite of fully managed load-balancing solutions for your scenarios. If you are looking for a DNS based global routing and do not have requirements for Transport Layer Security (TLS) protocol termination (“SSL offload”) or per-HTTP/HTTPS request, application-layer processing, review Traffic Manager. If you are looking for load balancing between your servers in a region, for application layer, review Application Gateway and for network layer load balancing, review Load Balancer. Your end-to-end scenarios might benefit from combining these solutions as needed.

For pricing information, see Front Door Pricing.

How to scale your web apps with Front Door

Create two simple Azure Web apps. Check this guide for a simple guide on how to create Azure App Service: https://www.e-apostolidis.gr/microsoft/azure/azure-start-point-your-first-web-app/

One at West Europe:

and one at North Europe:

Using FTP, I deployed an one-page html site at both regions. I change the text of both site to say “This Web Site is located at North Europe Azure Datacenter”

and “West Europe” to the other.

Then create a Front Door. Search for Front Door at Azure marketplace and Create one.

This is a high level diagram of the Front Door with two Web Apps design that we will create

The “create a Front Door” wizard will start and we can configure it step by step. First we will create a Frontend host by clicking the + at the Step 1

At the frontend host we will create the URL that our apps will be available. I added the papostolidis.azurefd.net. of course later you can add your custom domain and add a CNAME to route the traffic to the Front Door.

Then, at the Backend pools (Step 2), press the + to add the web apps. add a name for the backend pool, like “myapps” and press + ADD a backend to add the apps.

Select host type, you can add app service, cloud service, storage and custom host (URL). I selected the app service.

Select the subscription and the app service and add the correct ports for http and https traffic.

The priority defines if the traffic will be routed to the host with the lower priority number (e.g. 1) and if that host fails will route to the next host with bigger priority number (e.g. 2). If you add the same priority to more than one host then it will follow the weight number.

The weight number defines the percentage of requests that will be routed to each host.

The same way add the second web app

Finally select a path, protocol and interval for the probe that will do health checks to the app to define if it is active or not.

The third step is to add the routing rules. At the routing rules you can specify:

• The accepted protocol, http or https.
• the frontend host for this rule
• the patterns that the route will accept, like www.e-apostolidis.gr/mysite/* or just /* ro root.
• Route type forward or redirect.
• The backend pool that this rule will direct the traffic
• The protocol that the traffic will be forwarded. Here we define the SSL Offload if we select HTTPs for frontend accepted protocol and HTTP for backend.
• URL Rewrite rules
• Caching, for static content caching like CDN.

Once all steps are completed we can move on and create the Front Door

When the Front Door is ready, we can see the URL at the Overview.

And browse our web app using the Front Door URL:

How to protect your web apps with Front Door

Right now we scaled our web apps. If we use each app’s URL we can still access the app. The first security step is to lock the web apps to be accessed only through the Front Door URL.

Checking the Azure Front Door FAQ page, https://docs.microsoft.com/en-us/azure/frontdoor/front-door-faq it lists the Front Door’s address rance.

Front Door’s IPv4 backend IP space: 147.243.0.0/16

Go to the App Service, at the Networking section, select “Configure Access Restrictions”

Add an allow access restriction with the IP range of the Front Door.

Automatically a Deny rule will be created for everything else.

Add the rule to both web apps and then try to access the apps with their direct links.

Now on, we can access the apps only by using the Front Door URL:

This is a high level diagram after the restrictions

At the next article, we will see how to add Web Application Firewall (WAF) Rules to Front Door, Stay Tuned!! 

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Securely scale your Web Apps with Azure Front Door appeared first on Apostolidis Cloud Corner.