1

I have setup an Azure WAF, via the Azure Portal, to point to an App Service which has a custom domain. The App Service has 2 domain names:

  1. mysite.azurewebsites.com
  2. subdomain.mysite.com

When I select "Pick Hostname from backend address" for the Probe and the Backend HTTP Settings, the Custom domain is picked up. I am also using SSL and this is working. However weirdly when I get past my login page on the app, the Application Gatewoy/WAF seems to resort to using the mysite.azurewebsites.net url. I tried following the recommendation in the following link, but it does not work for me.

Azure WAF infront of Web App changes HostName

Ie I deselected "Pick Hostname from backend address" and put "subdomain.mysite.com" as the hostname. This works for the probe, but when I specifiy this for the hostname in HTTP Settings, I get "Update Failed" without any explanation.

Any thoughts please?

Thanks.

EDIT: If I change the CNAME to bypass the WAF and go direct to the App Service, it works fine.

EDIT2: This may be relevant. The URL gets rewritten post authentication. There are a few links on the login page and these have the correct custom domain in them. However once the user logs in, the app links gets rewritten to use *.azurewebsites.net as the suffix.

EDIT3: Another thought... Is the "Probe" path wrong? I am currently using "/"

From MS docs....

Path    / or another path   

The remainder of the full url for the custom probe. A valid path starts with 
'/'. For the default path of http://contoso.com just use '/'
SamJolly
  • 6,347
  • 13
  • 59
  • 125

1 Answers1

1

Just spoke with MS. You need to use the "FQDN" in the backendpool and not the "AppService" option.

SamJolly
  • 6,347
  • 13
  • 59
  • 125
  • The above sounds reasonable and logical, however there's either a bug or feature in the portal AND through powershell where, when you add a backend pool referencing an azure site using the FQDN, it just changes it to "App Service". This happens regardless of whether you choose FQDN through the UI, on creation or through powershell. I'm in the queue for a callback with MS right now and will identify this issue to them – Carson Wilson Feb 09 '19 at 00:15