0

We have an Azure App Service in the UKSouth region hosting a .NET 6 Web Application with no public access and using a Private Endpoint on a UKSouth VNet.

The same Web Application is also hosted in another Azure App Service in the UKWest region again behind a Private Endpoint on a UKWest VNet.

We are using Azure Front Door and in the event of an entire regional outage of UKSouth we want it to redirect traffic to the lower priority UKWest origin for the Azure App Service.

While setting up the UKWest Origin I noticed that for App Services behind a private link the UKWest region wasn't available and the prompt indicated you should choose your target region or the next closest (UKSouth).

My concern is this is all completely pointless as if the private endpoint configured by Azure behind the scenes for our UKWest App Service Origin is in the UKSouth region then surely in a regional outage of UKSouth scenario that private link/endpoint would be unavailable leaving our UKWest App Service unreachable.

I am sure I have misunderstood how this works as MS can't possibly have rendered Azure Front Door useless for failover use cases where private endpoints (Which they encourage you to use) are setup.

Any advice would be greatly appreciated and if my understanding is correct solutions would be appreciated. I am assuming either publicly exposing the App Services or using Application Gateways behind a Traffic Manager instead which is much more costly.

user2997206
  • 50
  • 6

1 Answers1

0

If the Front Door private link to UKWest is unavailable one solution would be to relocate your secondary origin's web app to a region that has support for the Front Door private link. If that option doesn't work for you you could mitigate some of the risk by hosting your web app in an availability zone (supported in UK South) to ensure resiliency. There's always a chance there could be a region-wide event that would take down your web app that wouldn't affect a second distinct region.

Narthring
  • 1,124
  • 18
  • 32