[MUSIC].
>> Hey, I'm Cat and I'm a Program Manager here
at Azure Networking on the Application Gateway team.
Today I'll be talking to you about how to deliver
secure and scalable web applications
with Azure Application Gateway. Let's jump into it.
Our agenda for today,
we'll start by covering
Azure Networking's portfolio of
all the different services that we offer.
Then we'll focus in on Application Gateway
specifically and go over,
what is Application Gateway?
What can it be used for?
What are some of the main selling points of Application Gateway?
Then we'll be going into some of the key features as
well as latest features that we have on Application Gateway.
Finally, I'll wrap up with
some reference architecture on
how do you use Application Gateway with
all these other different Azure services and
Azure Networking Services to achieve secure,
scalable, global application delivery?
To start things off with Azure Networking,
there are a number of services,
and they all fall under
four different pillars in Azure Networking.
They either help with connection or protection,
monitoring or delivery, and
Application Gateway falls under the delivery category.
If we focus in on applicant or on
delivery in general in Azure Networking,
we can see that there are a variety of products that you
can use for application delivery.
The first one being Application Gateway,
which is the layer 7, regional load balancer.
Azure Front Door is a layer 7 global load balancer.
Azure CDN is great for static content delivering.
The Web Application Firewall or WAF is perfect
for protecting your applications at the layer 7 level.
Azure Load Balancer and Azure Traffic Manager will help you load
balance traffic through applications at the layer 4 level.
What is Application Gateway?
Application Gateway is a layer 7 Cloud-native load balancer,
and whether you're collecting or analyzing telemetry from
your IoT devices or you're hosting a very commercial website,
Application Gateway is very
flexible and is able to support a variety
of workloads and can be tailored to meet your needs.
Application Gateway is a highly available zone-redundant service,
which means you don't have to worry about
your service ever being not reachable.
The fact that Application Gateway is also scalable,
means that you don't have to worry about not having
enough space on your Application Gateway to serve
all the traffic that needs to reach your application.
Application Gateway can be deployed with
a public or private IP or both,
depending on what your security requirements
are or what the use case for the Application Gateway is,
and it will always be deployed with a static IP address.
One of the main benefits of
Application Gateway and what gives it its flexibility is
its variety of back-ends that you can
use are behind the Application Gateway.
Let's say you have a legacy application
that you're still running on-premises,
you can send traffic through
the Application Gateway back on on-premises.
But let's say you also have some new application
running in Azure Kubernetes Service and AKS cluster,
or in a more traditional VM scale set.
Application Gateway can also load
balance traffic between all those different
back-ends through one entry point.
Application Gateway also supports
Azure app services as a back-end.
In general, the combination of this
allows Application Gateway to be extremely
flexible and support a wide variety of
unique environments that are unique to you.
Security is also very important in application delivery as well.
Application Gateway is able to
handle SSL re encryption as well as,
you can select which SSL policy you
want to use on Application Gateway.
So that offers additional protection to make sure that any traffic
going to and from
your Application Gateway is fully secure and encrypted.
Application Gateway we also have
a built-in native Web Application Firewall or WAF,
which I'll be talking more about in an upcoming slide.
WAF allows you to protect your layer-7 HTTP traffic from attacks.
In general, just offers
additional protections to your application.
Application Gateway is also great for
handling SSL offload and takes the burden off of
your back-ends and is able to process that
and optimize your traffic for your customers even better.
Now that we've seen some of the key features and
benefits of using Application Gateway,
let's look at the configurable components
of the layer 7 load balancing itself.
Some of the knobs that you're
able to configure on the Application Gateway.
If you look at the diagrams on the right,
you can see the Application Gateway allows you to load balance
based on the URL path itself or on the host name or domain name.
We've actually recently added wildcard listeners in the host name,
so I'll be speaking to that in an upcoming slide.
Application gateway load balances traffic
to your back-ends via round robin.
It also allows for session affinity via
cookies for you to further optimize your traffic.
If you need redirection on your application,
Application Gateway supports this as well.
Application Gateway also allows you to
adjust or rewrite some components of requests coming in,
such as the header and the URL.
The URL rewrite is actually a feature that
I'll be talking about in an upcoming slide as well.
With websocket and HTTP/2
traffic support on your Application Gateway,
this allows you to even further
optimize your workloads on
Application Gateway by reusing connections.
With connection draining, you
never have to worry about requests getting drops if
you're making any changes or upgrades to
your back-ends as Application Gateway will make sure
to fully connection drain
before any changes are made to your back-end.
Finally, if you or your customer,
which ever run into any problems with
Application Gateway or your back-ends,
we allow for custom error pages so that your customers or you
won't get a blank error page and not know what happened.
Also makes this more customizable for your needs as well.
It's awesome to see that there are
so many different configurable knobs on
the Application Gateway in terms of the layer 7 load balancing,
but one of the main benefits of Application Gateway is it's
auto-scaling capabilities as well as its performance.
You are able to set the minimum number of instances
and maximum number of instances on the Application Gateway.
With auto-scaling turned on,
the minimum number of instances will be
guaranteed to always be running on Application Gateway
and as your traffic fluctuates
throughout the day or a period of time.
Application Gateway will be able to detect
that influx of traffic and then scale
out to the maximum number of instances,
and then scale back in once traffic has died back down.
This reduces overall operational costs,
because you don't have to worry about manually scaling up
your gateway once you do have a spike in traffic.
Also eliminates the need
to potentially over-provision your gateway.
Or also we have to guess
how many instances you want your gateway to have.
Additionally, Application Gateway has
very strong performance characteristics,
we're able to handle SSL offloads very
effectively and we're able to serve 50,000 connections per second,
up to three million persistent connections,
and up to 250,000 requests per second.
All of these, combined with
the HTTP layer 7 load balancing capabilities,
offers you a very configurable application delivery service.
But let's focus in on the security part as well now.
Now that we understand the Layer 7 Load Balancing capabilities
and how Application Gateway
works and the ability for it to AutoScale,
let's look at security since security is also
incredibly important for delivering applications.
Application Gateway has a built-in WAF
or web application firewall capability.
Here on the diagram on the right,
you can see that with WAF policy,
you can define OWASP rules,
or you can use Bot Management rule sets,
or you can create custom rules of your own.
The benefit of this WAF policy,
since it's a top-level Azure resource,
is that you can use this WAF policy at
your Application Gateway or on your Azure Front Door,
and this provides a uniform layer
of protection at the edge and at the regional level.
You might have noticed that I mentioned
the Bot Management protection rule set,
and this basically leverages Microsoft Threat Intelligence so
that your WAF will detect whether or
not an incoming request is coming
from a known IP or unknown bot,
and it will automatically block
those requests from your application.
Geo-filtering is also incredibly useful
on Application Gateways WAF.
This allows you to filter traffic,
either explicitly allow or explicitly deny traffic
coming from specific countries to your Application Gateway.
Finally, this WAF policy doesn't have to
only be applied at your entire App Gateway level,
you can also apply this WAF policy on a per site
or a per URI path level which allows
you even further granular control of how you want to secure
your backend application or your overall application,
and just provides more configurable security
to meet whatever needs that you might have.
Another really cool additional benefit
of using Application Gateway is that you can
leverage Azure Kubernetes Service
with the Application Gateway Ingress Controller.
The Application Gateway Ingress Controller
lives in the AKS cluster as a pod.
However, it offers improved performance benefits
over traditional in-cluster Ingress Controllers.
As you can see the diagram on the right,
the App Gateway Ingress Controller is not in
the data-path between the Application Gateway and AKS pods.
Traditional Ingress Controllers generally sit
between a load balancer and the Kubernetes pods.
However, because the Application Gateway Ingress Controller
configures App Gateway to talk directly to the pods,
you save an extra hop in the middle.
We've also recently released
this Application Gateway Ingress Controller as
an AKS add-on which allows
for one-line deployment in Azure CLI of
the cluster add-on and Application Gateway all at once.
This is a significant improvement over having
to deploy those three separate components,
especially via helm previously before.
This add-on is a fully supported and fully managed feature.
You never have to worry about upgrading
the version of this Application Gateway Ingress Controller,
and because it's fully supported,
you can be sure that Microsoft will be able to
support if anything does occur.
Now that we've covered some of
the main benefits of using Application Gateway and
how configurable and easy to adapt to your environment it is,
I want to talk about some of the latest features that
we've added on Application Gateway.
Wildcard Listener and URL Rewrite are both features that
were highly requested from customers like you,
and we're super excited to announce
that you will finally be able to use them.
Wildcard Listener allows you to use
a wildcard characters such as an asterisk
or a question mark in your host name,
on your Application Gateway,
and you're able to configure up to five host names
per multi-site listeners with this wildcard listener.
For URL Rewrite, you're able to re-write the host name
or the path or the query string of the incoming request URL,
and you're also able to choose if you want
to rewrite the URL of all incoming requests on a listener or not.
Ultimately, when you're deciding
how to route this request to the backend,
you can also choose to use either the original URL
or the rewritten URL when
you're routing the requests to the back-end.
Now that we have a pretty good understanding
of what you can do with Application Gateway,
you might be wondering,
how do I use Application Gateway with
all these other Azure networking and Azure services in general?
This reference architecture is essentially
one permutation of how do you use these services together
to meet the objective of secure global application delivery.
In this example, let's say you have
Layer 7 HTTP traffic that you want to protect,
and you also have non-HTTP traffic that you want to protect.
For the HTTP layer 7 portion,
you'll first set up an Azure Front Door with WAF enabled,
and then you'll set up an Application Gateway with
WAF enabled as well behind the Azure Front Door.
Behind the Application Gateway,
you can set up your workloads as needed, your back-ends,
whether it be in AKS cluster or VMSS,
it could be a mix of both or either or.
There are many benefits of using
Azure Front Door and in the series with Application Gateway,
especially with the firewall enabled on both levels.
With Azure Front Door,
it's able to support high availability and fail-over scenarios,
especially if this is a global application and you
have multiple Application Gateway support across multiple regions.
Azure Front Door is especially good for
fail-over scenarios in that case.
Azure Front Door also accelerates
the application delivery since it sits at the edge,
and also because Azure Front Door
maintains a warm connection with the Application Gateway.
Some responses might even be cached at the Azure Front Door level,
and therefore, the requests don't even make it to
the Application Gateway and improves
your customers end experience.
It's important to have WAF enabled at both levels,
because WAF at the edge protects
against different attacks than WAF at the regional level,
and so having both enabled offers you twice the protection
as if you only had one WAF at the edge or the regional level.
Now that we've secured our layer 7 traffic,
let's look at how do we secure
our non-layer 7 or non-HTTP traffic.
In this example, let's say you want to serve
traffic from Azure Storage and Azure SQL database,
and you want to make sure that you want
to secure what is able to come in and go out of these services.
You would now deploy an Azure firewall in front of
these services in parallel with
your Azure Front Door and Application Gateway.
Azure Storage and Azure SQL database
might be working behind the scenes with
your application on your VMSS or your AKS cluster.
But for security, especially for data exfiltration scenarios,
adding a firewall in front of storage and
SQL database will help really protect
your non-HTTP traffic where
Azure Front Door and Application Gateway will
protect your HTTP traffic.
Finally, because Application Gateway
offers integration with Azure Key Vault,
you can store all your secrets
and certificates in Azure Key Vault,
and just use them on the Application Gateway.
This completes the entire picture
of secure global application delivery.
Thank you so much for joining me in this session.
[MUSIC]
>> I hope you learned a lot about
Application Gateway and are as excited as I
have to use Application Gateway
or continue using Application Gateway.
I'm super excited to see you again next
time and thanks again for joining.
[MUSIC]