Skip to content

Commit e68ae80

Browse files
committed
more tweaks
1 parent 174dbfe commit e68ae80

File tree

1 file changed

+15
-10
lines changed

1 file changed

+15
-10
lines changed

articles/application-gateway/application-gateway-troubleshooting-502.md

Lines changed: 15 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ ms.author: amsriva
1111

1212
# Troubleshooting bad gateway errors in Application Gateway
1313

14-
Learn how to troubleshoot bad gateway (502) errors received when using application gateway.
14+
Learn how to troubleshoot bad gateway (502) errors received when using Azure Application Gateway.
1515

1616
[!INCLUDE [updated-for-az](../../includes/updated-for-az.md)]
1717

@@ -39,10 +39,11 @@ Similarly, the presence of a custom DNS in the VNet could also cause issues. A F
3939
### Solution
4040

4141
Validate NSG, UDR, and DNS configuration by going through the following steps:
42-
* Check NSGs associated with Application Gateway subnet. Ensure that communication to backend isn't blocked.
43-
* Check UDR associated with Application Gateway subnet. Ensure that UDR isn't directing traffic away from backend subnet - for example check for routing to network virtual appliances or default routes being advertised to Application Gateway subnet via ExpressRoute/VPN.
4442

45-
```powershell
43+
* Check NSGs associated with the application gateway subnet. Ensure that communication to backend isn't blocked.
44+
* Check UDR associated with the application gateway subnet. Ensure that the UDR isn't directing traffic away from the backend subnet. For example, check for routing to network virtual appliances or default routes being advertised to the application gateway subnet via ExpressRoute/VPN.
45+
46+
```azurepowershell
4647
$vnet = Get-AzVirtualNetwork -Name vnetName -ResourceGroupName rgName
4748
Get-AzVirtualNetworkSubnetConfig -Name appGwSubnet -VirtualNetwork $vnet
4849
```
@@ -70,7 +71,11 @@ If present, ensure that the DNS server can resolve the backend pool member's FQD
7071

7172
### Cause
7273

73-
502 errors can also be frequent indicators that the default health probe isn't able to reach back-end VMs. When an Application Gateway instance is provisioned, it automatically configures a default health probe to each BackendAddressPool using properties of the BackendHttpSetting. No user input is required to set this probe. Specifically, when a load-balancing rule is configured, an association is made between a BackendHttpSetting and BackendAddressPool. A default probe is configured for each of these associations and Application Gateway starts a periodic health check connection to each instance in the BackendAddressPool at the port specified in the BackendHttpSetting element. Following table lists the values associated with the default health probe.
74+
502 errors can also be frequent indicators that the default health probe can't reach back-end VMs.
75+
76+
When an application gateway instance is provisioned, it automatically configures a default health probe to each BackendAddressPool using properties of the BackendHttpSetting. No user input is required to set this probe. Specifically, when a load-balancing rule is configured, an association is made between a BackendHttpSetting and a BackendAddressPool. A default probe is configured for each of these associations and the application gateway starts a periodic health check connection to each instance in the BackendAddressPool at the port specified in the BackendHttpSetting element.
77+
78+
The following table lists the values associated with the default health probe:
7479

7580
| Probe property | Value | Description |
7681
| --- | --- | --- |
@@ -86,7 +91,7 @@ If present, ensure that the DNS server can resolve the backend pool member's FQD
8691
* The call to `http://127.0.0.1:port` should return an HTTP result code of 200. This should be returned within the 30-second timeout period.
8792
* Ensure that the port configured is open and that there are no firewall rules or Azure Network Security Groups, which block incoming or outgoing traffic on the port configured.
8893
* If Azure classic VMs or Cloud Service is used with a FQDN or a public IP, ensure that the corresponding [endpoint](../virtual-machines/windows/classic/setup-endpoints.md?toc=%2fazure%2fapplication-gateway%2ftoc.json) is opened.
89-
* If the VM is configured via Azure Resource Manager and is outside the VNet where Application Gateway is deployed, a [Network Security Group](../virtual-network/security-overview.md) must be configured to allow access on the desired port.
94+
* If the VM is configured via Azure Resource Manager and is outside the VNet where the application gateway is deployed, a [Network Security Group](../virtual-network/security-overview.md) must be configured to allow access on the desired port.
9095

9196
## Problems with custom health probe
9297

@@ -100,7 +105,7 @@ The following additional properties are added:
100105
| --- | --- |
101106
| Name |Name of the probe. This name is used to refer to the probe in back-end HTTP settings. |
102107
| Protocol |Protocol used to send the probe. The probe uses the protocol defined in the back-end HTTP settings |
103-
| Host |Host name to send the probe. Applicable only when multi-site is configured on Application Gateway. This is different from VM host name. |
108+
| Host |Host name to send the probe. Applicable only when multi-site is configured on the application gateway. This is different from VM host name. |
104109
| Path |Relative path of the probe. The valid path starts from '/'. The probe is sent to \<protocol\>://\<host\>:\<port\>\<path\> |
105110
| Interval |Probe interval in seconds. This is the time interval between two consecutive probes. |
106111
| Time-out |Probe time-out in seconds. If a valid response isn't received within this time-out period, the probe is marked as failed. |
@@ -111,7 +116,7 @@ The following additional properties are added:
111116
Validate that the Custom Health Probe is configured correctly as the preceding table. In addition to the preceding troubleshooting steps, also ensure the following:
112117

113118
* Ensure that the probe is correctly specified as per the [guide](application-gateway-create-probe-ps.md).
114-
* If Application Gateway is configured for a single site, by default the Host name should be specified as `127.0.0.1`, unless otherwise configured in custom probe.
119+
* If the application gateway is configured for a single site, by default the Host name should be specified as `127.0.0.1`, unless otherwise configured in custom probe.
115120
* Ensure that a call to http://\<host\>:\<port\>\<path\> returns an HTTP result code of 200.
116121
* Ensure that Interval, Timeout, and UnhealtyThreshold are within the acceptable ranges.
117122
* If using an HTTPS probe, make sure that the backend server doesn't require SNI by configuring a fallback certificate on the backend server itself.
@@ -120,7 +125,7 @@ Validate that the Custom Health Probe is configured correctly as the preceding t
120125

121126
### Cause
122127

123-
When a user request is received, Application Gateway applies the configured rules to the request and routes it to a back-end pool instance. It waits for a configurable interval of time for a response from the back-end instance. By default, this interval is **20** seconds. If Application Gateway does not receive a response from back-end application in this interval, the user request gets a 502 error.
128+
When a user request is received, the application gateway applies the configured rules to the request and routes it to a back-end pool instance. It waits for a configurable interval of time for a response from the back-end instance. By default, this interval is **20** seconds. If the application gateway does not receive a response from back-end application in this interval, the user request gets a 502 error.
124129

125130
### Solution
126131

@@ -176,7 +181,7 @@ BackendAddressPoolsText:
176181

177182
### Cause
178183

179-
If all the instances of BackendAddressPool are unhealthy, then Application Gateway doesn't have any back-end to route user request to. This can also be the case when back-end instances are healthy but don't have the required application deployed.
184+
If all the instances of BackendAddressPool are unhealthy, then the application gateway doesn't have any back-end to route user request to. This can also be the case when back-end instances are healthy but don't have the required application deployed.
180185

181186
### Solution
182187

0 commit comments

Comments
 (0)