Azure Private Link and Azure Front Door

[@JakubJakacki74]

This solved my problem with HTTPS at the origin side. Thank you!

[@Marcelk86]

Adam, you are excellent in explaining in a structured way! Looking forward for more content!

[@jinbaoxin]

Fantastic contents, I like your methodological way of explaining things, keep it up, cannot wait for you next video.

[@asadmahmand1091]

Fantastic video, very nicely explaind.

[@amglover4361]

Thank you for explaining that so clearly

[@paddee2k]

Excellent content! Thank you Adam!

[@rsutube-dec]

Thanks for the video. I have a question if you can please help me in my situation where I have an IIS hosting multiple sites with bindings. How do I set up my front door and its origin etc.? And site names are similar with app name and then environment name and they all resolve to the pip of the VM.

[@pdaniaful]

Just investigating this option for an Azure app service backend app but it looks like I need to upgrade from Afd standard to premium to take advantage of the private link option. Will Azure Front door make use of an existing private endpoint that is has already been setup or does it have to create the managed vnet and pls?

[@rsutube-dec]

I have posted my question twice but I do not see it after refresh? Is something wrong?

[@liamobrien1506]

Great video and content. I have a question, do you see a way of inserting an NVA (Palo Alto) somewhere in the path, perhaps using something like azure gaeway load balancer? I am currently working on designing inbound traffic patterns for a variety of services on our Azure edge, both WAF and a NVA are requirements in that path.

[@AdamStuart1]

Hi Liam. If you mean AFD > NVA > Backend. Then yes, you could do that either with or without Private Link. Without Private Link you would define the Origin as the Palo Alto PiP, probably attached to an external LB. With Private Link, you would map a PLS to a SLB in front of the NVA. Hope this helps. (Normally in this scenario Palo/NVA is performing the function of a reverse proxy also, as the regional ADC).

[@spop1974]

Perfect!

[@timeverts]

Great video. I have a question though. If using Front Door's private link (Microsoft Managed VNET) to protect an App Service and deploying changes to that App Service using an Azure Devops Pipeline, how do I give permission to the Microsoft Hosted Agents to deploy code to the app service? With the private link in place there is no permission to deploy to the app service, as it is not publicly accessible.

[@AdamStuart1]

Not something I've looked in to, this thread looks similar to your question - stackoverflow.com/questions/64845673/deploy-app-service-with-private-endpoint-via-azure-devops

[@kevinyang4141]

Is there a need for private DNS zone?

[@windyearle]

But we can't use this if our origins are in an unsupported region, like West US ?

[@carloseduardorodriguesdeal716]

How could i use AFD Premium with my AKS Cluster?

[@wenshuohan8370]

I am trying afdx -> pl - > app service -> regional vnet integration -> pl - > azure sql. Is it possible?

[@AdamStuart1]

Yes should work

[@rsutube-dec]

Thanks for the video. I have a question if you can please help me in my situation where I have an IIS hosting multiple sites with bindings. How do I set up my front door and its origin etc.? And site names are similar with app name and then environment name and they all resolve to the Private IP of the VM.