search

MicrosoftDocs / azure-docs

Open source documentation of Microsoft Azure
https://docs.microsoft.com/azure
Creative Commons Attribution 4.0 International
10.27k stars 21.45k forks source link

What are Application Gateway tiers "Standard V2" and "WAF V2"? #15279

Closed richardcox13 closed 6 years ago

richardcox13 commented 6 years ago

While listed when creating an application gateway, they are not documented. Nor do they appear in the pricing information.

What are they? What do they cost?

And what is the difference between the SKU size of application gateway?

Document details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

TravisCragg-MSFT commented 6 years ago

@richardcox13 Thanks for the feedback! I am gathering what information I can, and will update you soon.

jeffwmiles commented 6 years ago

The tooltip found upon the Tier setting of a deployed Standard V2 or WAF V2 states "The Standard_v2 and WAF_v2 tiers support availability zones. Changing from the WAF_v2 tier to the Standard_v2 tier is not supported."

So at a minimum, this is the change in V2; hopefully from a WAF perspective, there are more features involving additional intelligence and vulnerability updates beyond the static OWASP top 10.

shahiddev commented 6 years ago

Can we get an update on what these V2 versions are, their pricing and if they are in preview?

vhusker commented 6 years ago

Agree with what everyone else has said. Went to deploy a PoC for a customer today and noticed this as well and couldn't find anything documented. Additionally there is no tooltip in the Tier section anymore and instead an Availability Zone drop box appears at the bottom of the setup page. Would really like to see some documentation about the v2 versions for both types of application gateways.

Sulster commented 6 years ago

I don't know if I was doing something massively wrong, but it seems WAF_v2 won't accept .cer files when setting HTTPS Settings.

nhuntwalker commented 6 years ago

Ditto on the previous comment. The specific error that I've gotten when trying to use a .cer file with HTTP Settings in a WAF v2 was:

Application Gateway /subscriptions/<subscription ID>/resourceGroups/<resource group name>
/providers/Microsoft.Network/applicationGateways/<gateway name>
does not support AuthenticationCertificates for the selected SKU tier WAF_v2.
Supported SKU tiers are Standard,WAF.
AvinashReddyVaka commented 6 years ago

@Sulster Any work around to this issue?? Even i am getting the same error message as "app-gateway does not support AuthenticationCertificates for the selected SKU tier WAF_v2. Supported SKU tiers are Standard,WAF".

AvinashReddyVaka commented 6 years ago

The main difference between older tiers and _V2's is _v2's support static frontend public ip address.

Sulster commented 6 years ago

@AvinashReddyVaka Nope, I've tested with a few servers and sites and in the end I have had to use the older tier of WAF when End to End SSL was required. I use WAF_v2 for when I can get away with only SSL offloading.

bsnehanshu commented 6 years ago

Also, Version 2 ( WAF of Standard) Application Gateway seems to be present only in new locations ( for eg: East US 2, West US 2, Singapore, etc) when it will be available for South East Australia

vhorne commented 6 years ago

@richardcox13 The v2 SKU is documented here: https://docs.microsoft.com/azure/application-gateway/application-gateway-autoscaling-zone-redundant

Using certs with the v2 SKU is documented here: https://docs.microsoft.com/azure/application-gateway/ssl-overview#end-to-end-ssl-with-the-v2-sku

vhorne commented 6 years ago

please-close

TravisCragg-MSFT commented 6 years ago

@richardcox13 Thanks for the feedback! I have assigned the issue to the content author to evaluate and update as appropriate.

manikandan5555 commented 5 years ago

Hi All, any solution for this? app-gateway does not support AuthenticationCertificates for the selected SKU tier WAF_v2. Supported SKU tiers are Standard,WAF". If I execute using powershell its not refelct in the portal

sai-manoj-kumar commented 5 years ago

I can find answers to a few things mentioned here, in this link below: https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-autoscaling-zone-redundant. See if it helps.

ghost commented 5 years ago

When setting up an Application Gateway Standard V2, I am unable to retrieve health information from my components tied to my new AG. Same settings for a standard work just fine. I have added an nsg to the subnet of the AGV2 with updated rules documented (ports 65200 - 65535 for the v2 SKU); we are still unable to retrieve backend status of App Service and AGV2 reports as UNKNOWN backend health. It appears V2 is not quite working as expected by MS out of the box, or yet again, there is a new component without proper documentation on how to get the darned thing to work..

I can understand needing to have to use new settings or components, but that needs to be outlined and better defined by MS. Any time we try to upgrade to Standard_V2 to make use of a Static IP, nothing works: VMSS, App Service or IP.. Assistance and good documentation regarding the difference in setup and config for DIFFERENT VERSIONS Application Gateway would be much appreciated.

Snarkier note, this is such a common occurrence within Azure platform for most components that it is ridiculous. Components are either rushed, not feature rich, extremely limited, just flat out broke, or terrible/lazy documentation (often time missing key information..). I want to like this platform, but is so not ready and always has some sort of issue limiting our growth and expansions we really need in a hosting provider. AND AS ALWAYS GITHUBS ARE CLOSED WITHOUT REALLY REACHING OUT FOR PROPER CONFIRMATION OF A FIX OR TRYING TO FIX OR TEST ON YOUR OWN AS A COMPANY.

ricetristan commented 5 years ago

@Sulster and @AvinashReddyVaka I hit the same issue trying to setup end-to-end SSL via the Azure portal (_does not support AuthenticationCertificates for the selected SKU tier WAFv2). However, I was able to perform this configuration via powershell (Set-AzApplicationGatewayBackendHttpSettings) without issue. Hopefully the portal UI will be updated to support this soon!

jdcreek commented 5 years ago

@ricetristan Can you share the parameters you used for a successful end to end encryption when calling the Set-AzApplicationGatewayBackendHttpSettings command?

Thank you.

ricetristan commented 5 years ago

@jdcreek Sorry for the ridiculously long delay here - I was able to setup end-to-end encryption using the following powershell commands:

**$gw = Get-AzApplicationGateway -Name "YourAppGateway" -ResourceGroupName "YourResourceGroup"

Set-AzApplicationGatewayBackendHttpSetting -ApplicationGateway $gw -Name "YourAppGatewayBackendHttpSettings" -Port 443 -Protocol "Https"

Set-AzApplicationGateway -ApplicationGateway $gw**

rem-aj commented 5 years ago

@wacsintegra did you ever figure this issue out or file a ticket with MS for resolution? I am getting the same issue but actually wondering if it's a UI bug because I'm actually able to access my services via the DNS name. Even if it's a UI bug it's still bad from a monitoring standpoint.

ghost commented 5 years ago

MS would not assist on the support side and was not able to find a solution with the Azure platform.

rem-aj commented 5 years ago

I have opened up a ticket with them and will share my feedback when I get it. This product has been GA since the end of last month so it better be properly supported by now :)

rem-aj commented 5 years ago

@wacsintegra if you are using a custom DNS within your azure network, apparently that causes issues with the health check in V2. In my case I was using 8.8.8.8, after removing it from my VNET and restarting the app gateway all seemed to work well.

siddharth-dhawan commented 5 years ago

When will AG v2 be available in UAE North region?

rjuntechvision commented 5 years ago

Hi, Need help on Rstudio Server integration with Azure Kubernetes cluster, for on-demand horizontal scaling.