Configure listeners

3.2 Azure Application Gateway

📘Microsoft Azure Networking Solutions (AZ-700)

---

A listener in Azure Application Gateway is a component that “listens” for incoming traffic to your web application. Think of it as the entry point for all requests. Every request to your web app passes through a listener, which then directs it to the correct backend based on rules you configure.

---

1. What is a Listener?

• A listener monitors a specific IP address and port for incoming client requests.
• It’s the first step in processing requests in the Application Gateway.
• It can handle HTTP (port 80) and HTTPS (port 443) traffic.
• There are different types of listeners depending on your needs.

---

2. Types of Listeners

Azure Application Gateway supports the following listener types:

1. Basic (Single-Site) Listener
   • Listens for traffic to a single domain name (e.g., www.example.com).
   • Only one domain is handled per listener.
   • Simple configuration for single websites or apps.
2. Multi-Site Listener
   • Handles traffic for multiple domain names on the same Application Gateway.
   • Useful for hosting multiple websites on the same gateway (e.g., app1.example.com and app2.example.com).
   • Each domain has a host name defined in the listener.
3. Path-Based Listener (configured with routing rules)
   • Not a listener type itself, but you can configure routing rules to forward traffic based on URL paths.
   • Example: /images goes to one backend pool, /videos goes to another.

---

3. Listener Components

When configuring a listener in Azure, you define several components:

1. Frontend IP Configuration
   • The IP address (public or private) where the listener accepts traffic.
   • Public IP: For internet-facing apps.
   • Private IP: For internal apps inside a virtual network.
2. Protocol
   • Either HTTP or HTTPS.
   • HTTPS requires an SSL certificate for encryption.
3. Port
   • Standard ports: 80 for HTTP, 443 for HTTPS.
   • You can choose custom ports if needed.
4. Host Name (optional)
   • Required for multi-site listeners.
   • Tells the gateway which site the request is meant for.
5. SSL Certificate
   • Required only for HTTPS listeners.
   • Protects traffic between clients and the Application Gateway.
   • You can use a PFX certificate uploaded to Azure.

---

4. Configuring a Listener in Azure Portal

Here’s the step-by-step process for the exam:

1. Go to your Application Gateway
   • Open the Azure portal → search for Application Gateway → select your gateway.
2. Add a Listener
   • Go to Listeners → + Add Listener.
3. Define Listener Settings
   • Name: Give it a unique name.
   • Frontend IP: Choose public or private.
   • Protocol: HTTP or HTTPS.
   • Port: 80 or 443.
   • Host Name: Only if using multi-site listener.
   • SSL Certificate: Only if HTTPS is selected.
4. Associate Listener with Routing Rule
   • Listeners must be linked to a routing rule to know where to send traffic.
   • Default rule: forwards all traffic to a backend pool.
   • Path-based rules: forward requests based on URL path.

---

5. Key Exam Points

• A listener is mandatory; without it, the Application Gateway won’t accept traffic.
• Each listener must have a frontend IP (public or private) and a port/protocol.
• HTTPS listeners require SSL certificates.
• Multi-site listeners enable hosting multiple domains on one gateway.
• You cannot mix protocols on the same listener (i.e., one listener = HTTP or HTTPS, not both).
• Routing rules connect listeners to backend pools. Without a rule, traffic will not reach your app.

---

6. Practical IT Usage in an Environment

• A company has two web apps: portal.company.com and support.company.com.
  • They use a multi-site listener so one Application Gateway can handle both.
  • HTTPS is enabled for secure login.
  • Each listener points to a backend pool with the respective app servers.
• For a single internal API service:
  • Use a basic listener with private IP inside a virtual network.
  • HTTP is fine if traffic is only internal.

---

7. Exam Tip

• When a question asks: “Which component in Application Gateway accepts incoming traffic?” → Answer: Listener.
• If asked about configuring multiple domains on a single gateway → Answer: Multi-site listener.
• If asked about securing traffic → HTTPS listener + SSL certificate.

---

By understanding what a listener does, its types, components, and configuration steps, you’ll be ready to answer any exam question about Azure Application Gateway listeners.