Can not create WAF_v2 application gateway with private ip

[ajinkya101]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v1.1.6
registry.terraform.io/hashicorp/azurerm v2.97.0

Affected Resource(s)

• azurerm_application_gateway

Terraform Configuration Files

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_virtual_network" "example" {
  name                = "example-network"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  address_space       = ["10.1.0.0/16"]
}

resource "azurerm_subnet" "frontend" {
  name                 = "frontend"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.1.1.0/24"]
}

resource "azurerm_public_ip" "example" {
  name                = "example-pip"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  allocation_method   = "Static"
  sku                 = "Standard"
}

locals {
  backend_address_pool_name      = "devvnet-beap"
  frontend_port_name             = "devvnet-feport"
  frontend_ip_configuration_name = "devvnet-feip"
  http_setting_name              = "devvnet-be-htst"
  listener_name                  = "devvnet-httplstn"
  request_routing_rule_name      = "devvnet-rqrt"
  redirect_configuration_name    = "devvnet-rdrcfg"
}

resource "azurerm_application_gateway" "network" {
  name                = "example-appgateway"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location

  sku {
    name = "WAF_v2"
    tier = "WAF_v2"
  }

  autoscale_configuration {
    min_capacity = "1"
    max_capacity = "4"
  }

  gateway_ip_configuration {
    name      = "my-gateway-ip-configuration"
    subnet_id = azurerm_subnet.frontend.id
  }

  frontend_port {
    name = local.frontend_port_name
    port = 80
  }

  frontend_ip_configuration {
    name                          = local.frontend_ip_configuration_name
    public_ip_address_id          = azurerm_public_ip.example.id
    private_ip_address            = "10.1.1.10"
    private_ip_address_allocation = "Static"
  }

  backend_address_pool {
    name = local.backend_address_pool_name
  }

  backend_http_settings {
    name                  = local.http_setting_name
    cookie_based_affinity = "Disabled"
    path                  = "/path1/"
    port                  = 80
    protocol              = "Http"
    request_timeout       = 60
  }

  http_listener {
    name                           = local.listener_name
    frontend_ip_configuration_name = local.frontend_ip_configuration_name
    frontend_port_name             = local.frontend_port_name
    protocol                       = "Http"
  }

  request_routing_rule {
    name                       = local.request_routing_rule_name
    rule_type                  = "Basic"
    http_listener_name         = local.listener_name
    backend_address_pool_name  = local.backend_address_pool_name
    backend_http_settings_name = local.http_setting_name
  }
}

Expected Behaviour

As per Microsoft docs, the Application Gateway v2 SKU supports static public IP addresses and static internal IPs.
Link - https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-faq#does-application-gateway-support-static-ip

The Provided Static Private IP from the Virtual Network should be assigned to the frontend IP Configuration of the Application Gateway Resource with WAFv2 SKU.

Actual Behaviour

azurerm_application_gateway.network: Creating...
azurerm_application_gateway.network: Still creating... [10s elapsed]
| Error: creating/updating Application Gateway: (Name "example-appgateway" / Resource Group "example-resources"):
| network.ApplicationGatewaysClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error:
| Code="ApplicationGatewayFrontendIpCannotHavePublicIpAndPrivateIp" Message="FrontendIpConfiguration
| /subscriptions/******/resourceGroups/example-resources/providers/Microsoft.Network/applicationGateways/example-appgateway/frontendIPConfigurations/devvnet-feip cannot have both PublicIp and PrivateIpAddress. Only one should be specified." Details=[]

Steps to Reproduce

1. terraform apply

[ajinkya101]

The issue has been resolved by providing Separate Frontend IP Configuration for Public and private ip.

[adathouse]

Hi @ajinkya101 , could you detail how you finally provisioned your private address?

I've tried a number of combinations and all failed:

1. address in the same subnet as the AppGw - Code="PrivateIPAddressInReservedRange"
2. address from a different subnet - Code="ApplicationGatewayFrontendIpSubnetCannotBeDifferentFromGatewaySubnet"
3. try dropping the subnet argument - Code="ApplicationGatewayFrontendIpBothPublicIpAddressAndSubnetCannotBeNull"

I am using sku WAF_v2 and tier WAF_v2, like your example.

I am trying two use separate frontend_ip_configuration blocks, per other documentation and error messages from other attempts.

My lock file has:

provider "registry.terraform.io/hashicorp/azurerm" {
  version     = "2.95.0"
...

[ajinkya101]

You can use the following example code.

Terraform Configuration Files

# Configure the Microsoft Azure Provider
provider "azurerm" {
  # skip_provider_registration = true
  features {}
}

resource "azurerm_resource_group" "example" {
  name     = "example-resources"
  location = "West Europe"
}

resource "azurerm_virtual_network" "example" {
  name                = "example-network"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  address_space       = ["10.1.0.0/16"]
}

resource "azurerm_subnet" "frontend" {
  name                 = "frontend"
  resource_group_name  = azurerm_resource_group.example.name
  virtual_network_name = azurerm_virtual_network.example.name
  address_prefixes     = ["10.1.1.0/24"]
}

resource "azurerm_public_ip" "example" {
  name                = "example-pip"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location
  allocation_method   = "Static"
  sku                 = "Standard"
}

locals {
  backend_address_pool_name              = "devvnet-beap"
  frontend_port_name                     = "devvnet-feport"
  public_frontend_ip_configuration_name  = "devvnet-public-feip"
  private_frontend_ip_configuration_name = "devvnet-private-feip"
  http_setting_name                      = "devvnet-be-htst"
  listener_name                          = "devvnet-httplstn"
  request_routing_rule_name              = "devvnet-rqrt"
  redirect_configuration_name            = "devvnet-rdrcfg"
}

resource "azurerm_application_gateway" "network" {
  name                = "example-appgateway"
  resource_group_name = azurerm_resource_group.example.name
  location            = azurerm_resource_group.example.location

  sku {
    name = "WAF_v2"
    tier = "WAF_v2"
  }

  autoscale_configuration {
    min_capacity = "1"
    max_capacity = "4"
  }

  gateway_ip_configuration {
    name      = "my-gateway-ip-configuration"
    subnet_id = azurerm_subnet.frontend.id
  }

  frontend_port {
    name = local.frontend_port_name
    port = 80
  }

  frontend_ip_configuration {
    name                 = local.public_frontend_ip_configuration_name
    public_ip_address_id = azurerm_public_ip.example.id
  }

  frontend_ip_configuration {
    name                          = local.private_frontend_ip_configuration_name
    private_ip_address            = "10.1.1.10"
    private_ip_address_allocation = "Static"
    subnet_id                     = azurerm_subnet.frontend.id
  }

  backend_address_pool {
    name = local.backend_address_pool_name
  }

  backend_http_settings {
    name                  = local.http_setting_name
    cookie_based_affinity = "Disabled"
    path                  = "/path1/"
    port                  = 80
    protocol              = "Http"
    request_timeout       = 60
  }

  http_listener {
    name                           = local.listener_name
    frontend_ip_configuration_name = local.private_frontend_ip_configuration_name
    frontend_port_name             = local.frontend_port_name
    protocol                       = "Http"
  }

  request_routing_rule {
    name                       = local.request_routing_rule_name
    rule_type                  = "Basic"
    http_listener_name         = local.listener_name
    backend_address_pool_name  = local.backend_address_pool_name
    backend_http_settings_name = local.http_setting_name
  }
}

You need to use the address in the same subnet as the AppGw -
https://docs.microsoft.com/en-us/azure/application-gateway/configuration-infrastructure#size-of-the-subnet

Hope it resolves your issue. 🙂

[adathouse]

Thank you! That is very helpful. I did eventually find an address that works, but it seems like I had to exhaust the entire configuration search space first :-)

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.