applicationgateway setup

[thulasidassrinivasan]

Hi!! I need advise in writing bicep code for setting up application gateway. Below is the scenario.

Overview:
I have multiple listeners and multiple path rules, multiple probes, multiple redirectConfigurations for a single application gateway. In listeners we have both http based and https based. I would like to create a generic template which we can use across multiple environments like dev,test,staging,production.

What I need help with ?
Since I have both http and https listeners I would like to have a code that does both the configuration. As example I have below code.

var vhosthttplisteners = [
  {    
    name: 'frontend-https-listener'
    frontendIPConfiguration: 'appGatewayFrontendIP'
    frontendPort: 'appGatewayFrontendPort443'
    sslCertificate: 'frontend-cert'
    protocol: 'Https'
    hostName: 'abc.no'
    requireServerNameIndication: true
  }
  {
    name: 'portal-http-listener'
    frontendIPConfiguration: 'appGatewayFrontendIP'
    frontendPort:'appGatewayFrontendPort80'
    protocol: 'Http'
    hostName: 'portal-test.no'
    requireServerNameIndication: false
  }]
resource vhost_gw 'Microsoft.Network/applicationGateways@2020-11-01' = {
  name: appgwname
   httpListeners: [ for httplisteners in vhosthttplisteners: {
        name: httplisteners.name
        properties: {
          frontendIPConfiguration: {
            id: resourceId('Microsoft.Network/applicationGateways/frontendIPConfigurations', appgwname, httplisteners.frontendIPConfiguration)
          }
          frontendPort: {
            id: resourceId('Microsoft.Network/applicationGateways/frontendPorts', appgwname, httplisteners.frontendPort)
          }
          protocol: httplisteners.protocol
          sslCertificate: {
            id: resourceId('Microsoft.Network/applicationGateways/sslCertificates', appgwname, httplisteners.sslCertificate)
          }
          hostName: httplisteners.hostName
          requireServerNameIndication: httplisteners.requireServerNameIndication
        }
      }]
}

The problem with the above code is I cannot use this for http listener because http listener don't need a sslCertificate however https listener needs one. So I am not sure how to do this task. Any advise would be greatly helpful

[brwilkinson]

You can use the ternary operator to establish the if condition and provide a null where appropriate.

  sslCertificate: {
    id: (contains(httplisteners, 'sslCertificate') ? resourceId('Microsoft.Network/applicationGateways/sslCertificates', appgwname, httplisteners.sslCertificate) : json('null'))
  }

[thulasidassrinivasan]

Thanks @brwilkinson for replying. I tried your solution but i get below error

Value for reference id is missing. Path properties.httpListeners[1].properties.sslCertificate

[brwilkinson]

I see, yes that makes sense. . . Since we need to actually have the value for sslCertifcates as json null in the case where no certificates, instead of giving it an id with a value of null.

One way around this is to move your listener loop as a variable.

var Listeners = [for listener in waf.Listeners : {
  name: listener.Port
  backendAddressPool: {
    id: resourceId('Microsoft.Network/applicationGateways/backendAddressPools', WAFName, 'appGatewayBackendPool')
  }
  backendHttpSettings: {
    id: (contains(listener, 'BackendPort') ? resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', WAFName, 'appGatewayBackendHttpSettings${listener.BackendPort}') : json('null'))
  }
  redirectConfiguration: {
    id: resourceId('Microsoft.Network/applicationGateways/redirectConfigurations', WAFName, 'redirectConfiguration-${listener.Hostname}-80')
  }
  sslCertificate: {
    id: (contains(listener, 'Cert') ? resourceId('Microsoft.Network/applicationGateways/sslCertificates', WAFName, listener.Cert) : json('null'))
  }
  urlPathMap: {
    id: (contains(listener, 'pathRules') ? resourceId('Microsoft.Network/applicationGateways/urlPathMaps', WAFName, listener.pathRules) : json('null'))
  }
}]

and then on the listener loop itself, you can attach those properties.

    httpListeners: [for (list,index) in waf.Listeners: {
      name: 'httpListener-${(contains(list, 'pathRules') ? 'PathBasedRouting' : 'Basic')}-${list.Hostname}-${list.Port}'
      properties: {
        frontendIPConfiguration: {
          id: '${WAFID}/frontendIPConfigurations/appGatewayFrontend${list.Interface}'
        }
        frontendPort: {
          id: '${WAFID}/frontendPorts/appGatewayFrontendPort${list.Port}'
        }
        protocol: list.Protocol
        hostName: toLower('${Deployment}-${list.Hostname}.${list.Domain}')
        requireServerNameIndication: (list.Protocol == 'https')
        sslCertificate: ((list.Protocol == 'https') ? Listeners[index].sslCertificate : json('null'))
      }
    }]

This time with the following:
sslCertificate: ((list.Protocol == 'https') ? Listeners[index].sslCertificate : json('null'))

// we are essentially giving it

sslCertificate : json('null')

// where in the first sample i gave we were giving it

sslCertificate : {
       id: json(null)
}

[thulasidassrinivasan]

Thanks I tried it and i think i managed to move past listeneres but i have others like requestRoutingRules, pathrules, probes. I am having a hard time in requestRoutingRules

below is the piece of code

`var vhostrequestRoutingRules = [
{
name: 'admin'
ruleType: 'Basic'
httpListener: 'admin-listener'
backendAddressPool: 'admin-backend-pool'
backendHttpSettings: 'admin-settings'
redirectRule: 'no'
}
{
name: 'portal-http'
ruleType: 'Basic'
httpListener: 'portal-http-listener'
redirectConfigurations: 'portal-frontend-redirect'
redirectRule: 'yes'
}
{
name: 'api'
ruleType: 'PathBasedRouting'
httpListener: 'api-listener'
urlPathMap: 'api'
redirectRule: 'no'
}
]

requestRoutingRules: [for (routingrules,index) in vhostrequestRoutingRules:{
    name: routingrules.name
    properties: {
      ruleType: routingrules.ruleType
      redirectConfiguration: ((routingrules.redirectRule == 'yes') ? Reqroutingrules[index].redirectConfiguration : json('null'))
      backendHttpSettings: {
        id: ((routingrules.redirectRule == 'no' && routingrules.ruleType == 'Basic') ? Reqroutingrules[index].backendHttpSettings : json('null'))
      } 
      backendAddressPool: ((routingrules.redirectRule == 'no' && routingrules.ruleType == 'Basic') ? Reqroutingrules[index].backendAddressPool : json('null'))
      urlPathMap: ((routingrules.ruleType == 'PathBasedRouting') ? Reqroutingrules[index].urlPathMap : json('null'))
      httpListener: {
        id: resourceId('Microsoft.Network/applicationGateways/httpListeners', appgwname, string(routingrules.httpListener))
      }
    }
  }]

`

I get the error message Value for reference id is missing. Path properties.requestRoutingRules[0].properties.backendHttpSettings.

Do you have any advise how I can overcome this please ?

[brwilkinson]

Application Gateways (WAFs) can have some of the most difficult configurations out of any Azure Resource Provider type.

There may be some things in these samples that may help.
https://github.com/brwilkinson/AzureDeploymentFramework/blob/dev/ADF/bicep/WAF.bicep
https://github.com/brwilkinson/AzureDeploymentFramework/blob/dev/ADF/bicep/WAF-WAF.bicep

The WAFInfo objects that feeds those templates is here:
https://github.com/brwilkinson/AzureDeploymentFramework/blob/73df5f8f1dfc32415ca6d5051512edb7348a52b6/ADF/tenants/AOA/azuredeploy.1.ACU1.T5.parameters.json#L1074

[thulasidassrinivasan]

Thanks these were helpful