Securely Host Your Web Applications: Securing Azure App Service Environment

Internal App Service Environment can be great to securely and internally host your web applications on Azure. However, because ILB ASE is accessible only from within the VNet boundaries. It is a challenge to publish these apps externally, or deploy your code on them using DevOps as your pipelines cannot reach this secure environment.
In this video, I will go through the process of:
- Creating and Internal App Service Environment on a dedicated VNet
- Exposing the applications on it using Application Gateway
- SSL Offloading using Application Gateway and KeyVault Configuration
- Azure DevOps CD Pipeline using VMSS Self-hosted agents within the same VNet

[@peejayobinor2878]

This is a life server with very important insights. i really appreciate your effort on this. thank you very much.

[@ramanmama]

Excellent tutorials! Thanks for the efforts

[@ShankarKuppuswamy]

Best demo.. Covered end to end.. Thank you!

[@ZoomSpeaksTech]

Glad you liked it!

[@amsirajuddin]

nice one! thanks!

[@ashishsingh4693]

very informative I loved this session

[@asifsalman4702]

wonderful tutorial learned a lot

[@himanshumittal500]

Great content. Please cover more topics with great explanations.

[@ZoomSpeaksTech]

More to come!

[@pallaviak11]

Best explanation, best demo 👌 👏 thanks

[@ZoomSpeaksTech]

You are welcome!

[@tayoadaraloye]

Amazing tutorial

[@alokdubey4085]

This is a very informative video... thanks

[@ZoomSpeaksTech]

You're welcome

[@SumindaNiroshan]

One of the best tutorials! From start to finish. Have a question regarding Express Route and App Service,
If an on-premise network is connected to Azure via Express Route and I want to access an on-premise DB through my Web API hosted on an Azure App Service, will creating a Vnet Integration be enough to establish a successful TCP 1433 communication between Web API and on-premise DB? If not please let me know what other services I should configure?
Thanks again for an amazing video!

[@ZoomSpeaksTech]

Hi Suminda, yes that should be enough given the proper routes are in the route tables. However, I am always a proponent of the data layer being as close as possible to the service layer. Express Route is going to do fine if there so no way to get your data up on Azure. But nothing beats having service and data side by side in terms of performance, availability, and ease of configuration and troubleshooting.

[@SolutionHunterz]

Thanks for the awesome video. Could you please post a video for Availability zone support in azure app service.

[@ZoomSpeaksTech]

Goad you liked it. Will do.

[@swarupnayak85]

virtual machine scale set setup require a public IP address and it will automatic taken care during the scaling.

[@amitchaudhary2429]

Very good demo. Crystal clear. Need suggestion on if I don't want to keep APIM inside VNet. Is there a way I can expose ASE app services through APIM publically.

[@ZoomSpeaksTech]

Yeah sure, APIM can use backend APIs hosted on internal networks (such as ASE) and publish them publicly. I am preparing a complete APIM masterclass training for such scenarios, but for now try to follow along with this: docs.microsoft.com/en-us/azure/api-management/api-management-using-with-internal-vnet?tabs=stv2

[@amitchaudhary2429]

@@ZoomSpeaksTech But this still requires APIM to be deployed in internal VNet mode which is way expensive

[@omaramer9418]

very great tutorial. learned a lot! i do have a question though to make this more complex. what happens when you have an NVA in the mix and want to make sure all your traffic of your ASE is going through your NVA and you still want to reach 1 web app from your ILB ASE? would love to see you have UDR's involved to route your Vnet traffic through your NVA

[@ZoomSpeaksTech]

Yes in such case you’d need a UDR. This is no different from any other case where you’d have an NVA.

[@omaramer9418]

@@ZoomSpeaksTech yes I've been trying to test this out but the Microsoft docs make you go in circles trying to figure out forced tunnelling and what's needed from a NVA perspective. There's a long list of region IPs to add to the UDR and a ton of ports to open against those IPs on the NVA which seems like a big security risk.

[@mthangav]

well done!!
I hope the same level of security could also be achieved using webapp with private endpoint and VNET integration, without the need of ASE.
Another way could be to use service endpoint with App Gateway.

[@ZoomSpeaksTech]

It can, but always remember that the purpose of VNet Integration is for the WebApp to reach backend resources (such as internally hosted databases), rather than the WebApp being accessed internally on the private VNet. ASE serves a very specific purpose, to host an application internally and that presents challenges with DevOps. But a normal WebApp with VNet integration has no such challenges as it is still publicly hosted and a normal managed DevOps agent can always reach it to perform deployments.

[@mthangav]

yes totally agree with your point - VNET integration and Private endpoint are unidirectional.

[@tilakmishra]

@@mthangav Does that mean if one of our onprem application wants to talk back to the WebApp hosted in AppService Plan with a VNET Integration can't happen? And only solution we have is to go for App Service Environment?

[@anandrao3790]

@@ZoomSpeaksTech isnt it true that the major difference is the isolated instance we get in ASE which is not there is regular app service

[@ZoomSpeaksTech]

@@anandrao3790 Isolated compute is one of the reasons for sure. Often for regulatory reasons. But ASE can also have its perks in terms of isolated CI/CD cycles.

[@ijore]

Thank you really good video, it is really helpful. I am wondering about the virtual machine scale set setup. Does it require a public IP address?

[@ZoomSpeaksTech]

I would assume so since it needs communication with Azure DevOps service. But that will automatically be handled by the VMSS agent onboarding routine. So in the demo I did not specifically assign a public IP on the VMSS LB, it just did that by itself I assume.

[@ijore]

@@ZoomSpeaksTech Thank you

[@hamzathaddeus9339]

Instablaster...

[@cumpewter]

Can I use an app service certificate (purchased through azure) on the listener?

[@ZoomSpeaksTech]

I actually haven’t tried this before. But I think no because App Service Certificates are stored as Key Vault secrets, not certificates. I assume you can attempt to export it into a file, then upload that file as a Key Vault certificate.

[@asifsalman4702]

do u have any video made on windows env same using SSL/TLS?

[@ZoomSpeaksTech]

Not at the moment

[@MajmeKriza]

Thinking of any MS cert exam tutorial project?

[@ZoomSpeaksTech]

There are already many brilliant tutorials out there tackling the basics which enough to pass any exam. I prefer to make videos about complex issues that those other videos usually don’t cover. 👍