two frontend ports of application gateway are using the same port 443 - Azure application gateway in terraform

Question

I am configuring azure application gateway using terraform.

Following is the module that i wrote:

locals {
  backend_address_pool_name      = format("appgwbeap-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  frontend_port_name             = format("appgwfeport-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  frontend_ip_configuration_name = format("appgwfeip-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  http_setting_name              = format("appgwhtst-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  listener_name                  = format("appgwhttplstnr-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  request_routing_rule_name      = format("appgwrqrt-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  redirect_configuration_name    = format("appgwrdrcfg-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
}

resource "azurerm_application_gateway" "appgw" {
  name                = format("appgw-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
  resource_group_name = var.rg_name
  location            = var.location

  sku {
    name     = var.sku_name
    tier     = var.sku_tier
    capacity = var.sku_capacity
  }

  gateway_ip_configuration {
    name      = format("appgwipcfg-%[1]s-%[2]s%[3]sweb-gw",var.project_code,var.env,var.zone)
    subnet_id = var.subnet_id
  }

  frontend_port {
    name = "appgwfeport-app1-uatizweb-gw"
    port = "443"
  }


  frontend_port {
    name = "appgwfeport-app2-uatizweb-gw"
    port = "443"
  }

  ssl_certificate {
    name     = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
    data     = filebase64("./certificates/web.app1.sso.gwwu.xxx.com.de-12Jan2021.pfx")
    password = "${var.app1_pfx_password}"
  }
  authentication_certificate {
    name = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
    data = file("./certificates/web_app1_sso_gwwu_xxx_com_de-12Jan21.cer")
  }  

  ssl_certificate {
    name     = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
    data     = filebase64("./certificates/selfsigned-app2-uat-01Mar21.pfx")
    password = "${var.app1_pfx_password}"
  }
  authentication_certificate {
    name = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
    data = file("./certificates/selfsigned-app2-uat-01Mar21.cer")
  }  

  frontend_ip_configuration {
    name                 = "${local.frontend_ip_configuration_name}"
    subnet_id            = var.subnet_id
    private_ip_address   = var.frontend_private_ip
    private_ip_address_allocation = "Static"
  }

  backend_address_pool {
    name = "beap-path-app1-app"
    #fqdns     = var.fqdn_list
    ip_addresses = ["10.xxx.xxx.36"]
  }

  backend_address_pool {
    name = "beap-path-app2-app"
    #fqdns     = var.fqdn_list
    ip_addresses = ["10.xxx.xxx.37"]
  }

  backend_http_settings {
    name                  = "behs-path-app1-app"
    cookie_based_affinity = var.backend_cookie_based_affinity
    affinity_cookie_name  = "ApplicationGatewayAffinity"
    path                  = var.backend_path
    port                  = "443"
    #probe_name            = "probe-app1"
    protocol              = "Https"
    request_timeout       = var.backend_request_timeout
    authentication_certificate {
      name = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
    }
  }

  backend_http_settings {
    name                  = "behs-path-app2-app"
    cookie_based_affinity = var.backend_cookie_based_affinity
    affinity_cookie_name  = "ApplicationGatewayAffinity"
    path                  = var.backend_path
    port                  = "443"
    #probe_name            = "probe-app2"
    protocol              = "Https"
    request_timeout       = var.backend_request_timeout
    authentication_certificate {
      name = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
    }
  }

  http_listener {
    name                           = "appgwhttplsnr-app1-uatizweb-gw"
    frontend_ip_configuration_name = "${local.frontend_ip_configuration_name}"
    frontend_port_name             = "appgwfeport-app1-uatizweb-gw"
    protocol                       = "Https"
    ssl_certificate_name           = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
    require_sni                    = true
    host_name                      = "web.app1.sso.gwwu.xxx.com.de"
  }

  http_listener {
    name                           = "appgwhttplsnr-app2-uatizweb-gw"
    frontend_ip_configuration_name = "${local.frontend_ip_configuration_name}"
    frontend_port_name             = "appgwfeport-app2-uatizweb-gw"
    ssl_certificate_name           = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
    require_sni                    = true
    protocol                       = "Https"
    host_name                      = "web.app2.sso.gwwu.xxx.com.de"
  }

  request_routing_rule {
    name                       = "appgwrqrt-app2-uatizweb-gw"
    rule_type                  = var.backend_rule_type
    http_listener_name         = "appgwhttplsnr-app2-uatizweb-gw"
    backend_address_pool_name  = "beap-path-app2-app"
    backend_http_settings_name = "behs-path-app2-app"
  }

  request_routing_rule {
    name                       = "appgwrqrt-app1-uatizweb-gw"
    rule_type                  = var.backend_rule_type
    http_listener_name         = "appgwhttplsnr-app1-uatizweb-gw"
    backend_address_pool_name  = "beap-path-app1-app"
    backend_http_settings_name = "behs-path-app1-app"
  }
}

Below is the main.tf that calls the module:

module "app_gateway" {
  source                     = "../../../modules/appgateway"
  rg_name                    = var.rg_name
  agency                     = local.agency
  project_code               = local.project_code
  env                        = var.env
  zone                       = var.zone
  tier                       = "appgw"
  location                   = local.location
  vnet_name                  = var.vnet_name
  subnet_id                  = module.agw_subnet.subnet_id
  sku_name                   = var.appgw_sku_name
  sku_capacity               = var.appgw_sku_capacity
  frontend_private_ip        = var.appgw_frontend_ip
  frontend_port              = var.frontend_port
  frontend_protocol          = var.frontend_protocol
  app1_pfx_password          = "${var.app1_pfx_password}"
  backend_protocol           = var.backend_protocol
  backend_port               = var.backend_port
  backend_path               = "/"
  providers = {
    azurerm = azurerm.corpapps
  }
}

I have used Multi-site, However when i deploy -i get the following error: two frontend ports of application gateway are using the same port number 443 .

When i change one of my port to 5443 - it does get deployed and works from terraform. Also, i can create two frontend port with 443 (multi-site) from portal.Can't do this from terraform.

What am i missing from terraform. Any light on this will help!

Answer 1

We could use the same frontend configuration(frontend IP, protocol, port or name) for multi-sites listener instead of creating two frontend_port names.

For example, change the related codes:

 resource "azurerm_application_gateway" "appgw" {
    #..
    
      frontend_port {
        name = "appgwfeport-app1-uatizweb-gw"
        port = "443"
      }
    
    
    #  frontend_port {
    #    name = "appgwfeport-app2-uatizweb-gw"
    #    port = "443"
    #  }
    
    #..
    
    
      http_listener {
        name                           = "appgwhttplsnr-app1-uatizweb-gw"
        frontend_ip_configuration_name = "${local.frontend_ip_configuration_name}"
        frontend_port_name             = "appgwfeport-app1-uatizweb-gw"
        protocol                       = "Https"
        ssl_certificate_name           = "UAT-APP1-APPGW-SSL-CERT-SGCORE-12Jan21-12Jan23"
        require_sni                    = true
        host_name                      = "web.app1.sso.gwwu.xxx.com.de"
      }
    
      http_listener {
        name                           = "appgwhttplsnr-app2-uatizweb-gw"
        frontend_ip_configuration_name = "${local.frontend_ip_configuration_name}"
        frontend_port_name             = "appgwfeport-app1-uatizweb-gw"      #change here
        ssl_certificate_name           = "UAT-APP2-APPGW-SSL-CERT-01Mar21"
        require_sni                    = true
        protocol                       = "Https"
        host_name                      = "web.app2.sso.gwwu.xxx.com.de"
      }    
    }

For more information, read https://docs.microsoft.com/en-us/azure/application-gateway/tutorial-multiple-sites-powershell and https://docs.microsoft.com/en-us/azure/application-gateway/create-multiple-sites-portal#configuration-tab

Answer 2

We ran into the same error when updating an App Gateway via a PowerShell script.

Scenario: There was an existing multi-site listener using the FrontendPort for 80. When the script tried to add a second multi-site listener on that same port, we got the same error message.

It turned out that the original listener was on the public Frontend IP while the the second one being added was using the Private Frontend IP. I didn't realize this, but you can NOT use the same Frontend Port for both a public listener and a private listener even if they are both multi-site.

The original listener shouldn't have been public IP, anyway, so once I tweaked the original listener to use the private IP, the script executed without error.

I found the explanation about Private and Public IP's not being able to share the same port here:

• https://github.com/MicrosoftDocs/azure-docs/issues/23652

Maybe this will help someone else.

Answer 3

Maybe this link will be helpful: https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-faq#can-i-use-the-same-port-for-both-public-facing-and-private-facing-listeners The short answer is - it is not possible to use the same port private and public listeners. As a workaround I used another port like 10443 for https private listener configuration. In my case it worked fine because users did not use private listener

Answer 4

azure-cli was outdated in our case. After upgrade it all started to work like a charm.

We had an Application Gateway set up by Terraform with two multi-site public listeners , both using the same 443 port. The mentioned error Two Http Listeners of Application Gateway <..> and <..> are using the same Frontend Port <..> and FrontendIpConfiguration <..> was happening when outdated az cli was trying to az network application-gateway ssl-cert update --key-vault-secret-id <..> . azure-cli initial: 2.2.0, final: 2.39.0. After upgrade az network application-gateway ssl-cert update started to update GW's cert as expected.