How to use proxy protocol in application gateway

Question

How to use proxy protocol in application gateway

tree tree 20

I recently saw that tcp mode was added to application gateway

Just like there is a function to add x-forwarded-for header in http mode, is there a way to use proxy protocol in tcp mode?

Sai Prasanna Sinde 5,240 Reputation points Microsoft External Staff

2025-04-08T07:15:46.0433333+00:00
Hi @tree tree

In addition to the existing Layer 7 capabilities (HTTP, HTTPS, WebSockets and HTTP/2), Azure Application Gateway now also supports Layer 4 (TCP protocol) and TLS (Transport Layer Security) proxying. This feature is currently in public preview.

To configure Azure Application Gateway TCP/TLS proxy (Preview), you can refer to this document.

When you join this preview, all Application Gateways will have the ability to use Layer 4 proxy features. This is an auto-approved registration and needs about 30 minutes to take effect.

Use the following steps to enroll into the public preview for Application Gateway TCP/TLS proxy using the Azure portal:

Sign in to the Azure portal.

In the search box, enter subscriptions and select Subscriptions.

Select the link for your subscription's name.

From the left menu, under Settings select Preview features.

You see a list of available preview features and your current registration status.

From Preview features type into the filter box AllowApplicationGatewayTlsProxy, select the feature, and then select Register.

First, create a SQL Server virtual machine (VM) using the Azure portal.

Then, create an Application gateway.

Note: While the HTTP(S) traffic can be served through L4 proxy protocols as well, we don't recommend doing so. The L7 proxy solution of Application Gateway offers greater control and security over the HTTP(S) protocols through advanced features such Rewrites, Session Affinity, Redirection, WebSockets, WAF and more.

For more clarification, please refer to FAQ's about Application Gateway

Kindly let us know if the above helps or you need further assistance on this issue.
tree tree 20 Reputation points

2025-04-08T07:26:55.53+00:00

It's not a tls proxy, it's a proxy protocol
Sai Prasanna Sinde 5,240 Reputation points Microsoft External Staff

2025-04-08T07:37:34.93+00:00

@tree tree

Please understand that Azure Application Gateway (AGW) can handle TCP and TLS connections at the transport layer and HTTP/HTTPS connections at the application layer, but it does not include native support for the PROXY protocol.

It would be helpful if you could specify your exact requirements regarding the proxy protocol.

Here are some workarounds that you might want to review to see if they meet your requirements.

Kindly let us know if the above helps or you need further assistance on this issue.
tree tree 20 Reputation points

2025-04-08T07:45:09.99+00:00

............
tree tree 20 Reputation points

2025-04-08T07:45:26.7666667+00:00

https://learn.microsoft.com/en-us/azure/private-link/private-link-service-overview#getting-connection-information-using-tcp-proxy-v2

It is identical to the proxy protocol function provided by private link service.
Sai Prasanna Sinde 5,240 Reputation points Microsoft External Staff

2025-04-09T07:56:19.88+00:00

@tree tree

Just following up to see if the response above helped in addressing your questions.

if you have any further queries, please let us know in the comments below so that we can address them.
Sai Prasanna Sinde 5,240 Reputation points Microsoft External Staff

2025-04-10T05:48:36.92+00:00

Hi @tree tree

Just following up to see if the response above helped in addressing your questions about Proxy protocol.

if you have any further queries, please let us know in the comments below so that we can address them.

1 answer

Your answer

Sai Prasanna Sinde 5,240 Reputation points Microsoft External Staff

2025-04-08T07:15:46.0433333+00:00

Hi @tree tree

In addition to the existing Layer 7 capabilities (HTTP, HTTPS, WebSockets and HTTP/2), Azure Application Gateway now also supports Layer 4 (TCP protocol) and TLS (Transport Layer Security) proxying. This feature is currently in public preview.

To configure Azure Application Gateway TCP/TLS proxy (Preview), you can refer to this document.

When you join this preview, all Application Gateways will have the ability to use Layer 4 proxy features. This is an auto-approved registration and needs about 30 minutes to take effect.

Use the following steps to enroll into the public preview for Application Gateway TCP/TLS proxy using the Azure portal:

Sign in to the Azure portal.

In the search box, enter subscriptions and select Subscriptions.

Select the link for your subscription's name.

From the left menu, under Settings select Preview features.

You see a list of available preview features and your current registration status.

From Preview features type into the filter box AllowApplicationGatewayTlsProxy, select the feature, and then select Register.

First, create a SQL Server virtual machine (VM) using the Azure portal.

Then, create an Application gateway.

Note: While the HTTP(S) traffic can be served through L4 proxy protocols as well, we don't recommend doing so. The L7 proxy solution of Application Gateway offers greater control and security over the HTTP(S) protocols through advanced features such Rewrites, Session Affinity, Redirection, WebSockets, WAF and more.

For more clarification, please refer to FAQ's about Application Gateway

Kindly let us know if the above helps or you need further assistance on this issue.
tree tree 20 Reputation points

2025-04-08T07:26:55.53+00:00

It's not a tls proxy, it's a proxy protocol
Sai Prasanna Sinde 5,240 Reputation points Microsoft External Staff

2025-04-08T07:37:34.93+00:00

@tree tree

Please understand that Azure Application Gateway (AGW) can handle TCP and TLS connections at the transport layer and HTTP/HTTPS connections at the application layer, but it does not include native support for the PROXY protocol.

It would be helpful if you could specify your exact requirements regarding the proxy protocol.

Here are some workarounds that you might want to review to see if they meet your requirements.

Kindly let us know if the above helps or you need further assistance on this issue.
tree tree 20 Reputation points

2025-04-08T07:45:09.99+00:00

............
tree tree 20 Reputation points

2025-04-08T07:45:26.7666667+00:00

https://learn.microsoft.com/en-us/azure/private-link/private-link-service-overview#getting-connection-information-using-tcp-proxy-v2

It is identical to the proxy protocol function provided by private link service.
Sai Prasanna Sinde 5,240 Reputation points Microsoft External Staff

2025-04-09T07:56:19.88+00:00

@tree tree

Just following up to see if the response above helped in addressing your questions.

if you have any further queries, please let us know in the comments below so that we can address them.
Sai Prasanna Sinde 5,240 Reputation points Microsoft External Staff

2025-04-10T05:48:36.92+00:00

Hi @tree tree

Just following up to see if the response above helped in addressing your questions about Proxy protocol.

if you have any further queries, please let us know in the comments below so that we can address them.

Answer 1

@tree tree

Application Gateway supports web protocols HTTP, HTTPS, HTTP/2, and WebSocket with its Layer 7 proxy. The TLS and TCP protocols are supported with its Layer 4 proxy (Preview) and can be configured on the same resource.

but it does not include native support for the PROXY protocol.

Also, please review this similar thread and check if this meet your requirements.

If you wish, you may also leave your feedback in the Azure feedback forum requesting this feature.

All the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure.

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer.

If you still have questions, please let us know what is needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

Share via

How to use proxy protocol in application gateway

1 answer

Your answer