AGC (Application Gateway for Containers) public frontend IPs not reachable from Microsoft corpnet — new AGCs (20.x/98.x) fail while old AGC (4.150.x) works

Question

AGC (Application Gateway for Containers) public frontend IPs not reachable from Microsoft corpnet — new AGCs (20.x/98.x) fail while old AGC (4.150.x) works

Lianpeng Sun 80 Microsoft Employee

SUMMARY

Application Gateway for Containers (AGC) instances created in our subscription

are assigned platform-managed public frontend IPs. The original/old AGC's

frontend IP is reachable from Microsoft corpnet, but every newly-created AGC

gets a different public IP that is NOT reachable from corpnet (TCP 80/443 both

time out). The frontend IP is platform-assigned and not selectable by us, so we

cannot work around this from our side.

ENVIRONMENT

Subscription: 400b141f-9ce9-4189-b402-95f406803193 (IGSInfra)
Resource Group: MPHP
Region: eastus
AKS cluster: pipelinefarm-prod-aks-v2
Resource type: Microsoft.ServiceNetworking/trafficControllers (AGC)
In-cluster: ApplicationLoadBalancer CR (alb.networking.azure.io/v1), namespace gateway-system, alb-controller v1.8.12

GATEWAY ADDRESSES — OLD vs NEW

+---------------+------------------------+---------------------------------+------------+-----------------------+

+---------------+------------------------+---------------------------------+------------+-----------------------+

+---------------+------------------------+---------------------------------+------------+-----------------------+

DIFFERENCE BETWEEN OLD AND NEW

Only difference that matters: the public frontend IP that AGC assigns.
- OLD AGC IP 4.150.170.10 is in a range that corpnet can reach (HTTPS 200).
- All NEW AGC IPs (20.x / 98.x) are in ranges corpnet CANNOT reach.
We rebuilt the AGC three times, twice on a brand-new dedicated subnet (mphp_prod_alb_vnet_v2). Each rebuild produced a different public IP, and every new IP was unreachable. Changing the subnet did NOT change the outcome.

PROBLEM WITH THE NEW GATEWAY ADDRESS

New AGC public frontend IPs (98.71.113.162, 20.189.81.91, 20.4.80.75) cannot be reached from Microsoft corpnet on either port 80 or 443 — all connections time out at the TCP level (no SYN-ACK).
Traceroutes to a reachable IP (4.150.170.10) and an unreachable IP (e.g. 20.4.80.75) follow an IDENTICAL path up to the Azure edge, which rules out any VNet / subnet / peering misconfiguration on our side.
There is no ExpressRoute in this subscription; connectivity is via internet/Microsoft-Peering.

ASK

Please confirm whether the new AGC public frontend IP ranges (20.x / 98.x) are

expected to be advertised/reachable from Microsoft corpnet, and if not, either:

(a) advertise these segments to corpnet, or

(b) confirm the expected AGC public frontend behavior and any supported way to

obtain a corpnet-reachable frontend IP for AGC.

IMPACT

We are migrating from an old AKS cluster to a new one. The new AGC gateways are

unreachable from corpnet, blocking the migration cutover.?

Ravi Varma Mudduluru 12,535 Reputation points Microsoft External Staff Moderator

2026-06-09T09:58:43.7566667+00:00

Hello @Lianpeng Sun

Thank you for contacting us about the Application Gateway for Container issue. We have begun looking into it and will share our suggestions with you as soon as possible.

Answer accepted by question author

Ravi Varma Mudduluru 12,535 Microsoft External Staff Moderator

Hello @Lianpeng Sun

Thank you for reaching out to Microsoft Q&A.

Backend team identified that the Security Admin configurations were missing after updating the tags on the VNet resolved the issue.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

0 comments

1 additional answer

Your answer

Ravi Varma Mudduluru 12,535 Reputation points Microsoft External Staff Moderator

2026-06-09T09:58:43.7566667+00:00

Hello @Lianpeng Sun

Thank you for contacting us about the Application Gateway for Container issue. We have begun looking into it and will share our suggestions with you as soon as possible.

Answer 1

The behavior of which specific public IP ranges for Application Gateway for Containers (AGC) are advertised or reachable from Microsoft corpnet isn’t documented in the provided material, and there’s no supported mechanism in the context to influence or select the platform‑managed public frontend IP that AGC assigns.

The available guidance in the context focuses on:

Migrating from AGIC to AGC and feature/annotation mappings, including private IP and port limitations.
General Application Gateway frontend IP behavior (public vs private, SKU constraints).
Troubleshooting AGIC/AKS connectivity and backend mapping, not control over AGC public IP ranges or corpnet reachability.

From this context, only the following can be stated:

Application Gateway frontends can be public or private IPs, and for V2 SKUs the public IPs are standard, static, and platform‑managed; there is no documented way here to constrain them to specific ranges for corpnet reachability.
Private‑only deployments and network‑isolated scenarios are supported for Application Gateway (via EnableApplicationGatewayNetworkIsolation and private deployment guidance), but this does not address corpnet reachability of platform‑assigned public IPs.
Troubleshooting steps for AGIC/AKS focus on verifying backend health, pod/IP mapping, and gateway running state, not on upstream Microsoft network advertising or corpnet routing.

The question of whether specific 20.x / 98.x AGC frontend ranges are expected to be reachable from Microsoft corpnet, and how to obtain a corpnet‑reachable AGC frontend IP, isn’t answered in the provided documentation. There is also no documented control surface here to request or pin AGC to a particular public IP range.

References: