top of page
Search

Azure Application Gateway 502: Backend Health CLI When the Listener Is Fine

  • Aug 15
  • 2 min read
Azure network security troubleshooting lab
Azure · Techclick CLI troubleshooting lab
App Gateway listener is green. Users get 502. The VM answers on 80 locally.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Azure for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

502 is backend health. Probe path, host header, or NSG from the gateway subnet is wrong.

Why this ticket shows up

A listener can be up with zero healthy backends. Local curl on the VM does not use the probe path or the gateway SNAT.

Symptoms operators actually see

  • 502 Bad Gateway

  • Backend unhealthy

  • Probe path /health 404

  • NSG blocks gateway subnet

CLI first — copy this block

Run these on the Azure device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

az network application-gateway show-backend-health -n agw1 -g rg1 -o table
az network application-gateway probe list -g rg1 --gateway-name agw1 -o table
az network nic list-effective-nsg --ids <backend-nic>
curl -I http://127.0.0.1/health

How to read that output

Unhealthy + probe 404 means fix the path. Unhealthy + timeout means NSG or NSG-on-subnet from ApplicationGatewaySubnet.

Triage order

  1. show-backend-health

  2. Curl the exact probe path

  3. Allow the gateway subnet in the NSG

  4. Fix host header if the app requires it

  5. Wait for healthy then retest

Classic traps

What you see

Real cause

Fix

Restart the VM

Probe path is wrong

Fix probe

Open 80 to the world

Only the gateway subnet needs it

Tighten NSG

Rebuild the listener

Listener is not the 502

Fix backend

Proof the ticket is closed

  • Backend healthy

  • No 502

  • Probe path returns 200

Say this in an interview

App Gateway 502 is backend health. I do not debug the listener first.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page