Azure-docs: NSG allowed on Gateway subnet but Portal says not?

[mrdfuse]

You can only deploy an Application Gateway into the subnet of type 'Gateway'. But on a Gateway Subnet, the option to configure a NSG is locked with a tooltip saying: "Assigning a network security group to a gateway subnet is not supported as virtual network gateway management and gateway connectivity may fail."
Am I missing something here?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 88466307-81b8-1e5b-7f2c-191d8e818071
• Version Independent ID: 08ad49f3-6a57-b925-794a-37215e985aba
• Content: Frequently asked questions for Azure Application Gateway
• Content Source: articles/application-gateway/application-gateway-faq.md
• Service: application-gateway
• GitHub Login: @vhorne
• Microsoft Alias: victorh

[TravisCragg-MSFT]

@mrdfuse App Gateways do not have the restriction of being deployed into gateway subnet, and you can put NSGs on the App Gateway Subnets.

We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.

[nloke]

@TravisCragg-MSFT This is a valid issue(could be a bug but not a documentation issue). Your documentation says it is valid but the UI(Portal) does not allow us to assign NSG to it.

[mrdfuse]

My issue was about putting an NSG on a subnet created for an Application Gateway. My mistake was that I made the subnet of type Gateway, which is not necessary for an Application Gateway. In that respect Travis was right.

I'm not sure if your comment is relevant here, or even correct. If you have the same issue as me, try without creating a gateway subnet, but instead create a normal subnet for your Application Gateway.

[nloke]

@mrdfuse In my case I consciously wanted the gateway subnet to have the NSG as I need to whitelist some IPs. I believe the document is correct, so yes I supposed this issue being closed is accurate. The issue/bug is with the UI where it locks that and prevent users from assigning it.

Workaround for those who stumble across this issue is to use the CLI or Terraform to configure and you will be able to set the NSG on gateway subnet

[slandsaw]

@nloke Do you have an example or link to docs for how to do that?

[nloke]

Try
https://docs.microsoft.com/en-us/powershell/module/azurerm.network/set-azurermvirtualnetworksubnetconfig?view=azurermps-6.13.0