Azure-docs: Application Gateway v2 Default Listener

[AndrewSmithRS]

Application Gateway v2 with all listeners (multisite/HTTPS) defined with a hostname still allows the application gateway to be contacted via the AppGW dns name or the IP address even without anything defined. When accessing in this way the result is a 404 as there is no backend however a certificate is still shown which seems to be one from the first listener.

When configuring and testing the same on v1 the result is the site cannot be reached.

This was highlighted after using SSL Labs where two certificates are being identified when testing. A rating of T is being shown as certificate #1 does not match.

Is this correct behaviour? My expectation is if there is a listener present without a hostname then accessing via the AppGW url or IP address would access this however when there no listener the connection should be refused.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: faa5b8a2-11a1-6a2d-07cb-ffcf39643ed4
• Version Independent ID: 298a134e-fb27-f16d-bff2-d43eb0f766fd
• Content: Autoscaling and Zone-redundant Application Gateway v2
• Content Source: articles/application-gateway/application-gateway-autoscaling-zone-redundant.md
• Service: application-gateway
• GitHub Login: @vhorne
• Microsoft Alias: victorh

[GitaraniSharma-MSFT]

@AndrewSmithRS , thank you for your question. We'll review this and get back to you shortly.

[GitaraniSharma-MSFT]

@AndrewSmithRS , I have confirmed with the Application gateway backend team that when there's no matching listener, accessing App gateway V2 returns a 404 with the certificate from the first listener. This is a default behaviour of Application gateway V2 SKU.

We are closing this issue for now. If there are further questions regarding this matter, please reply and we will gladly continue the discussion.

[AndrewSmithRS]

Thanks for confirming the behaviour. Having the documentation updated to include this change would help.
Is there any technical reason for this occur? I know some of my customers will fail specific security audits due to this. I'm happy to raise a ticket if this is not the right forum.

[GitaraniSharma-MSFT]

@AndrewSmithRS , the difference between App gateway V1 and V2 SKU multi-site behaviour is documented in the below article:
https://docs.microsoft.com/en-us/azure/application-gateway/ssl-overview#frontend-tls-connection-client-to-application-gateway

[AndrewSmithRS]

Thanks for reminding me to read the documentation :)
I'll feedback via our partner team in regards to the implications of the new behaviour.