Backend unreachable. Check NSG, firewall, or port.

The error messages indicate issues with the backend health of your Azure Application Gateway. Here are the key points to consider based on the provided details:

1. Status Code Mismatch: For the backend server at 10.10.2.4 on port 443, the health probe is receiving an invalid status code. The probe is configured to accept status codes in the range of 200-399, but it is not receiving a valid response. You may need to either modify the probe configuration to accept the current response or resolve the underlying issues with the backend application to ensure it returns a valid status code.
2. Backend Connectivity Issues: For the backend server at 10.10.2.5 on port 8080, the health probe is unable to connect. This could be due to network security group (NSG) rules, user-defined routes (UDR), or firewall settings blocking access. Ensure that the application is running on the correct port and that the necessary inbound rules are configured in the NSG to allow traffic.

To troubleshoot further, consider the following steps:

• Check the NSG rules associated with the Application Gateway and the backend servers to ensure that they allow the necessary traffic.
• Verify that the application on the backend servers is running and listening on the expected ports.
• Review any UDRs that might be misrouting traffic away from the backend servers.

By addressing these points, you should be able to resolve the backend connectivity issues and ensure that your Application Gateway can successfully probe the backend servers.

References:

• Troubleshoot backend health issues in Application Gateway
• Troubleshooting bad gateway errors in Application Gateway