Share via

Application Gateway fails to be built where a NSG rule deny's outbound traffic to/from virtual network

Mark Roddick 11 Reputation points
2022-02-01T15:42:00.283+00:00

When building an application gateway into a subnet with the following outbound NSG ruleset it fails, complaining outbound internet traffic is blocked (which it isn't). Removing rule 4096 allows me to provision the application gateway, however I would like control over the outbound traffic for perimeter devices to my virtual network. If I try to add this rule after the application gateway is provisioning I also get this error.

Code="ApplicationGatewaySubnetOutboundTrafficBlockedByNetworkSecurityGroup" Message="Network security group blocks outgoing internet traffic on subnet with Application Gateway. This is not permitted for Application Gateways that have fast update enabled or have V2 Sku.

170168-151799028-762213e7-6a5a-4ae4-b3b5-853d5dbfbc06.png

Azure Application Gateway
Azure Application Gateway
An Azure service that provides a platform-managed, scalable, and highly available application delivery controller as a service.
0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Mark Roddick 11 Reputation points
    2022-02-02T09:24:41.92+00:00

    Hi @msrini-MSFT ,

    Please can you ask the product team to alter the validation as it doesn't make sense, and also allow the blocking of anything which isn't internet?

    I do block on the inbound on other subnets but want to use a zero trust model incase a subnet is accidentally opened, or in some cases where we have had to open a subnet inbound on virtual network for on-prem devices.

    Thanks,
    Mark

    2 people found this answer helpful.
  2. msrini-MSFT 9,291 Reputation points Microsoft Employee
    2022-02-02T09:10:21.977+00:00

    @Mark Roddick ,

    Technically, the rules which you have added makes sense and it will not block any outbound traffic to Internet. But the validation that is in place currently doesn't allow any deny rule in outbound rules section.

    What I can suggest you is to block the traffic from AppGW on the other subnets in the inbound rules section.

    Regards,
    Karthik Srinivas

    0 comments
  3. Pasquini, Matteo (Admin) 50 Reputation points
    2025-07-11T15:25:22.3866667+00:00

    Hello,
    Same issue here.
    Seen that original question is from 2022, now is 2025..

    Is this bug going to be opened/fixed ?

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.