title: Azure Application Gateway pointing to Azure CDN?
body: <p>Has anyone experience with pointing an Application Gateway to an Azure CDN? We can add internal and public services to our App Gateway but as soon as we point to an Azure CDN, then problems starts to arise.
  Here is what we are seeing:</p>
  <ul>
  <li><p>When adding a health probe pointing to the CDN it says everything is fine and it got a 200 reply.</p>
  </li>
  <li><p>When using the Connection Troubleshoot tool and pointing it to the CDN, it says it is reachable.</p>
  </li>
  <li><p>However, when checking the Backend Health, it says</p>
  </li>
  </ul>
  <blockquote>
  <p>The backend health status could not be retrieved. This happens when an
  NSG/UDR/Firewall on the application gateway subnet is blocking traffic
  on ports 65503-65534 in case of v1 SKU, and ports 65200-65535 in case
  of the v2 SKU or if the FQDN configured in the backend pool could not
  be resolved to an IP address. To learn more visit -
  <a href="https://aka.ms/UnknownBackendHealth" rel="nofollow noreferrer">https://aka.ms/UnknownBackendHealth</a>.</p>
  </blockquote>
  <p>For one the backend health is not &quot;unknown&quot; but &quot;unhealthy&quot;. And the tips there are not really useful. We don't have a blocking firewall and there are no NSGs.</p>
  <p>And to make it even more confusing, it actually appears that the endpoint is functioning when accessing the App Gateway listener. But it is a bit sporadic and sometimes it doesn't work.</p>
  <p>Any suggestion on how to debug this, as the tools available seems to indicate everything is fine until it is configured and the Backend Health says it is not?</p>
  <p><em><strong>Update:</strong></em></p>
  <p>It does in fact work if we use an IP from the CDN directly. Could indicate DNS issue however our DNS log does show that the App Gateway resolves the DNS.</p>