title: Azure App Gateway V2 cannot be configured with NSG
body: <p>I have provisioned App Gateway with WAF V2 SKU. Then, I have configured back-end pool to point to WebApp and added IP restrictions to allow only traffic from WAF IP.  Then, i am attempting to add NSG to the provisioned Subnet to further restrict traffic to the Frontend IP address.  I am getting an error (see below). Per <a href="https://docs.microsoft.com/en-us/azure/application-gateway/application-gateway-faq#configuration" rel="nofollow noreferrer">Application Gateway FAQ</a> this should be possible, but having trouble. Here is are the details of the deployment error:</p>
  <pre><code>Network security group /subscriptions/49c19f96-135d-4599-ae34-fd9087ce2bf8/resourceGroups/dbt-sc-platform-rg/providers/Microsoft.Network/networkSecurityGroups/BannerCIDRNsg blocks incoming internet traffic on ports 65200 - 65535 to subnet /subscriptions/49c19f96-135d-4599-ae34-fd9087ce2bf8/resourceGroups/dbt-sc-platform-rg/providers/Microsoft.Network/virtualNetworks/dbt-sc-platform-rg/subnets/default, associated with Application Gateway /subscriptions/49c19f96-135d-4599-ae34-fd9087ce2bf8/resourceGroups/dbt-sc-platform-rg/providers/Microsoft.Network/applicationGateways/dbt-sc-appgw. This is not permitted for Application Gateways that have V2 Sku.
  </code></pre>