Azure Application Gateway 502错误排查求助：健康探针配置问题

Alright, let's work through this 502 Bad Gateway issue you're facing. Since your VM (IP1) responds perfectly when you hit http://IP1/path/try.htm directly, the root cause is almost definitely a misconfigured health probe for your Application Gateway. Here's how to fix it step by step:

Step 1: Verify Health Probe Basic Settings #

Head to your Application Gateway's Health Probes section and double-check these critical details:

• Protocol: Make sure it's set to HTTP (you're using HTTP to access the VM directly, so the probe should match this—don't accidentally select HTTPS unless your VM's try.htm endpoint also supports it).
• Path: Enter the exact path /path/try.htm—don't omit the leading slash, this is a common mistake that breaks probe validation.
• Port: Match the HTTP port your VM is listening on (default is 80, but adjust if you've changed it for your web server).

Step 2: Check Backend Pool & Probe Association #

• Confirm your VM (IP1) is properly added to the Backend Pool linked to this probe. It's easy to accidentally target the wrong pool or forget to add the VM entirely.
• Under probe settings, ensure "Pick host name from backend target" is enabled. If your web server requires a specific Host header (unlikely since you're accessing via IP), manually set the Host header to IP1 instead.

Step 3: Align Backend Settings with Probe #

Go to Backend Settings and verify:

• The protocol and port match what you set in the health probe (e.g., HTTP 80). Mismatched protocols/ports will cause the gateway to mark the backend as unhealthy, triggering 502s.
• Make sure "Enable probe" is toggled on—if it's off, the gateway will fall back to default checks that might not recognize your custom /path/try.htm endpoint.

Step 4: Ensure Network Connectivity #

• Check your VM's Network Security Group (NSG) to confirm it allows inbound traffic from your Application Gateway's subnet (or IP2, if you're using public IP restrictions) on the HTTP port (80).
• Verify the VM's local firewall (Windows Firewall, iptables, etc.) isn't blocking traffic from the Application Gateway's IP range. Sometimes local firewalls are set to only allow your own IP, not the gateway's.

Step 5: Test Probe Availability Directly #

• If you can deploy a test VM in the Application Gateway's subnet, run curl http://IP1/path/try.htm from there. This simulates the gateway's perspective and will tell you if the endpoint is reachable from the gateway's network.
• Use Azure CLI to check probe status quickly:

  az network application-gateway probe show --resource-group <your-resource-group> --gateway-name <your-gateway-name> --name <your-probe-name>
  

  Look for the healthState field—if it's Unhealthy, the output will often include a reason like "Connection refused" or "404 Not Found" to guide your next fix.

Once you've adjusted these settings, wait a minute or two for the gateway to update its backend health status. If the probe shows as Healthy, your 502 errors should disappear right away.

内容的提问来源于stack exchange，提问作者BlindSniper