Home / Azure

AzureTroubleshootingIntermediate

Application Gateway 502 Bad Gateway: backend health troubleshooting

Read backend health, then fix the probe, NSG, certificate and timeout issues that make Application Gateway return 502 to users.

Deepak Bhardwaj2 min read

Applies toAzure Application Gateway v2 / WAF v2

1. Check backend health

az network application-gateway show-backend-health -g rg-net -n agw-prod \
  --query "backendAddressPools[].backendHttpSettingsCollection[].servers[].{address:address, health:health, log:healthProbeLog}" -o table

The healthProbeLog text tells you the reason. The common ones:

Probe log says Fix
Cannot connect to backend server / timeout NSG, firewall or the app isn't listening. Check port and IP.
Received invalid status code Probe path returns 301/401/404. Point it at a health URL that returns 200–399, or set match conditions.
The root certificate of the server certificate used by the backend does not match Backend uses a private CA. Upload the trusted root certificate to the HTTP settings.
The Common Name (CN) of the backend certificate does not match Set host name override to the name in the backend's certificate
Backend server certificate is not signed by a well-known CA Same: add the trusted root, or use a public certificate

2. Network path

  • The Application Gateway subnet's NSG must allow inbound TCP 65200–65535 from GatewayManager (v2), plus AzureLoadBalancer.
  • No UDR on the gateway subnet may send 0.0.0.0/0 anywhere except the Internet, unless you've deployed it as a private-only gateway.
  • The backend NSG and host firewall must allow traffic from the gateway subnet, not from the client IPs.

3. Healthy backends but still 502

  • Request timeout: the backend took longer than the HTTP settings timeout (default 20 s).
    az network application-gateway http-settings update -g rg-net --gateway-name agw-prod -n https-settings --timeout 60
  • Host header mismatch: the backend (App Service, for example) expects its own host name. Enable Pick host name from backend target, or set an explicit override.
  • Protocol mismatch: HTTP settings use HTTPS but the backend listens on HTTP, or the other way round.

4. Look at the access log

AzureDiagnostics
| where Category == "ApplicationGatewayAccessLog" and TimeGenerated > ago(1h)
| where httpStatus_d >= 500
| summarize count() by httpStatus_d, serverStatus_s, serverRouted_s, requestUri_s
| top 20 by count_
  • serverStatus_s empty with a 502 → the gateway couldn't get a response at all.
  • serverStatus_s = 502/503 → the backend itself returned the error.

5. WAF false positives look like errors too

WAF blocks return 403, not 502. If users report "blocked", query ApplicationGatewayFirewallLog for the rule ID and create a targeted exclusion. Don't switch the whole policy to Detection mode.

Prevent it next time

  • Use a custom probe on a dedicated /health endpoint that checks the app's dependencies lightly.
  • Alert on the UnhealthyHostCount metric above 0 for each backend pool.

Related fixes