Azure Front Door: A Solutions Architect’s Guide to Global Load Balancing and CDN

Executive Summary

Configuration Example

{
  "name": "my-frontdoor",
  "properties": {
    "enabledState": "Enabled",
    "backendPools": [
      {
        "name": "backendPool1",
        "backends": [
          {
            "address": "app-eastus.azurewebsites.net",
            "priority": 1,
            "weight": 50
          },
          {
            "address": "app-westeurope.azurewebsites.net",
            "priority": 1,
            "weight": 50
          }
        ],
        "loadBalancingSettings": {
          "sampleSize": 4,
          "successfulSamplesRequired": 2
        },
        "healthProbeSettings": {
          "path": "/health",
          "protocol": "Https",
          "intervalInSeconds": 30
        }
      }
    ]
  }
}

Azure Front Door Architecture

Request Flow and Routing Decision Logic

Azure Front Door Architecture

• Intelligent Routing: Real-time performance-based backend selection
• SSL Termination: Offload TLS processing to the edge
• Application Acceleration: Optimize delivery of both static and dynamic content
• Edge Security: WAF and DDoS protection before traffic reaches your origin
• Anycast IP: Single global IP automatically routes to nearest PoP

Understanding the Global Edge Network

Intelligent Routing Capabilities

1. Performance-Based Routing (Recommended)

{
  "routingRules": [
    {
      "name": "performanceRouting",
      "routingConfiguration": {
        "routingType": "Performance",
        "backendPoolName": "globalBackendPool"
      }
    }
  ],
  "backendPools": [
    {
      "name": "globalBackendPool",
      "backends": [
        {
          "address": "app-eastus.azurewebsites.net",
          "httpPort": 80,
          "httpsPort": 443,
          "priority": 1,
          "weight": 100
        },
        {
          "address": "app-westeurope.azurewebsites.net",
          "httpPort": 80,
          "httpsPort": 443,
          "priority": 1,
          "weight": 100
        }
      ],
      "healthProbeSettings": {
        "path": "/health",
        "protocol": "Https",
        "intervalInSeconds": 30
      }
    }
  ]
}

2. Weighted Routing (Blue-Green Deployments)

• Gradual rollouts (10% → 50% → 100%)
• A/B testing at the global level
• Canary deployments

// Bicep template for weighted routing
resource frontDoor 'Microsoft.Network/frontDoors@2021-06-01' = {
  name: 'myApp-fd'
  location: 'global'
  properties: {
    backendPools: [
      {
        name: 'blueGreenPool'
        backends: [
          {
            address: 'blue.example.com'
            httpPort: 80
            httpsPort: 443
            weight: 90  // 90% traffic to stable version
            priority: 1
          }
          {
            address: 'green.example.com'
            httpPort: 80
            httpsPort: 443
            weight: 10  // 10% traffic to new version
            priority: 1
          }
        ]
        loadBalancingSettings: {
          id: weightedSettings.id
        }
        healthProbeSettings: {
          id: healthProbe.id
        }
      }
    ]
  }
}

3. Priority-Based Routing (Failover)

4. Path-Based Routing (Microservices)

{
  "routingRules": [
    {
      "name": "apiRouting",
      "patternsToMatch": ["/api/*"],
      "backendPool": "apiBackendPool"
    },
    {
      "name": "authRouting",
      "patternsToMatch": ["/auth/*"],
      "backendPool": "authBackendPool"
    },
    {
      "name": "defaultRouting",
      "patternsToMatch": ["/*"],
      "backendPool": "webBackendPool"
    }
  ]
}

Request Flow & Routing Decision Logic

1. DNS Resolution: Anycast IP routes to nearest PoP
2. WAF Inspection: Request analyzed against WAF rules (OWASP, custom)
3. Content Classification: Static vs. dynamic content detection
4. Cache Check: For static content, serve from edge if cached
5. Backend Selection: For dynamic content or cache miss, select optimal backend
6. Request Optimization: Connection pooling, HTTP/2, compression
7. Response Caching: Cache-Control headers determine edge caching

Security at the Edge: WAF Integration

Managed Rule Sets

• OWASP Core Rule Set (CRS): Protection against Top 10 vulnerabilities
• Bot Protection: Distinguish legitimate bots from malicious automated traffic
• Rate Limiting: Per-IP request rate limiting at the edge
• Geo-Filtering: Block/allow traffic from specific countries

// WAF Policy configuration
resource wafPolicy 'Microsoft.Network/FrontDoorWebApplicationFirewallPolicies@2022-05-01' = {
  name: 'myAppWafPolicy'
  location: 'global'
  sku: {
    name: 'Premium_AzureFrontDoor'
  }
  properties: {
    policySettings: {
      enabledState: 'Enabled'
      mode: 'Prevention'  // Prevention or Detection
      requestBodyCheck: 'Enabled'
      maxRequestBodySizeInKb: 128
    }
    managedRules: {
      managedRuleSets: [
        {
          ruleSetType: 'Microsoft_DefaultRuleSet'
          ruleSetVersion: '2.1'
          ruleSetAction: 'Block'
        }
        {
          ruleSetType: 'Microsoft_BotManagerRuleSet'
          ruleSetVersion: '1.0'
        }
      ]
    }
    customRules: {
      rules: [
        {
          name: 'RateLimitRule'
          priority: 100
          ruleType: 'RateLimitRule'
          rateLimitThreshold: 100
          rateLimitDurationInMinutes: 1
          matchConditions: [
            {
              matchVariable: 'RemoteAddr'
              operator: 'IPMatch'
              matchValue: ['0.0.0.0/0']
            }
          ]
          action: 'Block'
        }
        {
          name: 'GeoFilterRule'
          priority: 200
          ruleType: 'MatchRule'
          matchConditions: [
            {
              matchVariable: 'RemoteAddr'
              operator: 'GeoMatch'
              negateCondition: true
              matchValue: ['US', 'CA', 'GB', 'DE']
            }
          ]
          action: 'Block'
        }
      ]
    }
  }
}

Caching and Optimization

Intelligent Caching Strategy

• Dynamic Compression: Gzip/Brotli for compressible content (30-70% size reduction)
• Query String Behavior: Control how query parameters affect cache keys
• Cache Purge: Instant global cache invalidation
• HTTP/2 & HTTP/3: Modern protocol optimizations

{
  "cachingConfiguration": {
    "queryStringCachingBehavior": "IgnoreSpecifiedQueryStrings",
    "queryParameters": "utm_source,utm_medium",
    "dynamicCompression": "Enabled",
    "cacheDuration": "1.00:00:00"
  }
}

Service Comparison: Choosing the Right Tool

Decision Framework

• ✅ Global HTTP/HTTPS workloads
• ✅ WAF protection at the edge
• ✅ CDN capabilities for static content
• ✅ Advanced routing (path-based, weighted)
• ✅ SSL termination at the edge
• ✅ Real-time performance-based routing

• ✅ Non-HTTP protocols (TCP, UDP)
• ✅ DNS-level global load balancing
• ✅ Hybrid cloud (Azure + on-premises)
• ✅ Lowest cost global load balancing

• ✅ Regional HTTP/HTTPS load balancing
• ✅ Private VNet workloads
• ✅ Internal application delivery
• ✅ Advanced layer 7 features (regional)

Integration Patterns & Best Practices

Pattern 1: Front Door + Private Link

// Private endpoint for App Service
resource privateEndpoint 'Microsoft.Network/privateEndpoints@2023-04-01' = {
  name: 'app-pe'
  location: 'eastus'
  properties: {
    subnet: {
      id: subnet.id
    }
    privateLinkServiceConnections: [
      {
        name: 'app-plsc'
        properties: {
          privateLinkServiceId: appService.id
          groupIds: ['sites']
        }
      }
    ]
  }
}

// Front Door with Private Link Origin
resource origin 'Microsoft.Cdn/profiles/originGroups/origins@2023-05-01' = {
  name: 'privateOrigin'
  properties: {
    hostName: appService.properties.defaultHostName
    httpPort: 80
    httpsPort: 443
    originHostHeader: appService.properties.defaultHostName
    priority: 1
    weight: 1000
    enabledState: 'Enabled'
    sharedPrivateLinkResource: {
      privateLink: {
        id: appService.id
      }
      privateLinkLocation: 'eastus'
      groupId: 'sites'
      requestMessage: 'Front Door access'
    }
  }
}

Pattern 2: Multi-Region Active-Active

# PowerShell - Deploy multi-region setup
$regions = @('eastus', 'westeurope', 'southeastasia')
$backendPool = @()

foreach ($region in $regions) {
    # Deploy App Service in region
    $app = New-AzWebApp `
        -ResourceGroupName "rg-$region" `
        -Name "app-$region" `
        -Location $region `
        -AppServicePlan "plan-$region"
    
    # Add to backend pool
    $backendPool += @{
        address = "${app.DefaultHostName}"
        httpPort = 80
        httpsPort = 443
        priority = 1
        weight = 100
        enabledState = 'Enabled'
    }
}

# Create Front Door with all regions
$frontDoorConfig = @{
    backendPools = @(
        @{
            name = 'globalPool'
            backends = $backendPool
            loadBalancingSettings = @{
                sampleSize = 4
                successfulSamplesRequired = 2
                additionalLatencyInMilliseconds = 50
            }
            healthProbeSettings = @{
                path = '/health'
                protocol = 'Https'
                intervalInSeconds = 30
            }
        }
    )
}

New-AzFrontDoor `
    -ResourceGroupName 'rg-frontdoor' `
    -Name 'myapp-fd' `
    -FrontDoorConfig $frontDoorConfig

Pattern 3: Monitoring & Observability

// Front Door diagnostic settings
resource diagnostics 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {
  name: 'fd-diagnostics'
  scope: frontDoor
  properties: {
    workspaceId: logAnalytics.id
    logs: [
      {
        category: 'FrontDoorAccessLog'
        enabled: true
        retentionPolicy: {
          days: 30
          enabled: true
        }
      }
      {
        category: 'FrontDoorHealthProbeLog'
        enabled: true
      }
      {
        category: 'FrontDoorWebApplicationFirewallLog'
        enabled: true
      }
    ]
    metrics: [
      {
        category: 'AllMetrics'
        enabled: true
        retentionPolicy: {
          days: 30
          enabled: true
        }
      }
    ]
  }
}

// KQL query for performance analysis
var performanceQuery = '''
AzureDiagnostics
| where Category == "FrontDoorAccessLog"
| where TimeGenerated > ago(1h)
| summarize 
    RequestCount = count(),
    AvgDuration = avg(todouble(timeTaken_s)),
    P95Duration = percentile(todouble(timeTaken_s), 95),
    P99Duration = percentile(todouble(timeTaken_s), 99)
    by bin(TimeGenerated, 5m), backendHostname_s
| render timechart
'''

Cost Optimization Strategies

• Data Transfer: Outbound data from edge to users
• HTTP/HTTPS Requests: Number of requests processed
• Routing Rules: Number of configured routes
• WAF Requests: Additional cost for WAF-inspected requests

Production Deployment Checklist

1. ✅ SSL Certificates: Upload or use Azure-managed certificates
2. ✅ Custom Domain: Configure CNAME records for your domain
3. ✅ Health Probes: Implement /health endpoints on all backends
4. ✅ WAF Testing: Test in Detection mode before enabling Prevention
5. ✅ Cache Configuration: Set appropriate Cache-Control headers
6. ✅ Monitoring: Configure diagnostics to Log Analytics
7. ✅ Alerts: Set up alerts for health probe failures and high latency
8. ✅ Disaster Recovery: Test failover scenarios
9. ✅ Performance Baseline: Measure before/after metrics
10. ✅ Cost Estimates: Project monthly costs based on traffic

Conclusion

• 🎯 Start with Premium SKU for Private Link and advanced WAF
• 🎯 Use Infrastructure as Code (Bicep/Terraform) for all configurations
• 🎯 Implement comprehensive monitoring from day one
• 🎯 Test failover scenarios regularly
• 🎯 Optimize caching aggressively to reduce costs

References & Further Reading

• 📚 Azure Front Door Official Documentation
• 📚 Front Door Routing Architecture Deep Dive
• 📚 Azure WAF Best Practices
• 📚 Azure Front Door Pricing
• 📚 Caching Strategies Guide