Azure 应用程序网关出现不健康状态 502 错误

Question

Azure 应用程序网关在概述仪表板上显示错误 -

All the instances in one or more of your backend pools are unhealthy. This will result in a 502 error when you try to access your application hosted behind the Application Gateway. Please check the backend health and resolve the issue.

有人遇到过这个错误并且知道如何解决这个问题吗？我已经使用 Azure-CLI 和 Command 重新启动了服务

:~$ az network application-gateway stop -n <ap-gw> -g <rs-gp>
:~$ az network application-gateway start -n <ap-gw> -g <rs-gp>

但是问题仍然存在..

当我检查应用程序网关健康状态时。

$ az network application-gateway show-backend-health --resource-group <rs-gp> --name <application-gateway>
{
  "backendAddressPools": [
    {
      "backendAddressPool": {
        "backendAddresses": null,
        "backendIpConfigurations": null,
        "etag": null,
        "id": "/subscriptions/subscriptionsID/resourceGroups/<application-gateway>/providers/Microsoft.Network/applicationGateways/<application-gateway>/backendAddressPools/dev-silverlight",
        "name": null,
        "provisioningState": null,
        "resourceGroup": "<application-gateway>",
        "type": null
      },
      "backendHttpSettingsCollection": [
        {
          "backendHttpSettings": {
            "affinityCookieName": null,
            "authenticationCertificates": null,
            "connectionDraining": null,
            "cookieBasedAffinity": null,
            "etag": null,
            "hostName": null,
            "id": "/subscriptions/subscriptionsID/resourceGroups/<application-gateway>/providers/Microsoft.Network/applicationGateways/<application-gateway>/backendHttpSettingsCollection/HTTPS-Resource",
            "name": null,
            "path": null,
            "pickHostNameFromBackendAddress": null,
            "port": null,
            "probe": null,
            "probeEnabled": null,
            "protocol": null,
            "provisioningState": null,
            "requestTimeout": null,
            "resourceGroup": "<application-gateway>",
            "trustedRootCertificates": null,
            "type": null
          },
          "servers": [
            {
              "address": "pvIP",
              "health": "Unhealthy",
              "healthProbeLog": "Cannot connect to backend server. Check whether any NSG/UDR/Firewall is blocking access to the server. Check if application is running on correct port. To learn more visit - https://aka.ms/servernotreachable.",
              "ipConfiguration": null
            }
          ]
        }
      ]
    }
  ]
}

它清楚地显示(“健康”:“不健康”)..

我们非常感谢所有反馈:-)

Answer 1

healthProbeLog 字段是您应该开始此调查的地方。它说:

"healthProbeLog": "无法连接到后端服务器。检查是否有任何 NSG/UDR/防火墙阻止对服务器的访问。检查应用程序是否在正确的端口上运行。要了解更多信息，请访问 - https://又名.ms/servernotreachable。”

应用程序网关将运行状况探测发送到后端实例。 AppGW 可能“不健康”，并会针对这些运行状况探测遇到的任何问题抛出 502。问题可能是后端的证书错误、探针的 SSL 握手失败，或者，就像您的情况一样，AppGW 根本没有获得运行状况探针的任何响应。

您的错误意味着 AppGW 正在向后端发送运行状况探测，但它根本没有响应。这可能有很多根本原因

• AppGW 没有到后端的良好网络路由。检查路由
• 后端前面有一个防火墙，正在丢弃运行状况探测流量
• 后端应用程序已死亡/停止，因此没有任何监听可以回复探测
• 还有更多原因

我建议遵循此Microsoft troubleshooting guide for AppGW 502s开始吧。