Edit

Routing architecture overview

  • Article

Azure Front Door traffic routing takes place over multiple stages. First, traffic is routed from the client to the Front Door. Then, Front Door uses your configuration to determine the origin to send the traffic to. The Front Door web application firewall, routing rules, rules engine, and caching configuration can all affect the routing process.

The following diagram illustrates the routing architecture:

Diagram that shows the Front Door routing architecture, including each step and decision point.

Important

Azure Front Door (classic) will be retired on March 31, 2027. To avoid any service disruption, it is important that you migrate your Azure Front Door (classic) profiles to Azure Front Door Standard or Premium tier by March 2027. For more information, see Azure Front Door (classic) retirement.

Diagram that shows the Front Door routing architecture, including each step and decision point.

The rest of this article describes these steps in detail.

Select and connect to the Front Door edge location

The user or client application initiates a connection to the Front Door. The connection terminates at an edge location closest to the end user. Front Door's edge location processes the request.

For more information about how requests are made to Front Door, see Front Door traffic acceleration.

Match request to a Front Door profile

When Front Door receives an HTTP request, it uses the request's Host header to match the request to the correct customer's Front Door profile. If the request is using a custom domain name, the domain name must be registered with Front Door to enable requests to get matched to your profile.

Match request to a front door

When Front Door receives an HTTP request, it uses the request's Host header to match the request to the correct customer's Front Door instance. If the request is using a custom domain name, the domain name must be registered with Front Door to enable requests to get matched to your Front door.

The client and server perform a TLS handshake using the TLS certificate you've configured for your custom domain name, or by using the Front Door certificate when the Host header ends with *.azurefd.net.

Evaluate WAF rules

If your domain has enabled the Web Application Firewall, WAF rules are evaluated.

If your frontend has enabled the Web Application Firewall, WAF rules are evaluated.

If a rule has been violated, Front Door returns an error to the client and the request processing stops.

Match a route

Front Door matches the request to a route. Learn more about the route matching process.

The route specifies the origin group that the request should be sent to.

Match a routing rule

Front Door matches the request to a routing rule. Learn more about the route matching process.

The route specifies the backend pool that the request should be sent to.

Evaluate rule sets

If you have defined rule sets for the route, they're executed in the order they're configured. Rule sets can override the origin group specified in a route. Rule sets can also trigger a redirection response to the request instead of forwarding it to an origin.

Evaluate rules engines

If you have defined rules engines for the route, they're executed in the order they're configured. Rules engines can override the backend pool specified in a routing rule. Rules engines can also trigger a redirection response to the request instead of forwarding it to a backend.

Return cached response

If the Front Door routing rule has caching enabled, and the Front Door edge location's cache includes a valid response for the request, then Front Door returns the cached response.

If caching is disabled or no response is available, the request is forwarded to the origin.

If the Front Door routing rule has caching enabled, and the Front Door edge location's cache includes a valid response for the request, then Front Door returns the cached response.

If caching is disabled or no response is available, the request is forwarded to the backend.

Select origin

Front Door selects an origin to use within the origin group. Origin selection is based on several factors, including:

Forward request to origin

Finally, the request is forwarded to the origin.

Select backend

Front Door selects a backend to use within the backend pool. Backend selection is based on several factors, including:

Forward request to backend

Finally, the request is forwarded to the backend.

Next steps