Azure Front Door and CDN Profiles

Azure Front Door is a global, scalable entry point that uses HTTP/S and layer 7 routing to direct traffic to your application backends. It operates at the edge of Microsoft's global network, providing capabilities like SSL termination, path-based routing, URL rewrite, session affinity, and Web Application Firewall (WAF) policies. Front Door is not a load balancer in the traditional sense; it is an application delivery controller (ADC) that routes traffic based on the request URL, headers, and cookies, not just source IP. It supports multi-region deployment and can failover automatically if a backend becomes unhealthy.

Front Door uses a routing engine that evaluates each incoming request against a set of routing rules. Each rule has a frontend host (e.g., myapp.azurefd.net), a path pattern (e.g., /api/*), and a backend pool. The routing process: 1. Request arrives at the nearest edge location (POP) based on Anycast DNS. 2. Front Door inspects the Host header and path. 3. It matches against the first rule with a matching frontend host and path pattern. 4. It selects a backend from the pool using the configured routing method (latency, priority, or weighted). 5. It forwards the request, optionally rewriting the URL or adding headers.

# Create a Front Door profile
az network front-door create --name myFrontDoor --resource-group myRG --backend-address 10.0.0.4:80

# Add a frontend endpoint
az network front-door frontend-endpoint create --front-door-name myFrontDoor --resource-group myRG --name myFrontend --host-name myapp.azurefd.net

# Add a backend pool
az network front-door backend-pool create --front-door-name myFrontDoor --resource-group myRG --name myBackendPool --backends '[{"address":"10.0.0.4","httpPort":80,"httpsPort":443}]' --load-balancing-settings '{"sampleSize":4,"successfulSamplesRequired":3}' --health-probe-settings '{"path":"/","protocol":"Http","intervalInSeconds":30}'

# Add a routing rule
az network front-door routing-rule create --front-door-name myFrontDoor --resource-group myRG --name myRule --frontend-endpoints myFrontend --backend-pool myBackendPool --accepted-protocols Http Https --patterns '/*'

Azure Content Delivery Network (CDN) is a distributed network of servers that caches content closer to users. It supports two products: Azure CDN Standard from Microsoft (integrated with Azure) and Azure CDN from Verizon (premium features). CDN is optimized for static content (images, CSS, JS, videos) but can also accelerate dynamic content with dynamic site acceleration (DSA).

When a user requests content: 1. DNS resolves the CDN endpoint (e.g., mycdn.azureedge.net) to the nearest POP. 2. The POP checks its cache. If the content is cached and not expired, it returns it directly (cache hit). 3. If not cached (cache miss), the POP requests the content from the origin server, caches it according to Cache-Control headers, and serves it to the user. 4. Subsequent requests for the same content are served from cache until it expires.

# Create a CDN profile
az cdn profile create --name myCDN --resource-group myRG --sku Standard_Microsoft

# Create an endpoint
az cdn endpoint create --name myEndpoint --profile-name myCDN --resource-group myRG --origin www.example.com --origin-host-header www.example.com

# Add a custom domain
az cdn custom-domain create --endpoint-name myEndpoint --profile-name myCDN --resource-group myRG --host-name www.mycustomdomain.com

# Purge cache
az cdn endpoint purge --endpoint-name myEndpoint --profile-name myCDN --resource-group myRG --content-paths '/*'

Front Door is your choice when you need:

CDN is your choice when you need:

They can be combined: Place Front Door in front of CDN to add routing and WAF, while CDN caches static content. However, this adds latency due to extra hop. Typically, you use one or the other based on primary need.

A large e-commerce company with users worldwide deploys Azure Front Door to route traffic to two regional backend deployments: one in US East (primary) and one in West Europe (secondary). They use latency-based routing to send users to the nearest healthy backend. The platform serves both dynamic API calls and static images. They configure caching rules: for /images/*, cache for 24 hours; for /api/*, no caching. They also enable WAF to block SQL injection attempts. During a regional outage, Front Door automatically fails over to the secondary region within 90 seconds (3 health probe intervals). The company monitors Front Door metrics (request count, latency, health probe status) in Azure Monitor. Misconfiguration: Initially, they set the health probe path to the root '/' which returned a 200 even when the database was down, causing traffic to be sent to a broken backend. They fixed it by creating a dedicated /health endpoint that checks database connectivity.

A video streaming service uses Azure CDN from Verizon to deliver video files (MP4, HLS) to millions of users. They set up a CDN endpoint with origin pointing to Azure Blob Storage. They enable compression for text files and set cache expiration to 7 days for video files. To handle live streaming, they use dynamic site acceleration (DSA) which optimizes TCP and route to reduce latency. They also implement geo-filtering to block content in restricted countries. Common issue: When they updated video files, users still saw old versions because cache hadn't expired. They now use CDN purge to clear cache for specific files after updates. Purge is limited to 50 paths per minute, so they use wildcard purges sparingly.

A SaaS provider combines Front Door and CDN. They use Front Door for global load balancing and routing to regional App Services. For static assets (JavaScript, CSS), they use Azure CDN from Microsoft with a custom domain. They configure Front Door to forward requests for /static/* directly to the CDN endpoint (by setting the backend to the CDN endpoint). This offloads static content delivery from the App Service. However, they found that double caching (Front Door and CDN) caused issues with cache invalidation. They resolved by disabling caching on Front Door for the /static/* rule and relying solely on CDN. Performance improved by 40% for static assets.