How to configure Outbound NSG for application gateway

Question

How to configure Outbound NSG for application gateway

heng yeow (nova) 90

I want to configure the custom error pages for my listener in application gateway. The static .html page is in another VM which is different virtual network with application gateway.

When running the "connection troubleshoot" tool, I noticed the "Outbound NSG diagnostic" status is Denny. How to resolve it?

Please refer to the information below:

User's image

User attachment My application gateway firewall is using "Standard V2". User's image

My application gate way's Virtual network/subnet : fornaxNet / fornaxNetSub

I have created Peerings to connect to the VM (in another Virtual network)

User's image

The VM is in Virtual network/subnet : SPD-SIT-Network/SPD-SIT-Subnet1

Have also created the Peering.

User's image

Allan Solomon Mejia 10,545 Reputation points

2026-10-14T22:33:27.07+00:00
Hello @heng yeow (nova)

Thanks for sharing the network configuration and screenshots.

Since your Application Gateway Standard_v2 and the VM hosting your HTML page are deployed in separate virtual networks, and you've already configured VNet peering, focus on the effective outbound NSG rule and connectivity to the destination VM.

The Outbound NSG diagnostic: Deny result suggests that an NSG rule is blocking the tested connection. However, we should identify the specific rule before making any changes.

1. Verify the outbound NSG rules

In the Azure portal, navigate to Network security groups > [Application Gateway subnet NSG] > Outbound security rules.

Check whether an explicit Deny rule takes precedence over the default Allow rules.

One important consideration is your Application Gateway deployment type:

Standard_v2 without Network Isolation: Microsoft requires outbound Internet connectivity and does not support outbound NSG rules that deny connectivity.

Application Gateway with Network Isolation enabled: More restrictive outbound NSG rules are supported, including rules that allow specific backend destinations.

For a Network Isolation-enabled deployment, you can configure an outbound Allow rule for the destination VM using the following values:

For a standard deployment without Network Isolation, avoid adding restrictive outbound Deny rules that conflict with Microsoft's documented Application Gateway requirements.

2. Verify connectivity across the peered VNets

Since you've already configured peering between fornaxNet and SPD-SIT-Network, check that both peering connections are established and that the relevant virtual network traffic is permitted.

Also verify the destination VM's NSG inbound rules. The VM must permit connections from the Application Gateway subnet on the port where the web server is listening.

VNet peering provides network connectivity, but it doesn't automatically override NSG restrictions.

3. Verify the backend web server

Confirm that the VM hosting the HTML page is running a web server and that the page is accessible using the VM's private IP address and configured HTTP/HTTPS port.

You can use Azure Network Watcher Connection Troubleshoot to test the destination VM's private IP and port.

If the test still reports Outbound NSG diagnostic: Deny, review the NSG rules affecting the tested source and destination before making further changes.

4. Check the custom error page configuration

Another important point about your intended design.

Azure Application Gateway custom error pages are configured using a publicly accessible URL to an HTML file. The gateway retrieves the file and stores it locally for use when displaying custom error responses.

Therefore, hosting the HTML page only on a private VM in a peered VNet doesn't satisfy the documented custom error page URL requirement.

If your goal is to configure a custom error page, consider hosting the static HTML file at a publicly accessible HTTPS endpoint, such as Azure Blob Storage, rather than relying on private VNet connectivity.

Additional clarification

Could you confirm:

Is Network Isolation enabled on your Application Gateway Standard_v2 deployment?

Which NSG rule is reported as denying the connection?

Are you using the VM as a backend server, or only as the host for the custom error page?

This distinction is important because the networking requirements for backend connectivity and custom error page retrieval are different.

Hope this helps clarify the configuration.

References:

Application Gateway infrastructure configuration

Private Application Gateway deployment

Application Gateway custom error pages

Azure Network Watcher Connection Troubleshoot

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.
heng yeow (nova) 90 Reputation points

2026-10-15T04:20:12.0533333+00:00
In the Azure portal, navigate to Network security groups > [Application Gateway subnet NSG] > Outbound security rules.
Hi Allan Solomon Mejia, thanks for the reply, but I couldn't locate my Application Gateway subnet NSG. Please assist how to proceed.

Could you confirm:

Is Network Isolation enabled on your Application Gateway Standard_v2 deployment?

Which NSG rule is reported as denying the connection?

Are you using the VM as a backend server, or only as the host for the custom error page?

How to check the Network Isolation whether is enabled?

In the screenshot I provided, it is only mentions Outbound NSG diagnostic status is "deny" without giving additional info, hence I also not sure which NSG rule is reported as deny.

The application gateway acts as a web traffic load balancer for my project hosted in VM-1, my VM-1 will not be up every day. Hence, I'm trying to configure a custom error page (502 error code) to display a maintenance message when my VM-1 is down. So, the static HTML page I plan to host on VM-2.

If your goal is to configure a custom error page, consider hosting the static HTML file at a publicly accessible HTTPS endpoint, such as Azure Blob Storage, rather than relying on private VNet connectivity.

The application gateway acts as a web traffic load balancer for my project hosted in VM-1, my VM-1 will not be up every day. Hence, I'm trying to configure a custom error page (502 error code) to display a maintenance message when my VM-1 is down. So, the static HTML page I plan to host on VM-2. My VM-2 has public IP; will my approach work? Or do I still need to use Azure Blob Storage?
Allan Solomon Mejia 10,545 Reputation points

2026-10-15T15:06:29.4+00:00
Hi @heng yeow (nova)

Thanks for clarifying your setup and what you're trying to achieve.

Since your goal is to display a maintenance page when VM-1 is unavailable, Azure Application Gateway's custom error page feature is designed for this scenario. You don't necessarily need VM-2 to act as another backend server.

Let me address your questions.

Where can you find the Application Gateway subnet NSG?

In the Azure portal:

Open your Application Gateway resource.

Under Settings > Configuration, identify the virtual network and subnet associated with your Application Gateway.

Navigate to Virtual networks > Your VNet > Subnets.

Select the Application Gateway subnet and check its associated Network security group.

If no NSG is associated with that subnet, there won't be an Application Gateway subnet NSG to open. An NSG isn't automatically created for every subnet.

How do you check Network Isolation?

Network Isolation is part of the private Application Gateway deployment capability.

You can review your deployment against the requirements in the Private Application Gateway deployment documentation.

For now, I don't recommend changing your network configuration simply because the diagnostic displays Outbound NSG: Deny, particularly since we haven't identified the specific rule or traffic flow being evaluated.

Can you host the maintenance page on VM-2?

Yes, provided the HTML page is publicly accessible.

It supports hosting custom error pages on a virtual machine or Azure Blob Storage.

Since VM-2 already has a public IP address, you can use it to host the maintenance page, provided:

The HTML file is accessible through a public HTTP or HTTPS URL.

The URL returns HTTP 200 when accessed.

The file uses an .htm or .html extension.

The HTML file is smaller than 1 MB.

Any externally referenced images or CSS files are publicly accessible.

You don't have to move the page to Azure Blob Storage if VM-2 meets these requirements.

Configure the custom 502 error page

Once the maintenance page is publicly accessible:

Open your Application Gateway resource in the Azure portal.

Select Listeners.

Choose the listener associated with your application.

Under Custom error pages, configure the publicly accessible URL for HTTP 502.

Save the configuration.

Application Gateway downloads the HTML file and caches it locally. When Application Gateway itself generates a 502 response, it can display your custom maintenance page.

This means VM-2 doesn't need to receive each maintenance-page request. However, if the page references external images or stylesheets, clients must still be able to access those resources.

One important limitation: Custom error pages apply to errors generated by Application Gateway, not HTTP errors returned directly by your backend application.

My recommendation: Since VM-2 already has a public IP, you can use it to host your static maintenance page. Verify that the public URL returns HTTP 200, then configure it as the custom 502 error page on your Application Gateway listener.

This should meet your requirement without introducing additional backend routing changes.

Hope this clarifies the configuration!

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.

Your answer

heng yeow (nova) 90 Reputation points

2026-10-15T04:20:12.0533333+00:00

In the Azure portal, navigate to Network security groups > [Application Gateway subnet NSG] > Outbound security rules.
Hi Allan Solomon Mejia, thanks for the reply, but I couldn't locate my Application Gateway subnet NSG. Please assist how to proceed.

Could you confirm:

Is Network Isolation enabled on your Application Gateway Standard_v2 deployment?

Which NSG rule is reported as denying the connection?

Are you using the VM as a backend server, or only as the host for the custom error page?

How to check the Network Isolation whether is enabled?

In the screenshot I provided, it is only mentions Outbound NSG diagnostic status is "deny" without giving additional info, hence I also not sure which NSG rule is reported as deny.

The application gateway acts as a web traffic load balancer for my project hosted in VM-1, my VM-1 will not be up every day. Hence, I'm trying to configure a custom error page (502 error code) to display a maintenance message when my VM-1 is down. So, the static HTML page I plan to host on VM-2.

If your goal is to configure a custom error page, consider hosting the static HTML file at a publicly accessible HTTPS endpoint, such as Azure Blob Storage, rather than relying on private VNet connectivity.

The application gateway acts as a web traffic load balancer for my project hosted in VM-1, my VM-1 will not be up every day. Hence, I'm trying to configure a custom error page (502 error code) to display a maintenance message when my VM-1 is down. So, the static HTML page I plan to host on VM-2. My VM-2 has public IP; will my approach work? Or do I still need to use Azure Blob Storage?